ThreatMiner

Details

ID	`ThreatMiner`
Provider	ThreatConnect
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Data Mining for Threat Intelligence

Configure ThreatMiner in Cortex

Parameter	Description	Required
Maximum results per query, enter ‘all’ to get unlimited results		False
Source Reliability	Reliability of the source providing the intelligence data.	True
Trust any certificate (not secure)		False
Use system proxy settings		False
ThreatMiner API URL		True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

domain

Retrieves data from ThreatMiner about a specified domain.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name	Description	Required
domain	Domain name to get information for.	Required

Context Output

Path	Type	Description
ThreatMiner.Domain.Whois.Server	string	Whois server address.
ThreatMiner.Domain.Whois.CreateDate	date	Creation date.
ThreatMiner.Domain.Whois.UpdateDate	date	Last update date.
ThreatMiner.Domain.Whois.Expiration	date	Expiration date.
ThreatMiner.Domain.Whois.NameServers	string	Whois name servers.
ThreatMiner.Domain.PassiveDNS.IP	string	Passive DNS IP address.
ThreatMiner.Domain.PassiveDNS.FirstSeen	date	Passive DNS first seen date.
ThreatMiner.Domain.PassiveDNS.LastSeen	date	Passive DNS last seen date.
ThreatMiner.Domain.Subdomains	string	Subdomains.
ThreatMiner.Domain.URI.Address	string	Related URIs.
ThreatMiner.Domain.URI.LastSeen	string	URI last seen date.
ThreatMiner.Domain.MD5	string	Related samples’ MD5 hash.
Domain.Name	string	Searched domain name
ThreatMiner.Domain.Whois.Domain	string	Domain name that was searched.
Domain.DNS	unknown	IPs resolved by DNS.
Domain.Whois.CreateDate	date	Creation date.
Domain.Whois.UpdateDate	date	Last update date.
Domain.Whois.Expiration	date	Expiration date.
Domain.Whois.Registrant.Name	string	Name of the registrant
Domain.Whois.Registrant.Email	string	Email of the registrant
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.

ip

Retrieves data from ThreatMiner about a specified IP address.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to get information for.	Required

Context Output

Path	Type	Description
ThreatMiner.IP.Address	string	IP address that was searched.
ThreatMiner.IP.Whois.Reverse	string	Whois reverse name.
ThreatMiner.IP.Whois.Bgp	string	BGP prefix.
ThreatMiner.IP.Whois.Country	string	Related country.
ThreatMiner.IP.Whois.ASN	string	Related ASN.
ThreatMiner.IP.Whois.Org	string	Organization name.
ThreatMiner.IP.PassiveDNS.Domain	string	PassiveDNS domain.
ThreatMiner.IP.PassiveDNS.FirstSeen	date	Passive DNS first seen date.
ThreatMiner.IP.PassiveDNS.LastSeen	date	Passive DNS last seen date.
ThreatMiner.IP.URI.Address	string	Related URIs.
ThreatMiner.IP.URI.LastSeen	date	URI last seen date.
ThreatMiner.IP.MD5	string	Related samples MD5 hash.
ThreatMiner.IP.SSL	string	SSL certificates.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
IP.Address	unknown	IP address that was searched.
IP.Geo.Country	unknown	Related country.
IP.ASN	unknown	Related ASN.

file

Retrieves data from ThreatMiner about a specified file.

Base Command

file

Input

Argument Name	Description	Required
file	File hash (md5, sha1, sha256).	Required
threshold	If ThreatScore is greater or equal than the threshold, then file will be considered malicious. Default is 10.	Optional

