TruSTAR v2 Deprecated

Deprecated. Not supported since TrueSTAR was acquired by Splunk, No available replacement.

Data Enrichment & Threat Intelligence · TruSTAR (Deprecated)

Details

ID	`TruSTAR v2`
Provider	Cisco Systems
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/trustar:20.2.0.2058885`
Supported Modules	Agentix XSIAM

README

TruSTAR is an Intelligence Management Platform that helps you operationalize data across tools and teams, helping you prioritize investigations and accelerate incident response.
This integration was integrated and tested with version 0.3.31 of TruSTAR v2

Configure TruSTAR v2 in Cortex

Parameter	Description	Required
server	Server URL (e.g. https://api.trustar.co)	True
station	Station URL (e.g. https://station.trustar.co)
key	TruSTAR API Key	True
secret	TruSTAR API Secret	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

trustar-search-indicators

Searches for all indicators that contain the given search term.

Base Command

trustar-search-indicators

Input

Argument Name	Description	Required
search_term	The term to search for (e.g. covid-19)	Optional
enclave_ids	Comma-separated list of enclave ids; (i.e. <enclave1>,<enclave2>,<enclave3>). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command ‘!trustar-get-enclaves’	Optional
from_time	Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. ‘10 minutes ago’, ‘5 days ago’, etc). Based on updated time, and not created time. Default is 1 day ago.	Optional
to_time	End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. ‘10 minutes ago’, ‘5 days ago’, etc). Based on updated time, and not created time. Default is 1 day ago.	Optional
indicator_types	comma-separated indicator types to filter by. e.g. “URL, IP”	Optional
tags	Name (or list of names) of tag(s) to filter indicators by. (i.e. <tag1>,<tag2>,<tag3>). Only indicators containing ALL of these tags will be returned.	Optional
excluded_tags	Indicators containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. <tag1>,<tag2>,<tag3>).	Optional
limit	Limit of results to return. Max value possible is 1000.	Optional

Context Output

Path	Type	Description
TruSTAR.Indicators.indicatorType	string	Indicator type
TruSTAR.Indicators.value	string	Indicator value
File.Name	String	The full file name (including file extension).
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA1 hash of the file.
IP.Address	String	IP address
URL.Data	String	The URL
CVE.ID	String	The ID of the CVE, for example: CVE-2015-1653
Account.Email.Address	String	The email address of the account.
RegistryKey.Path	String	The path to the registry key
Domain.Name	String	The domain name, for example: “google.com”.
DBotScore.Indicator	string	The indicator we tested
DBotScore.Type	string	The type of the indicator
DBotScore.Vendor	string	Vendor used to calculate the score
DBotScore.Score	number	The actual score

Command Example


#### Context Example

{
“DBotScore”: [
{
“Indicator”: “7aef3cfa5a71fb2010d8b7ffca95ccf0”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “f5b9b2828b1cc279700e403b1da7ae6087160c61”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “6b642c67b51809a851c08a019312a84073e5fd2e”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “33cda57b3af3856a31fec725ecad44f9”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “22c864a9597b0112b345ecc2f39b96b39e055728”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “61b73375a486e3ca1a8d3e98434a9623”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “75040606c388b7675adaa17b91fe6e9c”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “9ad5b0aec764c0a9c42b019fdbeac672030ec64d”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “017008c65929cf54ee4a035b490c5f4b”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “c5429e1391d52404eaca77289ead47853e68263d”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://api.intel471.com/v1/download/malwareintel/26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “4f4af35ed47d965bcd1012f2da2d75cd”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “da3111fb65f02659d52900412c8968a342fd19ae”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
}
],
“File”: [
{
“MD5”: “7aef3cfa5a71fb2010d8b7ffca95ccf0”
},
{
“SHA1”: “f5b9b2828b1cc279700e403b1da7ae6087160c61”
},
{
“SHA256”: “b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860”
},
{
“SHA1”: “6b642c67b51809a851c08a019312a84073e5fd2e”
},
{
“MD5”: “33cda57b3af3856a31fec725ecad44f9”
},
{
“SHA256”: “bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d”
},
{
“SHA1”: “22c864a9597b0112b345ecc2f39b96b39e055728”
},
{
“SHA256”: “1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21”
},
{
“MD5”: “61b73375a486e3ca1a8d3e98434a9623”
},
{
“SHA256”: “b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87”
},
{
“MD5”: “75040606c388b7675adaa17b91fe6e9c”
},
{
“SHA1”: “9ad5b0aec764c0a9c42b019fdbeac672030ec64d”
},
{
“MD5”: “017008c65929cf54ee4a035b490c5f4b”
},
{
“SHA1”: “c5429e1391d52404eaca77289ead47853e68263d”
},
{
“SHA256”: “2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab”
},
{
“SHA256”: “26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430”
},
{
“MD5”: “4f4af35ed47d965bcd1012f2da2d75cd”
},
{
“SHA1”: “da3111fb65f02659d52900412c8968a342fd19ae”
}
],
“TruSTAR”: {
“Indicators”: [
{
“indicatorType”: “MD5”,
“value”: “7aef3cfa5a71fb2010d8b7ffca95ccf0”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860.zip”
},
{
“indicatorType”: “MALWARE”,
“value”: “SMOKELOADER”
},
{
“indicatorType”: “SHA1”,
“value”: “f5b9b2828b1cc279700e403b1da7ae6087160c61”
},
{
“indicatorType”: “SHA256”,
“value”: “b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860”
},
{
“indicatorType”: “SHA1”,
“value”: “6b642c67b51809a851c08a019312a84073e5fd2e”
},
{
“indicatorType”: “MD5”,
“value”: “33cda57b3af3856a31fec725ecad44f9”
},
{
“indicatorType”: “SHA256”,
“value”: “bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d.zip”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21.zip”
},
{
“indicatorType”: “SHA1”,
“value”: “22c864a9597b0112b345ecc2f39b96b39e055728”
},
{
“indicatorType”: “SHA256”,
“value”: “1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21”
},
{
“indicatorType”: “MD5”,
“value”: “61b73375a486e3ca1a8d3e98434a9623”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87.zip”
},
{
“indicatorType”: “SHA256”,
“value”: “b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87”
},
{
“indicatorType”: “MD5”,
“value”: “75040606c388b7675adaa17b91fe6e9c”
},
{
“indicatorType”: “SHA1”,
“value”: “9ad5b0aec764c0a9c42b019fdbeac672030ec64d”
},
{
“indicatorType”: “MD5”,
“value”: “017008c65929cf54ee4a035b490c5f4b”
},
{
“indicatorType”: “SHA1”,
“value”: “c5429e1391d52404eaca77289ead47853e68263d”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab.zip”
},
{
“indicatorType”: “SHA256”,
“value”: “2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab”
},
{
“indicatorType”: “SHA256”,
“value”: “26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430”
},
{
“indicatorType”: “URL”,
“value”: “https://api.intel471.com/v1/download/malwareintel/26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430.zip”
},
{
“indicatorType”: “MD5”,
“value”: “4f4af35ed47d965bcd1012f2da2d75cd”
},
{
“indicatorType”: “SHA1”,
“value”: “da3111fb65f02659d52900412c8968a342fd19ae”
}
]
},
“URL”: [
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860.zip”
},
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d.zip”
},
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21.zip”
},
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87.zip”
},
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab.zip”
},
{
“Data”: “https://api.intel471.com/v1/download/malwareintel/26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430.zip”
}
]
}


#### Human Readable Output

>### Results
>
>|indicatorType|value|
>|---|---|
>| MD5 | 7aef3cfa5a71fb2010d8b7ffca95ccf0 |
>| URL | https://api.intel471.com/v1/download/malwareintel/b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860.zip |
>| MALWARE | SMOKELOADER |
>| SHA1 | f5b9b2828b1cc279700e403b1da7ae6087160c61 |
>| SHA256 | b5b10e9b7dc006800dda70d2538d487a737490631b15bd2f5b0448aff6a7b860 |
>| SHA1 | 6b642c67b51809a851c08a019312a84073e5fd2e |
>| MD5 | 33cda57b3af3856a31fec725ecad44f9 |
>| SHA256 | bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d |
>| URL | https://api.intel471.com/v1/download/malwareintel/bb5e7e6f1b1bedd9759b1d16d9f34ff97722706c85df7feb9a7f772121d4508d.zip |
>| URL | https://api.intel471.com/v1/download/malwareintel/1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21.zip |
>| SHA1 | 22c864a9597b0112b345ecc2f39b96b39e055728 |
>| SHA256 | 1bb1a78d2366930a83f94932dc481ec5d24309b3c676902ef2d755c430a67f21 |
>| MD5 | 61b73375a486e3ca1a8d3e98434a9623 |
>| URL | https://api.intel471.com/v1/download/malwareintel/b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87.zip |
>| SHA256 | b45fc4e1523c2bde997dd0c76e7d5124d940b06601556fdd4a42b9cf20357c87 |
>| MD5 | 75040606c388b7675adaa17b91fe6e9c |
>| SHA1 | 9ad5b0aec764c0a9c42b019fdbeac672030ec64d |
>| MD5 | 017008c65929cf54ee4a035b490c5f4b |
>| SHA1 | c5429e1391d52404eaca77289ead47853e68263d |
>| URL | https://api.intel471.com/v1/download/malwareintel/2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab.zip |
>| SHA256 | 2234bc82dd0aa9586b664c4bb679988b653afd8b367f3c8e29f181c37028feab |
>| SHA256 | 26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430 |
>| URL | https://api.intel471.com/v1/download/malwareintel/26113fb83b96dbea7ada873cc84c2a5b66e1bc6761f7011b14e11f1567d4e430.zip |
>| MD5 | 4f4af35ed47d965bcd1012f2da2d75cd |
>| SHA1 | da3111fb65f02659d52900412c8968a342fd19ae |

### trustar-get-enclaves

***
Returns the list of all enclaves that the user has access to, as well as whether they can read, create, and update reports in that enclave.

#### Base Command

`trustar-get-enclaves`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Enclaves.id | string | Enclave type |
| TruSTAR.Enclaves.name | string | Enclave name |
| TruSTAR.Enclaves.type | string | Enclave type |
| TruSTAR.Enclaves.create | Bool | True if I have create permissions on enclave |
| TruSTAR.Enclaves.update | Bool | True if I have update permissions on enclave |
| TruSTAR.Enclaves.read | Bool | True if I have read permissions on enclave |

