ThreatX

The ThreatX integration allows automated enforcement and intel gathering actions.

Network Security · ThreatX

Details

IDThreatX
ProviderA10 Networks
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use the ThreatX integration to enrich intel and automate enforcement actions on the ThreatX Next Gen WAF.

 

Use Cases

  • Add and remove CIDR ranges and IP addresses to various block lists or the allow list
  • Gather Entity metadata for intel enrichment and DBot scoring
  • Set Entity notes for SOC integration or further automation

 

Configure ThreatX on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for ThreatX.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Customer Name: Contact the ThreatX SOC for your Customer Name
    • ThreatX Server URL (e.g., https://provision.threatx.io/ )
    • API Key: Contact the ThreatX SOC for your API Key
    • DBot Score Threshold: Set the threshold ThreatX Risk score (1 to 100) which will be translated to Malicious DBot scores. Default is 70.
    • Use system proxy settings
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

 

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

 

  1. Temporarily block an IP address or CIDR: threatx-block-ip
  2. Unblock an IP address or CIDR: threatx-unblock-ip
  3. Block list an IP address or CIDR: threatx-blacklist-ip
  4. Remove an IP address or CIDR from the block list: threatx-unblacklist-ip
  5. Add an IP address or CIDR to allow list: threatx-whitelist-ip
  6. Remove an IP address or CIDR from the allow list: threatx-unwhitelist-ip
  7. Get entity information: threatx-get-entities
  8. Get entity notes: threatx-get-entity-notes
  9. Add a note to an entity: threatx-add-entity-note

 

1. Temporarily block an IP address or CIDR

 

Temporarily blocks an IP address or CIDR.

 

Base Command

 

threatx-block-ip

 

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required
description The description of the IP record in the block list. The default value is: "Added by ThreatX Cortex XSOAR Integration". Optional

 

Context Output 
Path Type Description
IP.Address string IP address or CIDR that was blocked.

 

Command Example 
!threatx-block-ip ip=12.12.12.12

 

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Blocklist entry for ip 12.12.12.12 added

  

2. Unblock an IP address or CIDR

Unblocks a blocked IP address or CIDR.

Base Command

threatx-unblock-ip

Input 
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

  

Context Output
Path Type Description
IP.Address string IP address or CIDR that was unblocked.

 

Command Example 
!threatx-unblock-ip ip=12.12.12.12

 

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Block list entry for ip 12.12.12.12 removed

 

3. Block list an IP address or CIDR 

Adds an IP address or CIDR to the block list. 

Base Command

threatx-blacklist-ip

Input
Argument Name Description Required
ip IP address or CIDR in CSV format, for example: "10.1.1.1,10.1.1.0/24". Required
description The description of the IP record in the block list. The default value is: "Added by ThreatX Cortex XSOAR Integration". Optional

 

Context Output
Path Type Description
IP.Address string IP address or CIDR that was added to the blacklist.

 

Command Example
!threatx-blacklist-ip ip=12.12.12.12

 

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Block list entry for ip 12.12.12.12 added

 

4. Remove an IP address or CIDR from the block list

Removes an IP address or CIDR from the block list.

Base Command

threatx-unblacklist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

 

Context Output 
Path Type Description
IP.Address string IP address or CIDR that was removed from the block list.

 

Command Example
!threatx-unblacklist-ip ip=12.12.12.12
Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Block list entry for ip 12.12.12.12 removed

 

5. Add an IP address or CIDR to allow list

 Adds an IP address or CIDR to the allow list.

Base Command

threatx-whitelist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required
description The description of the IP record in the allow list. The default value is: "Added by ThreatX Cortex XSOAR Integration". Optional

 

Context Output 
Path Type Description
IP.Address string IP address or CIDR was added to the allow list.

 

Command Example 
!threatx-whitelist-ip ip=12.12.12.12

 

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Whitelist entry for ip 12.12.12.12 added

 

6. Remove an IP address or CIDR from the allow list

Removes an IP address or CIDR from the allow list. 

Base Command

threatx-unwhitelist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

 

Context Output 
Path Type Description
IP.Address string IP address or CIDR that was removed from the allow list.

 

Command Example
!threatx-unwhitelist-ip ip=12.12.12.12

 

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

 

Human Readable Output
Result
Allow list entry for ip 12.12.12.12 removed

 

7. Get entity information

Returns high-level entity information by Entity ID, Entity Name, or Entity IP.