Context Output

Path	Type	Description
ThreatMiner.File.MD5	string	File MD5 hash.
ThreatMiner.File.SHA1	string	File SHA1 hash.
ThreatMiner.File.SHA256	string	File SHA256 hash.
ThreatMiner.File.Type	string	File type.
ThreatMiner.File.Name	string	File name.
ThreatMiner.File.Architecture	string	File architecture.
ThreatMiner.File.Size	string	File size.
ThreatMiner.File.Analyzed	date	File analyzed date.
ThreatMiner.File.HTTP.Domain	string	HTTP traffic to domain.
ThreatMiner.File.HTTP.URL	string	HTTP traffic to URL.
ThreatMiner.File.HTTP.Useragent	string	HTTP user agent.
ThreatMiner.File.Domains.IP	string	Related IP address.
ThreatMiner.File.Domains.Domain	string	Related domain name.
ThreatMiner.File.Mutants	string	Used mutexes.
ThreatMiner.File.Registry	string	Used registry keys.
ThreatMiner.File.AV.Name	string	Detected AV name.
ThreatMiner.File.AV.Detection	string	AV detection.
File.MD5	string	File MD5 hash.
File.SHA1	string	File SHA1 hash.
File.SHA256	string	File SHA256 hash.
File.Malicious.Detections	number	For malicious files, the total number of detections.
File.Malicious.Vendor	string	For malicious files, the vendor that made the decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
File.Name	string	File name.

Configuration parameters

limit_results — Maximum results per query, enter 'all' to get unlimited results
integrationReliability — Source Reliability (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
threatminer_url — ThreatMiner API URL (required)

Commands (3)

domain
Retrieves data from ThreatMiner about a specified domain.
file
Retrieves data from ThreatMiner about a specified file.
ip
Retrieves data from ThreatMiner about a specified IP address.