#### Command Example

```!trustar-get-enclaves```

#### Context Example

{
“TruSTAR”: {
“Enclave”: [
{
“create”: false,
“id”: “ed35f85a-d6bf-4e74-a0f8-61651abf705e”,
“name”: “IBM X-Force”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “1e530a47-c3c0-4d53-b473-9d32fbc096df”,
“name”: “Intel 471 Malware List”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “c12f55c2-7a9e-47a7-951a-6a67d742f72a”,
“name”: “Intel 471 Alerts”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “d2c80d0e-0310-4bdf-9301-b77e660d919d”,
“name”: “NCFTA CyFin”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “19b79707-40a8-4d50-80d0-ce563f1d053d”,
“name”: “SpyCloud”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “82c899e4-1031-4e5a-bb0b-c91a4e95150c”,
“name”: “Flashpoint”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “8335131d-c2e5-4257-8c1b-5bce7991e431”,
“name”: “IT-ISAC”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “e93f119a-7883-4417-bab0-17e7aa593f39”,
“name”: “CrowdStrike Falcon Detection”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “28177710-9cb8-aa2f-29e8-135c14365e80”,
“name”: “Community”,
“read”: true,
“type”: “COMMUNITY”,
“update”: false
},
{
“create”: false,
“id”: “c49f4e9b-478a-451f-9509-af29572b380c”,
“name”: “H-ISAC TLP Amber Alerts”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “919879d7-88b3-4605-9464-b2a8fca5473a”,
“name”: “US-CERT”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “83279ba8-1d6a-4da1-b8cb-696b857668a3”,
“name”: “RiskIQ PassiveTotal”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “7a33144f-aef3-442b-87d4-dbf70d8afdb0”,
“name”: “RH-ISAC”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “fdd13b75-a672-47b7-9957-2ee76d429346”,
“name”: “Digital Shadows”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “b18292c7-ccf1-42f8-912b-37fdbdddcb78”,
“name”: “NCU-ISAO”,
“read”: true,
“type”: “INTERNAL”,
“update”: false
},
{
“create”: false,
“id”: “011ad71b-fd7d-44c2-834a-0d751299fb1f”,
“name”: “VirusTotal”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “c879f089-ffbd-4a2f-8144-d3e8bdbd6981”,
“name”: “Acme SOC - Vetted”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “ed9d7459-dd90-414f-96ee-5e37f232cd18”,
“name”: “Bambenek”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “170c3077-f502-4b1a-b8f7-7538f83a66c1”,
“name”: “Abuse Ransomware”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “fb8dcceb-b1aa-45cd-a5b2-b75352d321dc”,
“name”: “FS-ISAC”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “d2cf82f0-5aba-4cf4-ba3b-fc990829b663”,
“name”: “Packetstorm”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “5d5d1eee-f65f-4fd9-a14b-43c597d9af9e”,
“name”: “Malwarebytes”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: true,
“id”: “3688a99c-0272-4ca6-848a-104dfe929555”,
“name”: “ND_ISAC”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “b0a7be7b-a847-4597-9e1d-20ae18c344ea”,
“name”: “COVID-19 OSINT Community Enclave”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “0092174d-25c0-4d9e-ae7e-7d5031643df0”,
“name”: “Blackfish”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “71001c42-2d05-4491-bf35-ee7c678b92da”,
“name”: “Acme QRadar”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “00cbe17f-8d3c-4dd8-84ac-3c0c4e6a7c02”,
“name”: “Abuse SSL IP Blacklist”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: true,
“id”: “50bbdeea-c18e-4a8f-ba5e-19c2660c6127”,
“name”: “Acme Splunk ES Matches”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “e7f4907a-2909-48e8-9c2d-74ffc4b22e8c”,
“name”: “EU-CERT”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: true,
“id”: “83439f0f-549a-41ca-9c17-5a496e02d3bc”,
“name”: “Sharing Group”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: true,
“id”: “58050264-8d13-4b3b-9596-ce13dcd6c2fa”,
“name”: “Jayson Demo Private”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: true,
“id”: “080234eb-d818-4507-a676-dae5c5927d94”,
“name”: “Hernan private enclave”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “c6cadd98-0dc1-4148-b074-bdcd7a09faf4”,
“name”: “NCFTA TNT”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “d5ae5120-a99d-4f28-bdaa-7261c43e3f3a”,
“name”: “Silobreaker”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: true,
“id”: “70381c7e-83b4-4911-9b40-d9b440f3c113”,
“name”: “Salesforce_TI”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “fa17005e-714b-4bb9-bd56-11ec337ad458”,
“name”: “Internal Test IBM Vetted Indicators”,
“read”: true,
“type”: “INTERNAL”,
“update”: false
},
{
“create”: false,
“id”: “7819c8d1-2b7b-48ac-b127-c71d8e7de612”,
“name”: “Hail A TAXII”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “2eeccced-c740-4ad9-aa5c-82744cd1f6aa”,
“name”: “Hybrid Analysis Public Feed”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: true,
“id”: “d915e45a-d0c8-4a75-987a-775649020c96”,
“name”: “Acme Phishing”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “0618ee04-0c17-417f-a9ad-52a66ec1a5db”,
“name”: “RiskIQ Blacklist”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “d2eec321-34bc-4db6-aa20-2ad0a52135fc”,
“name”: “NIST NVD”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “77abf4bd-c67b-4016-a8f1-fd8c7e8b07bb”,
“name”: “IBM Premier Threat Intelligence”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “71f337a0-9696-4331-988a-5679271656a0”,
“name”: “Acme Investigations”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “eec779f5-7abc-48ea-ad19-4c5a5f8f5822”,
“name”: “Infosecisland”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “699c6ffc-86c0-48f2-964a-c77dc949c2f1”,
“name”: “Dragos”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “5392b0a7-32fb-4825-aac7-1e6c6d437de3”,
“name”: “H-ISAC TLP Green & White Alerts”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “59cd8570-5dce-4e5b-b09c-9807530a7086”,
“name”: “RH-ISAC Vetted Indicators “,
“read”: true,
“type”: “INTERNAL”,
“update”: false
},
{
“create”: false,
“id”: “931a7386-ed4f-4acd-bda0-b13b2b6b8f71”,
“name”: “Alienvault OTX Pulse”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “11125bbd-ca70-4f16-bce2-7e361693ceb2”,
“name”: “Unit 42”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “182057fe-4867-4d5e-b49b-fa495f1e7c52”,
“name”: “MISP”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “07429af5-a943-4fbc-87b8-49d6c26e472b”,
“name”: “CrowdStrike Falcon Intelligence”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: true,
“id”: “e3ad52ed-ee3b-4446-9177-5c0f6258b8f0”,
“name”: “Acme Resilient”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: true,
“id”: “85654534-24ae-45c1-ae33-970443377932”,
“name”: “CSA Intel Exchange”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: true,
“id”: “6ef1078c-a74a-4b42-9344-56c6adea0bda”,
“name”: “Acme ServiceNow”,
“read”: true,
“type”: “INTERNAL”,
“update”: true
},
{
“create”: false,
“id”: “0e4443fc-2b50-4756-b5e0-4ea30030bcb3”,
“name”: “Broadanalysis”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “d039cebb-fb2a-411f-bbc8-7e6a80af105f”,
“name”: “URLhaus”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “eecdff2d-22ae-4e4a-b924-42da4e7ccd4b”,
“name”: “Internet Storm Center”,
“read”: true,
“type”: “OPEN”,
“update”: false
},
{
“create”: false,
“id”: “0e450b84-d96f-41de-be51-495af574c1a5”,
“name”: “CrowdStrike Falcon Reports”,
“read”: true,
“type”: “CLOSED”,
“update”: false
},
{
“create”: false,
“id”: “379be0e7-86df-4403-900e-d5e59b9022ae”,
“name”: “Intel 471 Adversary List “,
“read”: true,
“type”: “CLOSED”,
“update”: false
}
]
}
}


#### Human Readable Output

>### TruSTAR Enclaves
>
>|create|id|name|read|type|update|
>|---|---|---|---|---|---|
>| false | ed35f85a-d6bf-4e74-a0f8-61651abf705e | IBM X-Force | true | CLOSED | false |
>| false | 1e530a47-c3c0-4d53-b473-9d32fbc096df | Intel 471 Malware List | true | CLOSED | false |
>| false | c12f55c2-7a9e-47a7-951a-6a67d742f72a | Intel 471 Alerts | true | CLOSED | false |
>| false | d2c80d0e-0310-4bdf-9301-b77e660d919d | NCFTA CyFin | true | CLOSED | false |
>| false | 19b79707-40a8-4d50-80d0-ce563f1d053d | SpyCloud | true | CLOSED | false |
>| false | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | Flashpoint | true | CLOSED | false |
>| true | 8335131d-c2e5-4257-8c1b-5bce7991e431 | IT-ISAC | true | INTERNAL | true |
>| false | e93f119a-7883-4417-bab0-17e7aa593f39 | CrowdStrike Falcon Detection | true | CLOSED | false |
>| true | 28177710-9cb8-aa2f-29e8-135c14365e80 | Community | true | COMMUNITY | false |
>| false | c49f4e9b-478a-451f-9509-af29572b380c | H-ISAC TLP Amber Alerts | true | CLOSED | false |
>| false | 919879d7-88b3-4605-9464-b2a8fca5473a | US-CERT | true | OPEN | false |
>| false | 83279ba8-1d6a-4da1-b8cb-696b857668a3 | RiskIQ PassiveTotal | true | CLOSED | false |
>| true | 7a33144f-aef3-442b-87d4-dbf70d8afdb0 | RH-ISAC | true | INTERNAL | true |
>| false | fdd13b75-a672-47b7-9957-2ee76d429346 | Digital Shadows | true | CLOSED | false |
>| true | b18292c7-ccf1-42f8-912b-37fdbdddcb78 | NCU-ISAO | true | INTERNAL | false |
>| false | 011ad71b-fd7d-44c2-834a-0d751299fb1f | VirusTotal | true | CLOSED | false |
>| true | c879f089-ffbd-4a2f-8144-d3e8bdbd6981 | Acme SOC - Vetted | true | INTERNAL | true |
>| false | ed9d7459-dd90-414f-96ee-5e37f232cd18 | Bambenek | true | OPEN | false |
>| false | 170c3077-f502-4b1a-b8f7-7538f83a66c1 | Abuse Ransomware | true | OPEN | false |
>| false | fb8dcceb-b1aa-45cd-a5b2-b75352d321dc | FS-ISAC | true | CLOSED | false |
>| false | d2cf82f0-5aba-4cf4-ba3b-fc990829b663 | Packetstorm | true | OPEN | false |
>| false | 5d5d1eee-f65f-4fd9-a14b-43c597d9af9e | Malwarebytes | true | OPEN | false |
>| true | 3688a99c-0272-4ca6-848a-104dfe929555 | ND_ISAC | true | INTERNAL | true |
>| false | b0a7be7b-a847-4597-9e1d-20ae18c344ea | COVID-19 OSINT Community Enclave | true | OPEN | false |
>| false | 0092174d-25c0-4d9e-ae7e-7d5031643df0 | Blackfish | true | CLOSED | false |
>| true | 71001c42-2d05-4491-bf35-ee7c678b92da | Acme QRadar | true | INTERNAL | true |
>| false | 00cbe17f-8d3c-4dd8-84ac-3c0c4e6a7c02 | Abuse SSL IP Blacklist | true | OPEN | false |
>| true | 50bbdeea-c18e-4a8f-ba5e-19c2660c6127 | Acme Splunk ES Matches | true | INTERNAL | true |
>| false | e7f4907a-2909-48e8-9c2d-74ffc4b22e8c | EU-CERT | true | OPEN | false |
>| true | 83439f0f-549a-41ca-9c17-5a496e02d3bc | Sharing Group | true | INTERNAL | true |
>| true | 58050264-8d13-4b3b-9596-ce13dcd6c2fa | Jayson Demo Private | true | INTERNAL | true |
>| true | 080234eb-d818-4507-a676-dae5c5927d94 | Hernan private enclave | true | INTERNAL | true |
>| false | c6cadd98-0dc1-4148-b074-bdcd7a09faf4 | NCFTA TNT | true | CLOSED | false |
>| true | d5ae5120-a99d-4f28-bdaa-7261c43e3f3a | Silobreaker | true | INTERNAL | true |
>| true | 70381c7e-83b4-4911-9b40-d9b440f3c113 | Salesforce_TI | true | INTERNAL | true |
>| false | fa17005e-714b-4bb9-bd56-11ec337ad458 | Internal Test IBM Vetted Indicators | true | INTERNAL | false |
>| false | 7819c8d1-2b7b-48ac-b127-c71d8e7de612 | Hail A TAXII | true | OPEN | false |
>| false | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | Hybrid Analysis Public Feed | true | OPEN | false |
>| true | d915e45a-d0c8-4a75-987a-775649020c96 | Acme Phishing | true | INTERNAL | true |
>| false | 0618ee04-0c17-417f-a9ad-52a66ec1a5db | RiskIQ Blacklist | true | CLOSED | false |
>| false | d2eec321-34bc-4db6-aa20-2ad0a52135fc | NIST NVD | true | OPEN | false |
>| false | 77abf4bd-c67b-4016-a8f1-fd8c7e8b07bb | IBM Premier Threat Intelligence | true | CLOSED | false |
>| true | 71f337a0-9696-4331-988a-5679271656a0 | Acme Investigations | true | INTERNAL | true |
>| false | eec779f5-7abc-48ea-ad19-4c5a5f8f5822 | Infosecisland | true | OPEN | false |
>| false | 699c6ffc-86c0-48f2-964a-c77dc949c2f1 | Dragos | true | CLOSED | false |
>| false | 5392b0a7-32fb-4825-aac7-1e6c6d437de3 | H-ISAC TLP Green & White Alerts | true | OPEN | false |
>| false | 59cd8570-5dce-4e5b-b09c-9807530a7086 | RH-ISAC Vetted Indicators  | true | INTERNAL | false |
>| false | 931a7386-ed4f-4acd-bda0-b13b2b6b8f71 | Alienvault OTX Pulse | true | CLOSED | false |
>| false | 11125bbd-ca70-4f16-bce2-7e361693ceb2 | Unit 42 | true | OPEN | false |
>| false | 182057fe-4867-4d5e-b49b-fa495f1e7c52 | MISP | true | CLOSED | false |
>| false | 07429af5-a943-4fbc-87b8-49d6c26e472b | CrowdStrike Falcon Intelligence | true | CLOSED | false |
>| true | e3ad52ed-ee3b-4446-9177-5c0f6258b8f0 | Acme Resilient | true | INTERNAL | true |
>| true | 85654534-24ae-45c1-ae33-970443377932 | CSA Intel Exchange | true | INTERNAL | true |
>| true | 6ef1078c-a74a-4b42-9344-56c6adea0bda | Acme ServiceNow | true | INTERNAL | true |
>| false | 0e4443fc-2b50-4756-b5e0-4ea30030bcb3 | Broadanalysis | true | OPEN | false |
>| false | d039cebb-fb2a-411f-bbc8-7e6a80af105f | URLhaus | true | OPEN | false |
>| false | eecdff2d-22ae-4e4a-b924-42da4e7ccd4b | Internet Storm Center | true | OPEN | false |
>| false | 0e450b84-d96f-41de-be51-495af574c1a5 | CrowdStrike Falcon Reports | true | CLOSED | false |
>| false | 379be0e7-86df-4403-900e-d5e59b9022ae | Intel 471 Adversary List  | true | CLOSED | false |

### trustar-related-indicators

***
Finds all reports that contain any of the given indicators and returns correlated indicators from those reports.

#### Base Command

`trustar-related-indicators`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicators | Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. | Required |
| enclave_ids | Comma-separated list of enclave IDs; (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Indicators.indicatorType | string | Indicator type |
| TruSTAR.Indicators.value | string | Indicator value |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-related-indicators indicators=WANNACRY```

#### Context Example

{
“CVE”: {
“ID”: “CVE-2017-0147”
},
“DBotScore”: [
{
“Indicator”: “ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://urlhaus.abuse.ch/url/407033/”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “http://demo.singhealth.xyz/files/wannacry/generalelectioncandidates.pdf.exe”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “demo.singhealth.xyz”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://urlhaus-api.abuse.ch/v1/download/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “84c82835a5d21bbcf75a61706d8ab549”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “http://demo.singhealth.xyz/files/wannacry/ransomware.wannacry.zip”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “efe76bf09daba2c594d2bc173d9b5cf0”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://urlhaus.abuse.ch/url/407034/”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://urlhaus-api.abuse.ch/v1/download/707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a/”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “ce997cff0db912bf873636856b883915ebbbb9d2672a31539710e2b301fdea51”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “201.35.192.251”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “84.53.130.120”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “5.60.69.78”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “mssecsvc.exe.5efd7894.bin”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “8c860331167f51989cf2153b9bca47271e01bf1b57483aacd3b8b234b3bf7b2c”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “37.26.41.210”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “52.253.113.206”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “15.132.199.102”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “175.192.84.144”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “138.30.41.7”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “196.37.251.244”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “CVE-2017-0147”,
“Score”: 0,
“Type”: “cve”,
“Vendor”: null
}
],
“File”: [
{
“SHA256”: “ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa”
},
{
“MD5”: “84c82835a5d21bbcf75a61706d8ab549”
},
{
“MD5”: “efe76bf09daba2c594d2bc173d9b5cf0”
},
{
“SHA256”: “707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a”
},
{
“SHA256”: “ce997cff0db912bf873636856b883915ebbbb9d2672a31539710e2b301fdea51”