Base Command

threatx-get-entities

Input
Argument Name Description Required
timeframe Look-back timeframe for the query. Options are 1-Hour, 1-Day, 1-Week, 1-Month, or 3-Months. Note: long look-back timeframes for a large number of Entities can timeout. Required
entity_name CSV list of Entity names. Optional
entity_id CSV list of Entity ID hashes. Optional
entity_ip CSV list of Entity IP addresses. Optional

 

Context Output 
Path Type Description
Threatx.Entity.ID string ID hash of the Entity
Threatx.Entity.Name string Name of the Entity
Threatx.Entity.IP string IP address of the Entity
Threatx.Entity.Risk integer Risk score of the Entity

 

Command Example 
!threatx-get-entities timeframe=1-Day entity_name=CynicalGraaf,OveconfidentRas

 

Context Example
{
    "Threatx": {
        "Entity": [
            {
                "ID": "1061035762581303669",
                "Name": "OveconfidentRas",
                "Risk": 0,
                "IP": [
                    201.93.212.87
                ]
            },
            {
                "ID": "566056709675514809",
                "Name": "CynicalGraaf",
                "Risk": 0,
                "IP": [
                    1.125.227.13
                ]
            }
        ]
    }
}

 

Human Readable Output
ThreatX Risk Score IP Addresses Name ID
0 201.93.212.87 OveconfidentRas 1061035762581303669
55 1.125.227.13 CynicalGraaf 566056709675514809

  

8. Get entity notes

Returns the notes attached to an entity by Entity ID. 

Base Command

threatx-get-entity-notes

Input
Argument Name Description Required
entity_id ID hash of the Entity. To retrieve this value, run the threatx-get-entities command. Required

 

Context Output
Path Type Description
Threatx.Entity.ID string ID hash of the Entity
Threatx.Entity.Note.content string Content of the Note
Threatx.Entity.Note.timestamp string Timestamp of the Note
Threatx.Entity.Note.username string Author of the Note

 

Command Example 
!threatx-get-entity-notes entity_id=566056709675514809

 

Context Example
{
    "Threatx": {
        "Entity": [
            {
                "ID": "566056709675514809",
                "Note": [
                    {
                        "content": "Demisto test note.",
                        "entity_id": "566056709675514809",
                        "timestamp": "2019-05-31 18:41:09",
                        "username": "user@domain.com"
                    }
                ]
            }
        ]
    }
}

 

Human Readable Output
Username Timestamp Entity Id Content
user@domain.com 2019-05-31 18:41:09 566056709675514809 Demisto test note.
user@domain.com 2019-05-30 23:36:23 566056709675514809 this is a test note
user@domain.com 2019-05-12 21:36:12 566056709675514809 Another test note
user@domain.com 2019-05-12 21:34:48 566056709675514809 test-note-from-demisto

  

9. Add a note to an entity

Adds a new note to an entity.

Base Command

threatx-add-entity-note

Input
Argument Name Description Required
entity_id ID hash of the Entity. To retrieve this value, run the threatx-get-entities command. Required
message Contents of the note. Required

 

Context Output

There is no context output for this command. 

Command Example
!threatx-add-entity-note entity_id=566056709675514809 message="test note."

 

Human Readable Output
Result
Note for Entity<id=566056709675514809> created

Configuration parameters

  • url — ThreatX Server URL (e.g., https://provision.threatx.io) (required)
  • customer_name — Customer Name
  • api_key — API Key
  • credentials — Customer Name
  • dbot_threshold — IP Threshold. Minimum risk score from ThreatX to consider the IP malicious. (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (9)

  • threatx-add-entity-note

    Add a new note to the entity. For example: !threatx-add-entity-note entity_id=566056709695514809 message="test note"

  • threatx-blacklist-ip

    Adds an IP address or CIDR to the block list.

  • threatx-block-ip

    Temporarily blocks an IP address or CIDR. Default is 30 minutes.

  • threatx-get-entities

    Get high-level Entity information using the Entity ID, Entity Name, or Entity IP. For example: !threatx-get-entities timeframe=1-Day entity_name=CynicalGraaf,MJ12Bot entity_id= 566056709675514809 entity_ip=12.12.12.12,14.14.14.14. Note: long look-back timeframes for a large number of Entities can timeout.

  • threatx-get-entity-notes

    Returns the notes attached to an Entity, by Entity ID.

  • threatx-unblacklist-ip

    Removes an IP or CIDR from the block list.

  • threatx-unblock-ip

    Unblocks a blocked IP address or CIDR.

  • threatx-unwhitelist-ip

    Removes an IP address or CIDR from the allow list.

  • threatx-whitelist-ip

    Adds an IP address or CIDR to the allow list.