Source

ThreatMiner.py ThreatMiner_test.py ThreatMiner.yml ThreatMiner_description.md

Download History Raw

commonfields:
  id: ThreatMiner
  version: -1
name: ThreatMiner
display: ThreatMiner
category: Data Enrichment & Threat Intelligence
provider: ThreatConnect
description: Data Mining for Threat Intelligence.
sectionorder:
  - Connect
  - Collect
configuration:
- display: Maximum results per query, enter 'all' to get unlimited results
  name: limit_results
  defaultvalue: "30"
  type: 0
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  section: Collect
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: ThreatMiner API URL
  name: threatminer_url
  defaultvalue: https://api.threatminer.org/v2/
  type: 0
  required: true
  section: Connect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: domain
    arguments:
    - name: domain
      required: true
      description: Domain name to get information for.
      default: true
      isArray: true
    outputs:
    - contextPath: ThreatMiner.Domain.Whois.Server
      description: Whois server address.
      type: string
    - contextPath: ThreatMiner.Domain.Whois.CreateDate
      description: Creation date.
      type: date
    - contextPath: ThreatMiner.Domain.Whois.UpdateDate
      description: Last update date.
      type: date
    - contextPath: ThreatMiner.Domain.Whois.Expiration
      description: Expiration date.
      type: date
    - contextPath: ThreatMiner.Domain.Whois.NameServers
      description: Whois name servers.
      type: string
    - contextPath: ThreatMiner.Domain.PassiveDNS.IP
      description: Passive DNS IP address.
      type: string
    - contextPath: ThreatMiner.Domain.PassiveDNS.FirstSeen
      description: Passive DNS first seen date.
      type: date
    - contextPath: ThreatMiner.Domain.PassiveDNS.LastSeen
      description: Passive DNS last seen date.
      type: date
    - contextPath: ThreatMiner.Domain.Subdomains
      description: Subdomains.
      type: string
    - contextPath: ThreatMiner.Domain.URI.Address
      description: Related URIs.
      type: string
    - contextPath: ThreatMiner.Domain.URI.LastSeen
      description: URI last seen date.
      type: string
    - contextPath: ThreatMiner.Domain.MD5
      description: Related samples' MD5 hash.
      type: string
    - contextPath: Domain.Name
      description: Searched domain name.
      type: string
    - contextPath: ThreatMiner.Domain.Whois.Domain
      description: Domain name that was searched.
      type: string
    - contextPath: Domain.DNS
      description: IPs resolved by DNS.
    - contextPath: Domain.Whois.CreateDate
      description: Creation date.
      type: date
    - contextPath: Domain.Whois.UpdateDate
      description: Last update date.
      type: date
    - contextPath: Domain.Whois.Expiration
      description: Expiration date.
      type: date
    - contextPath: Domain.Whois.Registrant.Name
      description: Name of the registrant.
      type: string
    - contextPath: Domain.Whois.Registrant.Email
      description: Email of the registrant.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    description: Retrieves data from ThreatMiner about a specified domain.
  - name: ip
    arguments:
    - name: ip
      required: true
      description: IP address to get information for.
      default: true
      isArray: true
    outputs:
    - contextPath: ThreatMiner.IP.Address
      description: IP address that was searched.
      type: string
    - contextPath: ThreatMiner.IP.Whois.Reverse
      description: Whois reverse name.
      type: string
    - contextPath: ThreatMiner.IP.Whois.Bgp
      description: BGP prefix.
      type: string
    - contextPath: ThreatMiner.IP.Whois.Country
      description: Related country.
      type: string
    - contextPath: ThreatMiner.IP.Whois.ASN
      description: Related ASN.
      type: string
    - contextPath: ThreatMiner.IP.Whois.Org
      description: Organization name.
      type: string
    - contextPath: ThreatMiner.IP.PassiveDNS.Domain
      description: PassiveDNS domain.
      type: string
    - contextPath: ThreatMiner.IP.PassiveDNS.FirstSeen
      description: Passive DNS first seen date.
      type: date
    - contextPath: ThreatMiner.IP.PassiveDNS.LastSeen
      description: Passive DNS last seen date.
      type: date
    - contextPath: ThreatMiner.IP.URI.Address
      description: Related URIs.
      type: string
    - contextPath: ThreatMiner.IP.URI.LastSeen
      description: URI last seen date.
      type: date
    - contextPath: ThreatMiner.IP.MD5
      description: Related samples MD5 hash.
      type: string
    - contextPath: ThreatMiner.IP.SSL
      description: SSL certificates.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: IP address that was searched.
    - contextPath: IP.Geo.Country
      description: Related country.
    - contextPath: IP.ASN
      description: Related ASN.
    description: Retrieves data from ThreatMiner about a specified IP address.
  - name: file
    arguments:
    - name: file
      required: true
      description: File hash (md5, sha1, sha256).
      default: true
      isArray: true
    - name: threshold
      description: If ThreatScore is greater or equal than the threshold, then file will be considered malicious.
      defaultValue: "10"
    outputs:
    - contextPath: ThreatMiner.File.MD5
      description: File MD5 hash.
      type: string
    - contextPath: ThreatMiner.File.SHA1
      description: File SHA1 hash.
      type: string
    - contextPath: ThreatMiner.File.SHA256
      description: File SHA256 hash.
      type: string
    - contextPath: ThreatMiner.File.Type
      description: File type.
      type: string
    - contextPath: ThreatMiner.File.Name
      description: File name.
      type: string
    - contextPath: ThreatMiner.File.Architecture
      description: File architecture.
      type: string
    - contextPath: ThreatMiner.File.Size
      description: File size.
      type: string
    - contextPath: ThreatMiner.File.Analyzed
      description: File analyzed date.
      type: date
    - contextPath: ThreatMiner.File.HTTP.Domain
      description: HTTP traffic to domain.
      type: string
    - contextPath: ThreatMiner.File.HTTP.URL
      description: HTTP traffic to URL.
      type: string
    - contextPath: ThreatMiner.File.HTTP.Useragent
      description: HTTP user agent.
      type: string
    - contextPath: ThreatMiner.File.Domains.IP
      description: Related IP address.
      type: string
    - contextPath: ThreatMiner.File.Domains.Domain
      description: Related domain name.
      type: string
    - contextPath: ThreatMiner.File.Mutants
      description: Used mutexes.
      type: string
    - contextPath: ThreatMiner.File.Registry
      description: Used registry keys.
      type: string
    - contextPath: ThreatMiner.File.AV.Name
      description: Detected AV name.
      type: string
    - contextPath: ThreatMiner.File.AV.Detection
      description: AV detection.
      type: string
    - contextPath: File.MD5
      description: File MD5 hash.
      type: string
    - contextPath: File.SHA1
      description: File SHA1 hash.
      type: string
    - contextPath: File.SHA256
      description: File SHA256 hash.
      type: string
    - contextPath: File.Malicious.Detections
      description: For malicious files, the total number of detections.
      type: number
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: File.Name
      description: File name.
      type: string
    description: Retrieves data from ThreatMiner about a specified file.
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- ThreatMiner-Test
fromversion: 5.0.0