},
{
“Name”: “mssecsvc.exe.5efd7894.bin”
},
{
“SHA256”: “8c860331167f51989cf2153b9bca47271e01bf1b57483aacd3b8b234b3bf7b2c”
},
{
“SHA256”: “3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670”
}
],
“IP”: [
{
“Address”: “201.35.192.251”
},
{
“Address”: “84.53.130.120”
},
{
“Address”: “5.60.69.78”
},
{
“Address”: “37.26.41.210”
},
{
“Address”: “52.253.113.206”
},
{
“Address”: “15.132.199.102”
},
{
“Address”: “175.192.84.144”
},
{
“Address”: “138.30.41.7”
},
{
“Address”: “196.37.251.244”
}
],
“TruSTAR”: {
“Indicators”: [
{
“indicatorType”: “SHA256”,
“value”: “ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa”
},
{
“indicatorType”: “URL”,
“value”: “https://urlhaus.abuse.ch/url/407033/”
},
{
“indicatorType”: “URL”,
“value”: “http://demo.singhealth.xyz/files/wannacry/generalelectioncandidates.pdf.exe”
},
{
“indicatorType”: “URL”,
“value”: “demo.singhealth.xyz”
},
{
“indicatorType”: “URL”,
“value”: “https://urlhaus-api.abuse.ch/v1/download/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/”
},
{
“indicatorType”: “MD5”,
“value”: “84c82835a5d21bbcf75a61706d8ab549”
},
{
“indicatorType”: “URL”,
“value”: “http://demo.singhealth.xyz/files/wannacry/ransomware.wannacry.zip”
},
{
“indicatorType”: “MD5”,
“value”: “efe76bf09daba2c594d2bc173d9b5cf0”
},
{
“indicatorType”: “URL”,
“value”: “https://urlhaus.abuse.ch/url/407034/”
},
{
“indicatorType”: “URL”,
“value”: “https://urlhaus-api.abuse.ch/v1/download/707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a/”
},
{
“indicatorType”: “SHA256”,
“value”: “707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a”
},
{
“indicatorType”: “SHA256”,
“value”: “ce997cff0db912bf873636856b883915ebbbb9d2672a31539710e2b301fdea51”
},
{
“indicatorType”: “IP”,
“value”: “201.35.192.251”
},
{
“indicatorType”: “IP”,
“value”: “84.53.130.120”
},
{
“indicatorType”: “IP”,
“value”: “5.60.69.78”
},
{
“indicatorType”: “SOFTWARE”,
“value”: “mssecsvc.exe.5efd7894.bin”
},
{
“indicatorType”: “SHA256”,
“value”: “8c860331167f51989cf2153b9bca47271e01bf1b57483aacd3b8b234b3bf7b2c”
},
{
“indicatorType”: “IP”,
“value”: “37.26.41.210”
},
{
“indicatorType”: “IP”,
“value”: “52.253.113.206”
},
{
“indicatorType”: “SHA256”,
“value”: “3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670”
},
{
“indicatorType”: “IP”,
“value”: “15.132.199.102”
},
{
“indicatorType”: “IP”,
“value”: “175.192.84.144”
},
{
“indicatorType”: “IP”,
“value”: “138.30.41.7”
},
{
“indicatorType”: “IP”,
“value”: “196.37.251.244”
},
{
“indicatorType”: “CVE”,
“value”: “CVE-2017-0147”
}
]
},
“URL”: [
{
“Data”: “https://urlhaus.abuse.ch/url/407033/”
},
{
“Data”: “http://demo.singhealth.xyz/files/wannacry/generalelectioncandidates.pdf.exe”
},
{
“Data”: “demo.singhealth.xyz”
},
{
“Data”: “https://urlhaus-api.abuse.ch/v1/download/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/”
},
{
“Data”: “http://demo.singhealth.xyz/files/wannacry/ransomware.wannacry.zip”
},
{
“Data”: “https://urlhaus.abuse.ch/url/407034/”
},
{
“Data”: “https://urlhaus-api.abuse.ch/v1/download/707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a/”
}
]
}


#### Human Readable Output

>### Results
>
>|indicatorType|value|
>|---|---|
>| SHA256 | ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa |
>| URL | https://urlhaus.abuse.ch/url/407033/ |
>| URL | http://demo.singhealth.xyz/files/wannacry/generalelectioncandidates.pdf.exe |
>| URL | demo.singhealth.xyz |
>| URL | https://urlhaus-api.abuse.ch/v1/download/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/ |
>| MD5 | 84c82835a5d21bbcf75a61706d8ab549 |
>| URL | http://demo.singhealth.xyz/files/wannacry/ransomware.wannacry.zip |
>| MD5 | efe76bf09daba2c594d2bc173d9b5cf0 |
>| URL | https://urlhaus.abuse.ch/url/407034/ |
>| URL | https://urlhaus-api.abuse.ch/v1/download/707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a/ |
>| SHA256 | 707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a |
>| SHA256 | ce997cff0db912bf873636856b883915ebbbb9d2672a31539710e2b301fdea51 |
>| IP | 201.35.192.251 |
>| IP | 84.53.130.120 |
>| IP | 5.60.69.78 |
>| SOFTWARE | mssecsvc.exe.5efd7894.bin |
>| SHA256 | 8c860331167f51989cf2153b9bca47271e01bf1b57483aacd3b8b234b3bf7b2c |
>| IP | 37.26.41.210 |
>| IP | 52.253.113.206 |
>| SHA256 | 3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670 |
>| IP | 15.132.199.102 |
>| IP | 175.192.84.144 |
>| IP | 138.30.41.7 |
>| IP | 196.37.251.244 |
>| CVE | CVE-2017-0147 |

### trustar-trending-indicators

***
Find indicators that are trending in the community.

#### Base Command

`trustar-trending-indicators`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicator_type | The types of indicators to be returned. If other, then all indicator types except for CVE and MALWARE will be returned. | Optional |
| days_back | The number of days back to count correlations for. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Indicators.correlationCount | Number | Indicator correlation count |
| TruSTAR.Indicators.indicatorType | string | Indicator type |
| TruSTAR.Indicators.value | string | Indicator value |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-trending-indicators days_back=1 indicator_type=MALWARE```

#### Context Example

{
“TruSTAR”: {
“Indicators”: [
{
“correlationCount”: 85,
“indicatorType”: “MALWARE”,
“value”: “TRICKBOT”
},
{
“correlationCount”: 31,
“indicatorType”: “MALWARE”,
“value”: “AMADEY”
},
{
“correlationCount”: 29,
“indicatorType”: “MALWARE”,
“value”: “EMOTET”
},
{
“correlationCount”: 27,
“indicatorType”: “MALWARE”,
“value”: “SMOKELOADER”
},
{
“correlationCount”: 14,
“indicatorType”: “MALWARE”,
“value”: “SALITY”
},
{
“correlationCount”: 10,
“indicatorType”: “MALWARE”,
“value”: “ZLOADER”
},
{
“correlationCount”: 5,
“indicatorType”: “MALWARE”,
“value”: “NIVDORT”
},
{
“correlationCount”: 5,
“indicatorType”: “MALWARE”,
“value”: “WANNACRY”
},
{
“correlationCount”: 4,
“indicatorType”: “MALWARE”,
“value”: “KRYPTIK”
},
{
“correlationCount”: 4,
“indicatorType”: “MALWARE”,
“value”: “ANDROMEDA”
}
]
}
}


#### Human Readable Output

>### Results
>
>|correlationCount|indicatorType|value|
>|---|---|---|
>| 85 | MALWARE | TRICKBOT |
>| 31 | MALWARE | AMADEY |
>| 29 | MALWARE | EMOTET |
>| 27 | MALWARE | SMOKELOADER |
>| 14 | MALWARE | SALITY |
>| 10 | MALWARE | ZLOADER |
>| 5 | MALWARE | NIVDORT |
>| 5 | MALWARE | WANNACRY |
>| 4 | MALWARE | KRYPTIK |
>| 4 | MALWARE | ANDROMEDA |

### trustar-indicators-metadata

***
Provide metadata associated with a list of indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags. The metadata is determined based on the enclaves the user making the request has READ access to.

#### Base Command

`trustar-indicators-metadata`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicators | Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. | Required |
| enclave_ids | CSV of enclave IDs to restrict to. (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). By default, uses all of the user’s enclaves. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.IndicatorsMetadata.notes | string | Indicator notes |
| TruSTAR.IndicatorsMetadata.indicatorType | string | Indicator type |
| TruSTAR.IndicatorsMetadata.firstSeen | Date | Indicator first seen value |
| TruSTAR.IndicatorsMetadata.correlationCount | Number | Indicator correlation count |
| TruSTAR.IndicatorsMetadata.value | string | Indicator value |
| TruSTAR.IndicatorsMetadata.lastSeen | Date | Indicator last seen value |
| TruSTAR.IndicatorsMetadata.tags | string | Indicator tags |
| TruSTAR.IndicatorsMetadata.enclaveIds | string | Enclave IDs where indicator is present |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-indicators-metadata indicators=37.26.41.210```

#### Context Example

{
“DBotScore”: [
{
“Indicator”: “37.26.41.210”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
}
],
“IP”: {
“Address”: “37.26.41.210”
},
“TruSTAR”: {
“IndicatorsMetadata”: {
“correlationCount”: 0,
“enclaveIds”: [
“2eeccced-c740-4ad9-aa5c-82744cd1f6aa”
],
“firstSeen”: “2020-07-02 04:59:03”,
“indicatorType”: “IP”,
“lastSeen”: “2020-07-02 04:59:03”,
“notes”: [],
“tags”: [],
“value”: “37.26.41.210”
}
}
}


#### Human Readable Output

>### Results
>
>|correlationCount|enclaveIds|firstSeen|indicatorType|lastSeen|notes|tags|value|
>|---|---|---|---|---|---|---|---|
>| 0 | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 2020-07-02 04:59:03 | IP | 2020-07-02 04:59:03 |  |  | 37.26.41.210 |

### trustar-indicator-summaries

***
Provides structured summaries about indicators, which are derived from intelligence sources on the TruSTAR Marketplace.

#### Base Command

`trustar-indicator-summaries`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| values | Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. | Required |
| enclave_ids | CSV of enclaves to search for indicator summaries in. (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). These should be enclaves containing data from sources on the TruSTAR Marketplace. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.IndicatorSummaries.severityLevel | string | Indicator severity level |
| TruSTAR.IndicatorSummaries.reportId | string | Indicator report ID |
| TruSTAR.IndicatorSummaries.value | string | Indicator value |
| TruSTAR.IndicatorSummaries.score.name | string | Indicator score name |
| TruSTAR.IndicatorSummaries.score.value | string | Indicator score value |
| TruSTAR.IndicatorSummaries.attributes | String | Indicator attributes |
| TruSTAR.IndicatorSummaries.enclaveId | string | Indicator enclave ID |
| TruSTAR.IndicatorSummaries.type | string | Indicator type |
| TruSTAR.IndicatorSummaries.source.key | string | Indicator source key |
| TruSTAR.IndicatorSummaries.source.name | string | Indicator source name |
| TruSTAR.IndicatorSummaries.updated | string | Indicator last update value |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-indicator-summaries values=LOCKY,23.121.54.102```

#### Human Readable Output

### trustar-get-whitelisted-indicators

***
Gets a list of indicators that the user’s company has added to allow list.

#### Base Command

`trustar-get-whitelisted-indicators`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.WhitelistedIndicators.indicatorType | string | File MD5 |
| TruSTAR.WhitelistedIndicators.value | string | File SHA1 |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-get-whitelisted-indicators```

#### Context Example

{
“Account”: {
“Email”: [
{
“Address”: “htain@trustar.co”
}
]
},
“DBotScore”: [
{
“Indicator”: “savc.net”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “22.37.45.53”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “1.1.1.1”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “88.249.181.198”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “1e82dd741e908d02e4eff82461f1297e”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://www.binarydefense.com”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “docusign.com”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “www.badsite.net”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “safrica24.com”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://my.silobreaker.com/5_2273991310555742265”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “test123.com”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://my.silobreaker.com/5_2273903231513919758”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://urlscan.io/search/#lihkg.com”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “3b05383323d4c1485f5a4d5dddfe55275e441c66714cee101baee9cdd19b18cc”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://cf-p.falcon.crowdstrike.com/2017/04/26202230/chollima1.png”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “\windows\system32\cmd.exe”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “109.120.214.195”,
“Score”: 0,
“Type”: “ip”,
“Vendor”: “TruSTAR”
}
],
“File”: [
{
“MD5”: “1e82dd741e908d02e4eff82461f1297e”
},
{
“SHA256”: “3b05383323d4c1485f5a4d5dddfe55275e441c66714cee101baee9cdd19b18cc”
},
{
“Name”: “\windows\system32\cmd.exe”
}
],
“IP”: [
{
“Address”: “22.37.45.53”
},
{
“Address”: “1.1.1.1”
},
{
“Address”: “88.249.181.198”
},
{
“Address”: “109.120.214.195”
}
],
“TruSTAR”: {
“WhitelistedIndicators”: [
{
“indicatorType”: “EMAIL_ADDRESS”,
“value”: “htain@trustar.co”
},
{
“indicatorType”: “URL”,
“value”: “savc.net”
},
{
“indicatorType”: “IP”,
“value”: “22.37.45.53”
},
{
“indicatorType”: “IP”,
“value”: “1.1.1.1”
},
{
“indicatorType”: “IP”,
“value”: “88.249.181.198”
},
{
“indicatorType”: “MD5”,
“value”: “1e82dd741e908d02e4eff82461f1297e”
},
{
“indicatorType”: “URL”,
“value”: “https://www.binarydefense.com”
},
{
“indicatorType”: “URL”,
“value”: “docusign.com”
},
{
“indicatorType”: “URL”,
“value”: “www.badsite.net”
},
{
“indicatorType”: “URL”,
“value”: “safrica24.com”
},
{
“indicatorType”: “URL”,
“value”: “https://my.silobreaker.com/5_2273991310555742265”
},
{
“indicatorType”: “URL”,
“value”: “test123.com”
},
{
“indicatorType”: “URL”,
“value”: “https://my.silobreaker.com/5_2273903231513919758”
},
{
“indicatorType”: “URL”,
“value”: “https://urlscan.io/search/#lihkg.com”
},
{
“indicatorType”: “SHA256”,
“value”: “3b05383323d4c1485f5a4d5dddfe55275e441c66714cee101baee9cdd19b18cc”
},
{
“indicatorType”: “URL”,
“value”: “https://cf-p.falcon.crowdstrike.com/2017/04/26202230/chollima1.png”
},
{
“indicatorType”: “SOFTWARE”,
“value”: “\windows\system32\cmd.exe”
},
{
“indicatorType”: “IP”,
“value”: “109.120.214.195”
}
]
},
“URL”: [
{
“Data”: “savc.net”
},
{
“Data”: “https://www.binarydefense.com”
},
{
“Data”: “docusign.com”
},
{
“Data”: “www.badsite.net”
},
{
“Data”: “safrica24.com”
},
{
“Data”: “https://my.silobreaker.com/5_2273991310555742265”
},
{
“Data”: “test123.com”
},
{
“Data”: “https://my.silobreaker.com/5_2273903231513919758”
},
{
“Data”: “https://urlscan.io/search/#lihkg.com”
},
{
“Data”: “https://cf-p.falcon.crowdstrike.com/2017/04/26202230/chollima1.png”
}
]
}


#### Human Readable Output

>### Results
>
>|indicatorType|value|
>|---|---|
>| EMAIL_ADDRESS | htain@trustar.co |
>| URL | savc.net |
>| IP | 22.37.45.53 |
>| IP | 1.1.1.1 |
>| IP | 88.249.181.198 |
>| MD5 | 1e82dd741e908d02e4eff82461f1297e |
>| URL | https://www.binarydefense.com |
>| URL | docusign.com |
>| URL | www.badsite.net |
>| URL | safrica24.com |
>| URL | https://my.silobreaker.com/5_2273991310555742265 |
>| URL | test123.com |
>| URL | https://my.silobreaker.com/5_2273903231513919758 |
>| URL | https://urlscan.io/search/#lihkg.com |
>| SHA256 | 3b05383323d4c1485f5a4d5dddfe55275e441c66714cee101baee9cdd19b18cc |
>| URL | https://cf-p.falcon.crowdstrike.com/2017/04/26202230/chollima1.png |
>| SOFTWARE | \windows\system32\cmd.exe |
>| IP | 109.120.214.195 |

### trustar-get-reports

***
Returns incident reports matching the specified filters. All parameters are optional: if nothing is specified, the latest 25 reports accessible by the user will be returned (matching the view the user would have by logging into Station).

#### Base Command

`trustar-get-reports`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| from_time | Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| to_time | End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| distribution_type | Whether to search for reports in the community, or only in enclaves | Optional |
| enclave_ids | Comma separated list of enclave ids to search for reports in. (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Even if distributionType is COMMUNITY, these enclaves will still be searched as well. Default is All enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| tags | a list of names of tags to filter by; only reports containing ALL of these tags will be returned. i.e. &lt;tag1&gt;,&lt;tag2&gt;,&lt;tag3&gt;). | Optional |
| excluded_tags | reports containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. &lt;tag1&gt;,&lt;tag2&gt;,&lt;tag3&gt;). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Report.title | string | Title of the report |
| TruSTAR.Report.reportBody | string | Body of the report |
| TruSTAR.Report.id | string | ID of the report |

#### Command Example