Source

ThreatX.py ThreatX_test.py ThreatX.yml ThreatX_description.md
Download History Raw 
category: Network Security
provider: A10 Networks
commonfields:
  id: ThreatX
  version: -1
configuration:
- defaultvalue: https://provision.threatx.io
  display: ThreatX Server URL (e.g., https://provision.threatx.io)
  name: url
  required: true
  type: 0
- display: Customer Name
  name: customer_name
  type: 0
  hidden: true
  required: false
- display: API Key
  name: api_key
  type: 4
  hidden: true
  required: false
- name: credentials
  type: 9
  display: Customer Name
  displaypassword: API Key
  required: false
- defaultvalue: '70'
  display: IP Threshold. Minimum risk score from ThreatX to consider the IP malicious.
  name: dbot_threshold
  required: true
  type: 0
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8

  required: false
description: The ThreatX integration allows automated enforcement and intel gathering actions.
display: ThreatX
name: ThreatX
script:
  commands:
  - arguments:
    - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".'
      name: ip
      required: true
    - defaultValue: 'Added by ThreatX Demisto Integration'
      description: 'The description of the IP record in the block list.'
      name: description
    description: Temporarily blocks an IP address or CIDR. Default is 30 minutes.
    execution: true
    name: threatx-block-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR that was blocked.
      type: string
  - arguments:
    - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".'
      name: ip
      required: true
    description: Unblocks a blocked IP address or CIDR.
    execution: true
    name: threatx-unblock-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR that was unblocked.
      type: Unknown
  - arguments:
    - description: 'IP address or CIDR in CSV format, for example: "10.1.1.1,10.1.1.0/24".'
      isArray: true
      name: ip
      required: true
    - defaultValue: 'Added by ThreatX Demisto Integration'
      description: 'The description of the IP record in the block list.'
      name: description
    description: Adds an IP address or CIDR to the block list.
    execution: true
    name: threatx-blacklist-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR that was added to the block list.
      type: string
  - arguments:
    - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".'
      name: ip
      required: true
    description: Removes an IP or CIDR from the block list.
    execution: true
    name: threatx-unblacklist-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR that was removed from the block list.
      type: string
  - arguments:
    - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".'
      name: ip
      required: true
    - defaultValue: 'Added by ThreatX Demisto Integration'
      description: 'The description of the IP record in the allow list.'
      name: description
    description: Adds an IP address or CIDR to the allow list.
    execution: true
    name: threatx-whitelist-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR was added to the allow list.
      type: string
  - arguments:
    - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".'
      name: ip
      required: true
    description: Removes an IP address or CIDR from the allow list.
    execution: true
    name: threatx-unwhitelist-ip
    outputs:
    - contextPath: IP.Address
      description: IP address or CIDR that was removed from the allow list.
      type: string
  - arguments:
    - description: CSV list of Entity names.
      name: entity_name
    - description: CSV list of Entity ID hashes.
      name: entity_id
    - description: CSV list of Entity IP addresses.
      name: entity_ip
    - auto: PREDEFINED
      defaultValue: 1-Hour
      description: 'Look-back timeframe for the query. Options are 1-Hour, 1-Day, 1-Week, 1-Month, or 3-Months. Note: long look-back timeframes for a large number of Entities can timeout.'
      name: timeframe
      predefined:
      - 1-Hour
      - 1-Day
      - 1-Week
      - 1-Month
      - 3-Months
      required: true
    description: 'Get high-level Entity information using the Entity ID, Entity Name, or Entity IP. For example: !threatx-get-entities timeframe=1-Day entity_name=CynicalGraaf,MJ12Bot entity_id= 566056709675514809 entity_ip=12.12.12.12,14.14.14.14. Note: long look-back timeframes for a large number of Entities can timeout.'
    name: threatx-get-entities
    outputs:
    - contextPath: Threatx.Entity.ID
      description: ID hash of the entity.
      type: string
    - contextPath: Threatx.Entity.Name
      description: Name of the entity.
      type: string
    - contextPath: Threatx.Entity.IP
      description: IP address of the entity.
      type: string
    - contextPath: Threatx.Entity.Risk
      description: Risk score of the entity.
      type: Unknown
  - arguments:
    - description: 'ID hash of the Entity. Note: this value can be retrieved using the "!threatx-get-entities" command.'
      name: entity_id
      required: true
    description: Returns the notes attached to an Entity, by Entity ID.
    name: threatx-get-entity-notes
    outputs:
    - contextPath: Threatx.Entity.Note
      description: Notes attached to the entity.
      type: number
    - contextPath: Threatx.Entity.ID
      description: ID hash of the entity.
      type: Unknown
    - contextPath: Threatx.Entity.Note.content
      description: Content of the note.
      type: Unknown
    - contextPath: Threatx.Entity.Note.timestamp
      description: Timestamp of the note.
      type: Unknown
    - contextPath: Threatx.Entity.Note.username
      description: Author of the note.
      type: Unknown
  - arguments:
    - description: 'ID hash of the Entity. To retrieve this value, run the "!threatx-get-entities" command.'
      name: entity_id
      required: true
    - description: Contents of the note.
      name: message
      required: true
    description: 'Add a new note to the entity. For example: !threatx-add-entity-note entity_id=566056709695514809 message="test note"'
    execution: true
    name: threatx-add-entity-note
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.0.0
tests:
- No tests (auto formatted)