```!trustar-get-reports enclave_ids=6ef1078c-a74a-4b42-9344-56c6adea0bda from_time="1 day ago"```

#### Context Example

{}


#### Human Readable Output

>No reports were found.

### trustar-get-indicators-for-report

***
Return a list of indicators extracted from a report.

#### Base Command

`trustar-get-indicators-for-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | the ID of the report to get the indicators from | Required |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Indicators.type | string | Indicator type |
| TruSTAR.Indicators.value | string | Indicator value |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-get-indicators-for-report report_id=6e00a714-379a-4db8-ac0c-812a629c8288```

#### Context Example

{
“DBotScore”: [
{
“Indicator”: “c5737f53ea049a88162297604b41c791dd8583b3”,
“Score”: 0,
“Type”: “file”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “http://travellux.nl”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “travellux.nl”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://zenshin-talent.us4.list-manage.com/profile?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
},
{
“Indicator”: “https://zenshin-talent.us4.list-manage.com/unsubscribe?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c&c=d1fe02d910”,
“Score”: 0,
“Type”: “url”,
“Vendor”: “TruSTAR”
}
],
“File”: {
“SHA1”: “c5737f53ea049a88162297604b41c791dd8583b3”
},
“TruSTAR”: {
“Indicators”: [
{
“indicatorType”: “SHA1”,
“value”: “c5737f53ea049a88162297604b41c791dd8583b3”
},
{
“indicatorType”: “URL”,
“value”: “http://travellux.nl”
},
{
“indicatorType”: “URL”,
“value”: “travellux.nl”
},
{
“indicatorType”: “URL”,
“value”: “https://zenshin-talent.us4.list-manage.com/profile?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c”
},
{
“indicatorType”: “URL”,
“value”: “https://zenshin-talent.us4.list-manage.com/unsubscribe?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c&c=d1fe02d910”
}
]
},
“URL”: [
{
“Data”: “http://travellux.nl”
},
{
“Data”: “travellux.nl”
},
{
“Data”: “https://zenshin-talent.us4.list-manage.com/profile?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c”
},
{
“Data”: “https://zenshin-talent.us4.list-manage.com/unsubscribe?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c&c=d1fe02d910”
}
]
}


#### Human Readable Output

>### Results
>
>|indicatorType|value|
>|---|---|
>| SHA1 | c5737f53ea049a88162297604b41c791dd8583b3 |
>| URL | http://travellux.nl |
>| URL | travellux.nl |
>| URL | https://zenshin-talent.us4.list-manage.com/profile?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c |
>| URL | https://zenshin-talent.us4.list-manage.com/unsubscribe?u=bf272ebe406152763de31f5a2&id=d178821f2b&e=0cbc95e07c&c=d1fe02d910 |

### trustar-move-report

***
Move a report from one enclave to another.

#### Base Command

`trustar-move-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | the ID of the report you want to move | Required |
| dest-enclave-id | the ID of the destination enclave | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-move-report report_id=20ce2d7f-4a25-4bed-a74e-ec99bf0b46db dest-enclave-id=71001c42-2d05-4491-bf35-ee7c678b92da```

#### Context Example

{}


#### Human Readable Output

>20ce2d7f-4a25-4bed-a74e-ec99bf0b46db has been moved to enclave id: 71001c42-2d05-4491-bf35-ee7c678b92da

### trustar-copy-report

***
Copies a report from one enclave to another.

#### Base Command

`trustar-copy-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | the ID of the report you want to move | Required |
| dest_enclave_id | the ID of the destination enclave | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-copy-report report_id=6e00a714-379a-4db8-ac0c-812a629c8288 dest_enclave_id=c879f089-ffbd-4a2f-8144-d3e8bdbd6981```

#### Context Example

{}


#### Human Readable Output

>6e00a714-379a-4db8-ac0c-812a629c8288 has been copied to enclave id: c879f089-ffbd-4a2f-8144-d3e8bdbd6981 with id: 9cc749a5-21b2-418d-8fa7-5e28fcf671ba

### trustar-submit-report

***
Submit a new incident report, and receive the ID it has been assigned in TruSTAR’s system.

#### Base Command

`trustar-submit-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| title | Title of the report | Required |
| report_body | Text content of report | Required |
| enclave_ids | CSV of TruSTAR-generated enclave ids. (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| distribution_type | Distribution type of the report | Optional |
| external_url | URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. | Optional |
| time_began | ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. | Optional |
| redact | YES OR NO. If redact is YES, all terms from user's company redaction library in TruSTAR will be applied before submitting. If NO, submits the report with body and title as written by the user. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Report.title | string | Title of the report |
| TruSTAR.Report.reportBody | string | Body of the report |
| TruSTAR.Report.id | string | ID of the report |

#### Command Example

```!trustar-submit-report title="foo title" report_body="the report body" enclave_ids=080234eb-d818-4507-a676-dae5c5927d94```

#### Context Example

{
“TruSTAR”: {
“Report”: {
“id”: “5cf979cb-aae6-4270-8295-52a2ed2b36a1”,
“reportBody”: “the report body”,
“title”: “foo title”
}
}
}


#### Human Readable Output

>### TruSTAR report was successfully created
>
>|distributionType|enclaveIds|id|reportBody|reportDeepLink|timeBegan|title|
>|---|---|---|---|---|---|---|
>| ENCLAVE | 080234eb-d818-4507-a676-dae5c5927d94 | 5cf979cb-aae6-4270-8295-52a2ed2b36a1 | the report body | https://station.trustar.co/constellation/reports/5cf979cb-aae6-4270-8295-52a2ed2b36a1 | 2020-07-02T20:51:05.817066+00:00 | foo title |

### trustar-delete-report

***
Deletes a report as specified by given id (id can be TruSTAR report id or external id).

#### Base Command

`trustar-delete-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | Finds a report by its internal or external id. | Required |
| id_type | Type of report ID | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-delete-report report_id=20ce2d7f-4a25-4bed-a74e-ec99bf0b46db```

#### Context Example

{}


#### Human Readable Output

>Report 20ce2d7f-4a25-4bed-a74e-ec99bf0b46db was successfully deleted

### trustar-correlated-reports

***
Returns a list of all reports that contain any of the provided indicator values.

#### Base Command

`trustar-correlated-reports`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicators | Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. | Required |
| enclave-ids | Comma-separated list of enclave ids; (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |
| distribution_type | Distribution type of the report | Optional |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-correlated-reports indicators=WANNACRY```

#### Context Example

{}


#### Human Readable Output

>No reports were found.

### trustar-report-details

***
Finds a report by its ID and returns the report details.

#### Base Command

`trustar-report-details`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | Finds a report by its internal or external id. | Required |
| id_type | Type of report ID | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Report.title | string | Title of the report |
| TruSTAR.Report.reportBody | string | Body of the report |
| TruSTAR.Report.id | string | ID of the report |

#### Command Example

```!trustar-report-details report_id=6e00a714-379a-4db8-ac0c-812a629c8288```

#### Context Example

{
“TruSTAR”: {
“Report”: {
“id”: “6e00a714-379a-4db8-ac0c-812a629c8288”,
“reportBody”: “\n==================================================\n EMAIL THREAD DATE: 2020-06-22 11:22:59\n==================================================\nFwd: Looking to hire?”,
“title”: “The new title”
}
}
}


#### Human Readable Output

>### TruSTAR report ID 6e00a714-379a-4db8-ac0c-812a629c8288 details
>
>|created|distributionType|enclaveIds|externalTrackingId|id|reportBody|reportDeepLink|timeBegan|title|updated|
>|---|---|---|---|---|---|---|---|---|---|
>| 2020-06-22 15:25:04 | ENCLAVE | d915e45a-d0c8-4a75-987a-775649020c96 | PGJmMjcyZWJlNDA2MTUyNzYzZGUzMWY1YTIuMGNiYzk1ZTA3Yy4yMDIwMDYxNzEzMTQyNS5kMWZlMDJkOTEwLmNmYjY5Mjg1QG1haWwyMjYuc2VhODEubWNzdi5uZXQ+ | 6e00a714-379a-4db8-ac0c-812a629c8288 | <br/>==================================================<br/> EMAIL THREAD DATE: 2020-06-22 11:22:59<br/>==================================================<br/>Fwd: Looking to hire? | https://station.trustar.co/constellation/reports/6e00a714-379a-4db8-ac0c-812a629c8288 | 2020-06-22 15:25:04 | The new title | 2020-06-22 15:25:04 |

### trustar-update-report

***
Update the report with the specified ID. Either the internal TruSTAR report ID or an external tracking ID can be used. Only the fields passed will be updated. All others will be left unchanged.

#### Base Command

`trustar-update-report`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| report_id | TruSTAR report id or external tracking id. | Required |
| title | Title of the report | Optional |
| report-body | Text content of report | Optional |
| enclave_ids | CSV of TruSTAR-generated enclave ids. (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| external_url | URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. | Optional |
| distribution_type | Distribution type of the report | Optional |
| time_began | ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Report.title | string | Title of the report |
| TruSTAR.Report.reportBody | string | Body of the report |
| TruSTAR.Report.id | string | ID of the report |

#### Command Example

```!trustar-update-report report_id=6e00a714-379a-4db8-ac0c-812a629c8288 title="The new title"```

#### Context Example


#### Human Readable Output

>### TruSTAR report was successfully updated
>
>|created|distributionType|enclaveIds|externalTrackingId|externalUrl|id|reportBody|reportDeepLink|timeBegan|title|updated|
>|---|---|---|---|---|---|---|---|---|---|---|
>| 2020-06-22 15:25:04 | ENCLAVE | d915e45a-d0c8-4a75-987a-775649020c96 | PGJmMjcyZWJlNDA2MTUyNzYzZGUzMWY1YTIuMGNiYzk1ZTA3Yy4yMDIwMDYxNzEzMTQyNS5kMWZlMDJkOTEwLmNmYjY5Mjg1QG1haWwyMjYuc2VhODEubWNzdi5uZXQ+ |  | 6e00a714-379a-4db8-ac0c-812a629c8288 | <br/>==================================================<br/> EMAIL THREAD DATE: 2020-06-22 11:22:59<br/>==================================================<br/>Fwd: Looking to hire? | https://station.trustar.co/constellation/reports/6e00a714-379a-4db8-ac0c-812a629c8288 | 2020-06-22 15:25:04 | The new title | 2020-06-22 15:25:04 |

### trustar-search-reports

***
Searches for all reports that contain the given search term.

#### Base Command

`trustar-search-reports`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| search_term | The term to search for (e.g. covid-19) If empty, no search term will be applied. Otherwise, must be at least 3 characters. | Optional |
| enclave_ids | Comma-separated list of enclave ids (i.e. &lt;enclave1&gt;,&lt;enclave2&gt;,&lt;enclave3&gt;). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). You can get a list of your enclave IDs executing the command '!trustar-get-enclaves' | Optional |
| from_time | Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| to_time | End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| tags | Name (or list of names) of tag(s) to filter indicators by. i.e. &lt;tag1&gt;,&lt;tag2&gt;,&lt;tag3&gt;). Only indicators containing ALL of these tags will be returned. | Optional |
| excluded_tags | Indicators containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. &lt;tag1&gt;,&lt;tag2&gt;,&lt;tag3&gt;). | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.Report.id | string | ID of the report |
| TruSTAR.Report.title | string | Report Title |

#### Command Example

```!trustar-search-reports search_term=WANNACRY```

#### Context Example

{
“TruSTAR”: {
“Report”: [
{
“id”: “319b7fa5-0be0-4ff0-aac8-f4455f7a99ce”,
“title”: “URLhaus - http://demo.singhealth.xyz/files/WannaCry/GeneralElectionCandidates.pdf.exe”
},
{
“id”: “899d6193-0dab-40b6-9a23-7bc8ee7145ba”,
“title”: “URLhaus - http://demo.singhealth.xyz/files/WannaCry/Ransomware.WannaCry.zip”
},
{
“id”: “5f0d4d95-834b-4ce2-8bfc-7c8ad109a88d”,
“title”: “hybridanalysispublicfeed-5b7f02a9c9aae2fad269a1b00b4398ab-2020-07-02 03:56:51”
},
{
“id”: “a18578c1-3217-4401-80a5-97520bf484f2”,
“title”: “hybridanalysispublicfeed-4e12d4af0963a8def144bf358e6bf6b7-2020-07-02 03:07:35”
},
{
“id”: “dea957a9-3b79-4976-ae29-12e86e6e799e”,
“title”: “X-Force URL: https://searchsecurity.techtarget.com/news/252463452/wannacry-infections-continue-to-spread-2-years-later.”
},
{
“id”: “9b5861b9-fdf2-4f22-a36a-cce2bdd9b6f0”,
“title”: “Indonesia”
},
{
“id”: “e5831db3-17b7-44a7-bb24-ff0d1c64f1b3”,
“title”: “India Global Spotlight (Analyst Knowledge Page)”
},
{
“id”: “9812510b-60ce-46fb-989b-85fbb5050b8e”,
“title”: “hybridanalysispublicfeed-f25e024d175c1be65d6888412601ce32-2020-06-30 03:02:40”
},
{
“id”: “9d5b19f3-2ca2-473b-ab17-be328790a414”,
“title”: “hybridanalysispublicfeed-9d745af56d0918db19c5ce7e31d531fd-2020-06-30 03:02:28”
},
{
“id”: “3e9f96e9-fbf0-4794-857e-0176b20acc1d”,
“title”: “hybridanalysispublicfeed-a224c21a15c76cce128657286145113d-2020-06-26 07:08:22”
},
{
“id”: “f41ab1af-153e-4c3b-a634-93d5715f6d79”,
“title”: “hybridanalysispublicfeed-1685c35cea07561d27d02ead16579b80-2020-06-26 07:08:12”
},
{
“id”: “eb67ce91-5206-4a2a-bec4-ffb30382b7fd”,
“title”: “hybridanalysispublicfeed-23d365aaa5a9d0deebc8eb3ac1120119-2020-06-26 07:08:22”
},
{
“id”: “eab34a1a-7eda-40fa-a77f-8eaef75d5672”,
“title”: “REvil/Sodinokibi Threatens to Release Documents on Law Firms and President Trump”
},
{
“id”: “f575bd0e-eff5-4be0-a37b-af97ef4b0757”,
“title”: “virustotal-URL-https://www.seattletimes.com/business/boeing-aerospace/boeing-hit-by-wannacry-virus-fears-it-could-cripple-some-jet-production/.”
},
{
“id”: “f854ab11-8c44-4438-9cd1-aeb882f90df2”,
“title”: “X-Force URL: https://www.bloomberg.com/news/articles/2017-12-19/u-s-blames-north-korea-for-cowardly-wannacry-cyberattack.”
},
{
“id”: “d6f75e4a-0f0c-4e9b-b798-ce5eaf3a3e2a”,
“title”: “X-Force URL: https://www.dataprotectionreport.com/2017/05/wannacry-ransomware-attack-summary/”
},
{
“id”: “4c65b47c-a290-4a83-8cde-a23019ce0301”,
“title”: “X-Force URL: https://www.forbes.com/sites/leemathews/2017/05/16/wannacry-ransomware-ms17-010/#1fe38b312609.”
},
{
“id”: “9e524c31-918e-4888-b5f2-04d029433ee2”,
“title”: “X-Force URL: https://www.seattletimes.com/business/boeing-aerospace/boeing-hit-by-wannacry-virus-fears-it-could-cripple-some-jet-production/.”
},
{
“id”: “e152cbcd-d61b-4b16-875a-9cec8d232643”,
“title”: “hybridanalysispublicfeed-6fd816cb36211fe24153420494319d86-2020-06-18 12:33:35”
},
{
“id”: “4d1b8092-35c2-42f4-853b-d4156ea0cfc0”,
“title”: “hybridanalysispublicfeed-2e215373915334aafb1e6f0fd6e626c6-2020-06-18 06:15:42”
},
{
“id”: “0bc27068-ae06-41da-8721-000524fe45cf”,
“title”: “hybridanalysispublicfeed-2da0875fd08114fec91e54a1bac0f142-2020-06-18 06:15:32”
},
{
“id”: “2d805eb5-0f4b-434f-8017-ad80f5ef795d”,
“title”: “hybridanalysispublicfeed-84c82835a5d21bbcf75a61706d8ab549-2020-06-12 23:39:58”
},
{
“id”: “72a99972-02e2-4414-9e56-e3b2d170f7ae”,
“title”: “Global Spotlight - North Korea (Analyst Knowledge Page)”
},
{
“id”: “e36505b3-de31-48f9-a39b-9dba57051fe2”,
“title”: “URLhaus - https://github.com/71e6fd52/wannacry/raw/master/wannacry.exe”
},
{
“id”: “e218d224-c92f-4004-8614-580d8a02440b”,
“title”: “Hungary Global Spotlight (Analyst Knowledge Page)”
}
]
}
}


#### Human Readable Output

>### TruSTAR reports that contain the term WANNACRY
>
>|created|distributionType|enclaveIds|id|title|updated|
>|---|---|---|---|---|---|
>| 2020-07-02 19:14:00 | ENCLAVE | d039cebb-fb2a-411f-bbc8-7e6a80af105f | 319b7fa5-0be0-4ff0-aac8-f4455f7a99ce | URLhaus - http://demo.singhealth.xyz/files/WannaCry/GeneralElectionCandidates.pdf.exe | 2020-07-02 19:14:00 |
>| 2020-07-02 15:11:01 | ENCLAVE | d039cebb-fb2a-411f-bbc8-7e6a80af105f | 899d6193-0dab-40b6-9a23-7bc8ee7145ba | URLhaus - http://demo.singhealth.xyz/files/WannaCry/Ransomware.WannaCry.zip | 2020-07-02 15:11:01 |
>| 2020-07-02 04:59:03 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 5f0d4d95-834b-4ce2-8bfc-7c8ad109a88d | hybridanalysispublicfeed-5b7f02a9c9aae2fad269a1b00b4398ab-2020-07-02 03:56:51 | 2020-07-02 04:59:03 |
>| 2020-07-02 04:59:00 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | a18578c1-3217-4401-80a5-97520bf484f2 | hybridanalysispublicfeed-4e12d4af0963a8def144bf358e6bf6b7-2020-07-02 03:07:35 | 2020-07-02 04:59:00 |
>| 2020-06-20 05:34:03 | ENCLAVE | ed35f85a-d6bf-4e74-a0f8-61651abf705e | dea957a9-3b79-4976-ae29-12e86e6e799e | X-Force URL: https://searchsecurity.techtarget.com/news/252463452/WannaCry-infections-continue-to-spread-2-years-later. | 2020-07-02 03:10:01 |
>| 2020-07-01 18:04:00 | ENCLAVE | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | 9b5861b9-fdf2-4f22-a36a-cce2bdd9b6f0 | Indonesia | 2020-07-01 18:04:00 |
>| 2020-04-01 19:55:00 | ENCLAVE | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | e5831db3-17b7-44a7-bb24-ff0d1c64f1b3 | India Global Spotlight (Analyst Knowledge Page) | 2020-06-30 13:21:00 |
>| 2020-06-30 04:23:01 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 9812510b-60ce-46fb-989b-85fbb5050b8e | hybridanalysispublicfeed-f25e024d175c1be65d6888412601ce32-2020-06-30 03:02:40 | 2020-06-30 04:23:01 |
>| 2020-06-30 04:19:05 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 9d5b19f3-2ca2-473b-ab17-be328790a414 | hybridanalysispublicfeed-9d745af56d0918db19c5ce7e31d531fd-2020-06-30 03:02:28 | 2020-06-30 04:19:05 |
>| 2020-06-26 08:04:06 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 3e9f96e9-fbf0-4794-857e-0176b20acc1d | hybridanalysispublicfeed-a224c21a15c76cce128657286145113d-2020-06-26 07:08:22 | 2020-06-26 08:04:06 |
>| 2020-06-26 08:02:03 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | f41ab1af-153e-4c3b-a634-93d5715f6d79 | hybridanalysispublicfeed-1685c35cea07561d27d02ead16579b80-2020-06-26 07:08:12 | 2020-06-26 08:02:03 |
>| 2020-06-26 07:56:03 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | eb67ce91-5206-4a2a-bec4-ffb30382b7fd | hybridanalysispublicfeed-23d365aaa5a9d0deebc8eb3ac1120119-2020-06-26 07:08:22 | 2020-06-26 07:56:03 |
>| 2020-05-15 00:03:18 | ENCLAVE | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | eab34a1a-7eda-40fa-a77f-8eaef75d5672 | REvil/Sodinokibi Threatens to Release Documents on Law Firms and President Trump | 2020-06-24 16:56:00 |
>| 2020-06-20 07:01:01 | ENCLAVE | 011ad71b-fd7d-44c2-834a-0d751299fb1f | f575bd0e-eff5-4be0-a37b-af97ef4b0757 | virustotal-URL-https://www.seattletimes.com/business/boeing-aerospace/boeing-hit-by-wannacry-virus-fears-it-could-cripple-some-jet-production/. | 2020-06-20 07:01:01 |
>| 2020-06-20 05:34:04 | ENCLAVE | ed35f85a-d6bf-4e74-a0f8-61651abf705e | f854ab11-8c44-4438-9cd1-aeb882f90df2 | X-Force URL: https://www.bloomberg.com/news/articles/2017-12-19/u-s-blames-north-korea-for-cowardly-wannacry-cyberattack. | 2020-06-20 05:34:04 |
>| 2020-06-20 05:30:00 | ENCLAVE | ed35f85a-d6bf-4e74-a0f8-61651abf705e | d6f75e4a-0f0c-4e9b-b798-ce5eaf3a3e2a | X-Force URL: https://www.dataprotectionreport.com/2017/05/wannacry-ransomware-attack-summary/ | 2020-06-20 05:30:00 |
>| 2020-06-20 05:25:00 | ENCLAVE | ed35f85a-d6bf-4e74-a0f8-61651abf705e | 4c65b47c-a290-4a83-8cde-a23019ce0301 | X-Force URL: https://www.forbes.com/sites/leemathews/2017/05/16/wannacry-ransomware-ms17-010/#1fe38b312609. | 2020-06-20 05:25:00 |
>| 2020-06-20 05:05:02 | ENCLAVE | ed35f85a-d6bf-4e74-a0f8-61651abf705e | 9e524c31-918e-4888-b5f2-04d029433ee2 | X-Force URL: https://www.seattletimes.com/business/boeing-aerospace/boeing-hit-by-wannacry-virus-fears-it-could-cripple-some-jet-production/. | 2020-06-20 05:05:02 |
>| 2020-06-18 12:56:00 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | e152cbcd-d61b-4b16-875a-9cec8d232643 | hybridanalysispublicfeed-6fd816cb36211fe24153420494319d86-2020-06-18 12:33:35 | 2020-06-18 12:56:00 |
>| 2020-06-18 06:54:00 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 4d1b8092-35c2-42f4-853b-d4156ea0cfc0 | hybridanalysispublicfeed-2e215373915334aafb1e6f0fd6e626c6-2020-06-18 06:15:42 | 2020-06-18 06:54:00 |
>| 2020-06-18 06:46:40 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 0bc27068-ae06-41da-8721-000524fe45cf | hybridanalysispublicfeed-2da0875fd08114fec91e54a1bac0f142-2020-06-18 06:15:32 | 2020-06-18 06:46:40 |
>| 2020-06-13 00:57:02 | ENCLAVE | 2eeccced-c740-4ad9-aa5c-82744cd1f6aa | 2d805eb5-0f4b-434f-8017-ad80f5ef795d | hybridanalysispublicfeed-84c82835a5d21bbcf75a61706d8ab549-2020-06-12 23:39:58 | 2020-06-13 00:57:02 |
>| 2020-04-17 21:18:30 | ENCLAVE | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | 72a99972-02e2-4414-9e56-e3b2d170f7ae | Global Spotlight - North Korea (Analyst Knowledge Page) | 2020-06-12 20:06:16 |
>| 2020-06-10 20:37:01 | ENCLAVE | d039cebb-fb2a-411f-bbc8-7e6a80af105f | e36505b3-de31-48f9-a39b-9dba57051fe2 | URLhaus - https://github.com/71e6fd52/wannacry/raw/master/wannacry.exe | 2020-06-10 20:37:01 |
>| 2020-03-25 17:41:22 | ENCLAVE | 82c899e4-1031-4e5a-bb0b-c91a4e95150c | e218d224-c92f-4004-8614-580d8a02440b | Hungary Global Spotlight (Analyst Knowledge Page) | 2020-06-09 20:48:08 |

### trustar-add-to-whitelist

***
Add to allow list a list of indicator values for the user’s company.

#### Base Command

`trustar-add-to-whitelist`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicators | CSV of indicators to add to allow list, i.e. evil.com,101.43.52.224 | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-add-to-whitelist indicators=8.8.8.8```

#### Context Example

{}


#### Human Readable Output

>['8.8.8.8'] added to the allow list successfully

### trustar-remove-from-whitelist

***
Delete an indicator from the user’s company allow list.

#### Base Command

`trustar-remove-from-whitelist`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| indicator | The value of the indicator to delete. | Required |
| indicator_type | The type of the indicator to delete. | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-remove-from-whitelist indicator=8.8.8.8 indicator_type=IP```

#### Context Example

{}


#### Human Readable Output

>8.8.8.8 removed from the allow list successfully

### trustar-get-phishing-submissions

***
Fetches all phishing submissions that fit the given criteria

#### Base Command

`trustar-get-phishing-submissions`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| priority_event_score | List of email submissions scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. -1,0,2) | Optional |
| from_time | Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| to_time | End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| status | A list of triage statuses for submissions (UNRESOLVED,CONFIRMED,IGNORED); only email submissions marked with at least one of these statuses will be returned | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.PhishingSubmission.submissionId | string | The submission ID |
| TruSTAR.PhishingSubmission.title | string | Submission title |
| TruSTAR.PhishingSubmission.normalizedTriageScore | number | Submission triage score |
| TruSTAR.PhishingSubmission.context.indicatorType | string | Indicator type |
| TruSTAR.PhishingSubmission.context.sourceKey | string | Indicator source |
| TruSTAR.PhishingSubmission.context.normalizedSourceScore | number | Indicator score |
| TruSTAR.PhishingSubmission.context.originalIndicatorScore.name | string | Original Indicator score name |
| TruSTAR.PhishingSubmission.context.originalIndicatorScore.value | string | Original Indicator score value |

#### Command Example

```!trustar-get-phishing-submissions from_time="7 days ago"```

#### Context Example

{}


#### Human Readable Output

>No phishing submissions were found.

### trustar-set-triage-status

***
Marks a phishing email submission with one of the phishing namespace tags

#### Base Command

`trustar-set-triage-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| submission_id | ID of the email submission | Required |
| status | Submission status | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!trustar-set-triage-status submission_id=6e00a714-379a-4db8-ac0c-812a629c8288 status=CONFIRMED```

#### Context Example

{}


#### Human Readable Output

>Submission ID 6e00a714-379a-4db8-ac0c-812a629c8288 is ['CONFIRMED']

### trustar-get-phishing-indicators

***
Get phishing indicators that match the given criteria.

#### Base Command

`trustar-get-phishing-indicators`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| normalized_indicator_score | List of Intel scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. 0,2,3), | Optional |
| priority_event_score | List of email submissions scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. 0,2,3), | Optional |
| from_time | Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| to_time | End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. | Optional |
| status | A list of triage statuses for submissions; only email submissions marked with at least one of these statuses will be returned. Options are 'UNRESOLVED', 'CONFIRMED', 'IGNORED' | Optional |
| limit | Limit of results to return. Max value possible is 1000. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TruSTAR.PhishingIndicator.indicatorType | string | Indicator Type |
| TruSTAR.PhishingIndicator.normalizedIndicatorScore | number | Indicator normalized score |
| TruSTAR.PhishingIndicator.originalIndicatorScore.name | string | Indicator original score name |
| TruSTAR.PhishingIndicator.originalIndicatorScore.value | string | Indicator original score value |
| TruSTAR.PhishingIndicator.sourceKey | string | Indicator source key |
| TruSTAR.PhishingIndicator.value | string | Indicator value |
| File.Name | String | The full file name \(including file extension\). |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA1 hash of the file. |
| IP.Address | String | IP address |
| URL.Data | String | The URL |
| CVE.ID | String | The ID of the CVE, for example: CVE\-2015\-1653 |
| Account.Email.Address | String | The email address of the account. |
| RegistryKey.Path | String | The path to the registry key |
| Domain.Name | String | The domain name, for example: "google.com". |
| DBotScore.Indicator | string | The indicator we tested |
| DBotScore.Type | string | The type of the indicator |
| DBotScore.Vendor | string | Vendor used to calculate the score |
| DBotScore.Score | number | The actual score |

#### Command Example

```!trustar-get-phishing-indicators from_time="7 days ago"```

#### Context Example

{}
```

Human Readable Output

No phishing indicators were found.

Configuration parameters

server — Server URL (e.g. https://api.trustar.co) (required)
station — Station URL (e.g. https://station.trustar.co)
key — TruSTAR API Key (required)
secret — TruSTAR API Secret (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (22)

trustar-add-to-whitelist
Add to allow list a list of indicator values for the user’s company.
trustar-copy-report
Copies a report from one enclave to another.
trustar-correlated-reports
Returns a list of all reports that contain any of the provided indicator values.
trustar-delete-report
Deletes a report as specified by given id (id can be TruSTAR report id or external id).
trustar-get-enclaves
Returns the list of all enclaves that the user has access to, as well as whether they can read, create, and update reports in that enclave.
trustar-get-indicators-for-report
Return a list of indicators extracted from a report.
trustar-get-phishing-indicators
Get phishing indicators that match the given criteria.
trustar-get-phishing-submissions
Fetches all phishing submissions that fit the given criteria.
trustar-get-reports
Returns incident reports matching the specified filters. All parameters are optional: if nothing is specified, the latest 25 reports accessible by the user will be returned (matching the view the user would have by logging into Station).
trustar-get-whitelisted-indicators
Gets a list of indicators that the user’s company has added to allow list.
trustar-indicator-summaries
Provides structured summaries about indicators, which are derived from intelligence sources on the TruSTAR Marketplace.
trustar-indicators-metadata
Provide metadata associated with a list of indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags. The metadata is determined based on the enclaves the user making the request has READ access to.
trustar-move-report
Move a report from one enclave to another.
trustar-related-indicators
Finds all reports that contain any of the given indicators and returns correlated indicators from those reports.
trustar-remove-from-whitelist
Delete an indicator from the user’s company allow list.
trustar-report-details
Finds a report by its ID and returns the report details.
trustar-search-indicators
Searches for all indicators that contain the given search term.
trustar-search-reports
Searches for all reports that contain the given search term.
trustar-set-triage-status
Marks a phishing email submission with one of the phishing namespace tags.
trustar-submit-report
Submit a new incident report, and receive the ID it has been assigned in TruSTAR’s system.
trustar-trending-indicators
Find indicators that are trending in the community.
trustar-update-report
Update the report with the specified ID. Either the internal TruSTAR report ID or an external tracking ID can be used. Only the fields passed will be updated. All others will be left unchanged.

Source

TruSTAR_V2.py TruSTAR_V2_test.py TruSTAR_V2.yml TruSTAR_V2_description.md command_examples.txt

Download History Raw

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
from typing import Tuple


''' IMPORTS '''

import dateparser
import requests
import trustar
import urllib3
from trustar.models.indicator import Indicator
from trustar.models.report import Report

# Disable insecure warnings
urllib3.disable_warnings()

handle_proxy()


class Utils(object):
    """
    Class with some utility methods.
    """
    @staticmethod
    def normalize_time(timestamp):
        ''' Converts unix epoch time to GMT '''
        if isinstance(timestamp, str):
            return timestamp
        return time.strftime('%Y-%m-%d %H:%M:%S', time.gmtime(timestamp / 1000.0))

    @staticmethod
    def date_to_unix(timestamp):
        d = dateparser.parse(timestamp)
        assert d is not None, f'could not parse {timestamp}'
        return int(d.strftime("%s")) * 1000


class ContextManager(object):
    """
    Manages where to put the data depending if the data to output is an indicator or not.

    If data is an indicator, the data is returned on 3 contexts:
    - DBotScore context: Contains the value of the IOC, the vendor (TruSTAR) and a score of 0.
    - Standard context: Groups all IOCs by types and returns the value of each one.
    - TruSTAR context: Contains all the information fetched from TruSTAR corresponding to each indicator.
    Data is also returned on the TruSTAR context for phishing submissions and reports.
    """

    INDICATOR_TYPES = {
        'URL': Common.URL,
        'IP': Common.IP,
        'DOMAIN': Common.Domain,
        'CVE': Common.CVE
    }

    DBOTSCORE_TYPES = {
        'URL': DBotScoreType.URL,
        'IP': DBotScoreType.IP,
        'DOMAIN': DBotScoreType.DOMAIN,
        'CVE': DBotScoreType.CVE,
        'SOFTWARE': DBotScoreType.FILE,
        'SHA256': DBotScoreType.FILE,
        'SHA1': DBotScoreType.FILE,
        'MD5': DBotScoreType.FILE,
    }

    FILE_TYPES = ['SOFTWARE', 'SHA256', 'SHA1', 'MD5']

    def _get_dbot_score(self, ts_indicator):
        """ Returns a DBotScore object with score as None """
        indicator_type = ts_indicator.get('indicatorType')
        dbot_score = Common.DBotScore(
            indicator=ts_indicator.get('value'),
            indicator_type=self.DBOTSCORE_TYPES.get(indicator_type),
            integration_name='TruSTAR',
            score=Common.DBotScore.NONE
        )
        return dbot_score

    def _get_xsoar_file_indicator(self, ts_indicator, dbot_score):
        """
        Returns a Common.File object. Handles logic to create the object with
        the corresponding type (SHA1, SHA256, MD5 or Name if software).
        """

        key = ts_indicator.get('indicatorType')
        key = "name" if key == "SOFTWARE" else key
        value = ts_indicator.get('value')
        args = {
            key.lower(): value,
            'dbot_score': dbot_score
        }
        xsoar_file_indicator = Common.File(**{k: v for k, v in args.items() if k})
        return xsoar_file_indicator

    def _get_xsoar_indicator_and_readable_output(self, ts_indicator) -> Tuple[Common.Indicator, str]:
        """
        Returns a XSoar Indicator with DBotScore embedded and their human readable. Indicators can be:
        - Common.File
        - Common.IP
        - Common.URL
        - Common.CVE
        """

        indicator_type = ts_indicator.get('indicatorType')
        if indicator_type == "CVE":
            return (Common.CVE(ts_indicator.get('value'), None, None, None, None),
                    f'Fetched CVE {ts_indicator.get("value")} details')

        dbot_score = self._get_dbot_score(ts_indicator)
        if indicator_type in self.FILE_TYPES:
            return (self._get_xsoar_file_indicator(ts_indicator, dbot_score),
                    f'Fetched File {ts_indicator.get("value")} details')

        XSOARIndicator = self.INDICATOR_TYPES.get(indicator_type)
        xsoar_indicator = XSOARIndicator(
            ts_indicator.get('value'),
            dbot_score=dbot_score
        ) if XSOARIndicator is not None else None
        return xsoar_indicator, f'Fetched {indicator_type} {ts_indicator.get("value")} details'

    def _remove_priority_level(self, indicator_dict):
        """  Removes priority level from indicator. It is a deprecated field """
        if indicator_dict.get('priorityLevel'):
            indicator_dict.pop('priorityLevel')

        return indicator_dict

    def get_context(self, indicators, context='Indicator'):
        """
        Handles logic to return an entry context with xsoar and non xsoar indicators
        on their corresponding contexts.
        """
        context_results: List[dict] = []
        indicators = [self.convert_indicator_timestamps(d) for d in indicators]
        indicators = [self._remove_priority_level(d) for d in indicators]
        xsoar_indicators = [
            self._get_xsoar_indicator_and_readable_output(d)
            for d in indicators
            if d.get('indicatorType') not in {'EMAIL_ADDRESS', 'REGISTRY_KEY', 'MALWARE', 'CIDR_BLOCK'}
        ]
        for xsoar_ioc, hr in xsoar_indicators:
            context_results.append(CommandResults(
                indicator=xsoar_ioc,
                readable_output=hr
            ).to_context())

        standard_context = self.get_non_xsoar_standard_context(indicators)
        results = CommandResults(
            outputs_prefix=f'TruSTAR.{context}',
            outputs_key_field='value',
            outputs=indicators,
        )
        context = results.to_context()
        context['EntryContext'].update(standard_context)

        # insert the TruStar result as the first item in results
        context_results.insert(0, context)
        return context_results

    def convert_indicator_timestamps(self, indicator):
        """ Converts indicator timestamp fields. """
        d = {
            t: Utils.normalize_time(indicator.get(t))
            for t in ['firstSeen', 'lastSeen']
            if t in indicator.keys()
        }
        indicator.update(d)
        return indicator

    def get_indicators_context(self, indicators, context='Indicators'):
        ts_indicator_dicts = [
            i.to_dict(remove_nones=True)
            for i in indicators
        ]

        return self.get_context(ts_indicator_dicts, context)

    def get_indicator_summaries_context(self, indicators, context='Indicators'):
        ts_indicator_dicts = [
            i.to_dict(remove_nones=True)
            for i in indicators
        ]

        for d in ts_indicator_dicts:
            d['indicatorType'] = d.pop('type')  # Adding IndicatorType field

        return self.get_context(ts_indicator_dicts, context)

    def get_non_xsoar_standard_context(self, indicator_dicts):
        """
        Returns a standard context for those indicator types that can not be automated
        with one of the 'Common' classes. Depending on the type of indicator,
        the data is put on the corresponding context.
        """
        emails = [
            {'Address': i.get('value')}
            for i in indicator_dicts
            if i.get('indicatorType') == "EMAIL_ADDRESS"
        ]

        registries = [
            {'Path': i.get('value')}
            for i in indicator_dicts
            if i.get('indicatorType') == "REGISTRY_KEY"
        ]
        standard_ec = {}
        if emails:
            standard_ec['Account.Email(val.Address && val.Address === obj.Address)'] = emails
        if registries:
            standard_ec['RegistryKey(val.Path && val.Path === obj.Path)'] = registries

        return standard_ec

    def translate_triage_submission(self, submissions):
        """ Returns Entry Contex for Phishing Submissions """
        submission_dicts = [s.to_dict(remove_nones=True) for s in submissions]
        ec = {'TruSTAR.PhishingSubmission(val.submissionId == obj.submissionId)': submission_dicts}
        return submission_dicts, ec

    def get_enclaves_ec(self, enclaves):

        context = [enclave.to_dict(remove_nones=True) for enclave in enclaves]
        ec = {
            'TruSTAR.Enclave(val.id && val.id === obj.id)': context
        }
        return context, ec

    def _get_report_context_fields(self, report):
        context_fields = ["id", "title", "reportBody"]
        fields = {k: v for k, v in report.items() if k in context_fields}
        return fields

    def get_reports_ec(self, reports):
        """ Returns entry context for Reports """
        context = [self._get_report_context_fields(report) for report in reports]
        ec = {
            'TruSTAR.Report(val.id && val.id === obj.id)': context
        }
        return ec

# ## CLIENT ###


class TrustarClient:
    """
    Class wrapper of TruSTAR SDK.

    Interpretates a command and retrieves the correspondding data
    from TruSTAR to be shown on the war room and put on the corresponding
    context.
    """

    LIST_ARGS = [
        "indicators",
        "indicator_types",
        "values",
        "enclave_ids",
        "priority_event_score",
        "normalized_indicator_score",
        "status",
        "tags",
        "exclueded_tags"
    ]

    def __init__(self, config, station=''):
        self.client = trustar.TruStar(config=config)
        self.command_dict = self._build_command_dict()
        self.context_manager = ContextManager()
        self.station = station

    def _build_command_dict(self):
        command_dict = {
            'test-module': self.test_module,
            'trustar-get-reports': self.get_reports,
            'trustar-get-enclaves': self.get_enclaves,
            'trustar-related-indicators': self.get_related_indicators,
            'trustar-indicators-metadata': self.get_indicators_metadata,
            'trustar-indicator-summaries': self.get_indicator_summaries,
            'trustar-get-whitelisted-indicators': self.get_whitelist,
            'trustar-move-report': self.move_report,
            'trustar-trending-indicators': self.get_trending_indicators,
            'trustar-get-indicators-for-report': self.get_indicators_for_report,
            'trustar-search-indicators': self.search_indicators,
            'trustar-submit-report': self.submit_report,
            'trustar-delete-report': self.delete_report,
            'trustar-correlated-reports': self.get_correlated_reports,
            'trustar-add-to-whitelist': self.add_to_whitelist,
            'trustar-remove-from-whitelist': self.remove_from_whitelist,
            'trustar-report-details': self.get_report_details,
            'trustar-update-report': self.update_report,
            'trustar-search-reports': self.search_reports,
            'trustar-get-phishing-indicators': self.get_all_phishing_indicators,
            'trustar-get-phishing-submissions': self.get_phishing_submissions,
            'trustar-set-triage-status': self.set_triage_status,
            'trustar-copy-report': self.copy_report
        }
        return command_dict

    def get_entry(self, title='', contents=None, ec=None):
        """
        Returns Context dictionary
        """
        entry = {
            'Type': EntryType.NOTE,
            'Contents': contents,
            'ContentsFormat': EntryFormat.JSON,
            'ReadableContentsFormat': EntryFormat.MARKDOWN,
            'HumanReadable': tableToMarkdown(title, contents),
        }
        if ec:
            entry['EntryContext'] = ec

        return entry

    def get_report_timestamps(self, report):
        """ Given a report dictionary, it returns the timestamp fields
        on a dictionary.
        """
        d = {
            t: Utils.normalize_time(report[t])
            for t in ['updated', 'created', 'timeBegan']
            if report.get(t)
        }
        return d

    def get_report_deep_link(self, report_id):
        """ Returns report link on TruSTAR self.station. """
        return f'{self.station}/constellation/reports/{report_id}'

    def test_module(self):
        """Tests connectivity with TruSTAR"""
        try:
            self.client.ping()
            return "ok"
        except requests.exceptions.HTTPError:
            return ("Invalid Credentials. Please check your API Key and Secret"
                    "are correct on TruSTAR Station. Settings > API")

    def search_indicators(self,
                          search_term=None,
                          enclave_ids=None,
                          from_time=None,
                          to_time=None,
                          indicator_types=None,
                          tags=None,
                          excluded_tags=None,
                          limit=None):
        """
        Searches for all indicators that contain the given search term.

        :param search_term: Term to be searched.
        :param enclave_ids: list of enclaves to restrict the search to.
        "param limit: Max number of entries to be returned.

        :return: Entry context with found indicators.
        """
        """
        Searches for all indicators that contain the given search term.

        :param search_term: Term to be searched.
        :param enclave_ids: list of enclaves to restrict the search to.
        "param limit: Max number of entries to be returned.

        :return: Entry context with found indicators.
        """
        from_time = Utils.date_to_unix(from_time) if from_time else from_time
        to_time = Utils.date_to_unix(to_time) if to_time else to_time
        try:
            response = self.client.search_indicators_page(
                search_term=search_term,
                enclave_ids=enclave_ids,
                from_time=from_time,
                to_time=to_time,
                tags=tags,
                indicator_types=indicator_types,
                excluded_tags=excluded_tags,
                page_number=0,
                page_size=limit,
            )

            if not response:
                return 'No indicators were found.'

        except requests.exceptions.HTTPError as err:
            if err.response.status_code == 400:
                return 'No indicators were found.'

            raise(err)

        results = self.context_manager.get_indicators_context(response)
        return results

    def get_reports(self,
                    from_time=None,
                    to_time=None,
                    enclave_ids=None,
                    distribution_type=None,
                    tags=None,
                    excluded_tags=None):
        """
        Returns incident reports matching the specified filters.

        :param from_time: Start of polling window.
        :param to_time: End of polling window.
        :param enclave_ids: List of user enclaves to restrict the query.
        :param distribution_type: Whether to search for reports in the community, or only
        in enclaves.
        :param tags: a list of names of tags to filter by.
        :param excluded_tags: reports containing ANY of these tags will be excluded from the
        results.

        :return: Entry context with found reports.
        """
        is_enclave = (distribution_type == 'ENCLAVE')
        from_time = Utils.date_to_unix(from_time) if from_time else from_time
        to_time = Utils.date_to_unix(to_time) if to_time else to_time
        response = self.client.get_reports_page(
            is_enclave,
            enclave_ids,
            tags,
            excluded_tags,
            from_time,
            to_time
        )

        if not response:
            return 'No reports were found.'

        reports = []
        for report in response.items:
            current_report = report.to_dict(remove_nones=True)
            current_report['reportDeepLink'] = self.get_report_deep_link(current_report.get("id"))
            current_report.update(self.get_report_timestamps(current_report))
            reports.append(current_report)

        ec = self.context_manager.get_reports_ec(reports)
        title = 'TruSTAR reports'
        entry = self.get_entry(title, reports, ec)
        return entry

    def submit_report(self,
                      title=None,
                      report_body=None,
                      enclave_ids=None,
                      external_url=None,
                      time_began=None,
                      distribution_type="ENCLAVE",
                      redact="NO"):
        """
        Submits a new report to TruSTAR station.

        :param title: Title of the report.
        :param report_body: Body of the report.
        :param enclave_ids: Enclave IDs where to submit the report.
        :param external_url: External URL of the report.
        :param time_began: Incident time. Defaults to current time if not given.
        :param distribution_type: Whether the report will be in the community, or only
        in enclaves
        :param redact: Wether to redact a report before submitting or not.

        :return: Entry context with the submitted report.
        """
        if distribution_type == 'ENCLAVE' and enclave_ids is None:
            raise Exception('Distribution type is ENCLAVE, but no enclave ID was given.')

        if redact == "YES":
            response = self.client.redact_report(
                title=title,
                report_body=report_body
            )

            title = response.title
            report_body = response.body

        ts_report = trustar.models.Report(
            title=title,
            body=report_body,
            enclave_ids=enclave_ids,
            is_enclave=(distribution_type == 'ENCLAVE'),
            time_began=time_began,
            external_url=external_url
        )

        response = self.client.submit_report(ts_report)
        report = ts_report.to_dict(remove_nones=True)
        report['reportDeepLink'] = self.get_report_deep_link(response.id)
        report['id'] = response.id
        ec = self.context_manager.get_reports_ec([report])
        title = 'TruSTAR report was successfully created'
        entry = self.get_entry(title, report, ec)
        return entry

    def delete_report(self, report_id=None, id_type=None):
        """
        Deletes report from TruStar.

        :param report_id: ID of the report to be deleted.
        :param id_type: Report id type. External or internal.

        :return: Success Message.
        """
        self.client.delete_report(report_id, id_type)
        return f'Report {report_id} was successfully deleted'

    def get_correlated_reports(self,
                               indicators=None,
                               enclave_ids=None,
                               distribution_type=None,
                               limit=None):
        """
        Returns a list of all reports that contain any of the provided
        indicator values.

        :param indicators: indicators list to perform the query.
        :param enclave_ids: enclaves list to restrict the query.
        :param distribution_type: Distribution type of the report.
        :param limit: Maximum value of report to be returned.

        :return: Entry context with found reports.
        """
        response = self.client.get_correlated_reports_page(
            indicators,
            enclave_ids,
            is_enclave=(distribution_type == "ENCLAVE"),
            page_number=0,
            page_size=limit
        )

        if not response:
            return 'No reports were found.'

        correlated_reports = []
        for report in response:
            current_report = report.to_dict(remove_nones=True)
            current_report.update(self.get_report_timestamps(current_report))
            correlated_reports.append(current_report)

        title = 'TruSTAR correlated reports'
        entry = self.get_entry(title, correlated_reports)
        return entry

    def get_report_details(self, report_id=None, id_type=None):
        """
        Finds a report by its ID and returns the report details.

        :param report_id: Report ID.
        :param id_type: Type of report ID. External or internal.

        :return: Entry context with Report queried.
        """
        response = self.client.get_report_details(report_id, id_type)
        if not response:
            return f"No details were found for report ID {report_id}"

        current_report_dict = response.to_dict(remove_nones=True)
        id = current_report_dict.get("id")
        current_report_dict.update(self.get_report_timestamps(current_report_dict))
        current_report_dict['reportDeepLink'] = self.get_report_deep_link(id)

        ec = self.context_manager.get_reports_ec([current_report_dict])

        title = f'TruSTAR report ID {report_id} details'
        entry = self.get_entry(title, current_report_dict, ec)
        return entry

    def update_report(self, **kwargs):
        """
        Update the report with the specified ID. Either the internal TruSTAR
        report ID or an external tracking ID can be used. Only the fields passed will
        be updated. All other fiels will remain unchanged.

        :return: Entry Context with updated report.
        """
        report_id = kwargs.pop('report_id')
        ts_report = self.client.get_report_details(report_id).to_dict()

        if kwargs.get('distribution_type'):
            kwargs["distributionType"] = kwargs.pop('distribution_type')

        if kwargs.get('report_body'):
            kwargs["reportBody"] = kwargs.pop('report_body')

        if kwargs.get('enclave_ids'):
            kwargs["enclaveIds"] = kwargs.pop('enclave_ids')

        if kwargs.get('external_url'):
            kwargs["externalUrl"] = kwargs.pop('external_url')

        if kwargs.get('time_began'):
            kwargs["timeBegan"] = kwargs.pop('time_began')

        ts_report.update(kwargs)
        self.client.update_report(Report.from_dict(ts_report))

        ts_report.update(self.get_report_timestamps(ts_report))
        ts_report['reportDeepLink'] = self.get_report_deep_link(report_id)
        ec = self.context_manager.get_reports_ec([ts_report])

        title = 'TruSTAR report was successfully updated'
        entry = self.get_entry(title, ts_report, ec)
        return entry

    def get_enclaves(self):
        """
        Returns the list of all enclaves that the user has access to, as
        well as whether they can read, create, and update reports in that enclave.

        :return: Entry context with list of enclaves
        """
        response = self.client.get_user_enclaves()
        enclaves, ec = self.context_manager.get_enclaves_ec(response)

        if not response:
            return "No enclaves were found."

        title = 'TruSTAR Enclaves'
        entry = self.get_entry(title, enclaves, ec)
        return entry

    def get_related_indicators(self, indicators=None, enclave_ids=None, limit=None):
        """
        Finds all reports that contain any of the given indicators
        and returns correlated indicators from those reports.

        :param indicators: list of indicator values.
        :param enclave_ids: list of enclaves to filter found reports.
        :param limit: Max num of related indicators to return.

        :return: Entry Context with related indicators.
        """
        related_indicator_response = self.client.get_related_indicators_page(
            indicators=indicators,
            enclave_ids=enclave_ids,
            page_size=limit,
            page_number=0
        )

        if not related_indicator_response:
            return f'No indicators related to {indicators} were found.'

        results = self.context_manager.get_indicators_context(related_indicator_response.items)
        return results

    def get_trending_indicators(self, indicator_type=None, days_back=None):
        """
        Find indicators that are trending in the community.

        :param indicator_type: Types of indicators to be returned. If is equal to 'other',
        then all indicator types except for CVE and MALWARE will be returned.
        :param days_back: The number of days back to count correlations for.

        """
        indicator_type = None if indicator_type == 'other' else indicator_type
        response = self.client.get_community_trends(indicator_type, days_back)

        if not response:
            return 'No trending indicators were found.'

        results = self.context_manager.get_indicators_context(response)
        return results

    def search_reports(self,
                       search_term=None,
                       enclave_ids=None,
                       from_time=None,
                       to_time=None,
                       tags=None,
                       excluded_tags=None,
                       limit=None):
        """
        Searches for all reports that contain the given search term.

        :param search_term: term to search for within the reports.
        :param enclave_ids: list of enclaves to restrict te search to.

        :return: Entry Context with Found reports.
        """
        from_time = Utils.date_to_unix(from_time) if from_time else from_time
        to_time = Utils.date_to_unix(to_time) if to_time else to_time
        response = self.client.search_reports_page(
            search_term=search_term,
            enclave_ids=enclave_ids,
            from_time=from_time,
            to_time=to_time,
            tags=tags,
            excluded_tags=excluded_tags,
            page_number=0,
            page_size=limit
        )
        if not response:
            return "No reports were found"

        reports = []
        for report in response:
            current_report = report.to_dict(remove_nones=True)
            current_report.update(self.get_report_timestamps(current_report))
            reports.append(current_report)

        ec = self.context_manager.get_reports_ec(reports)

        title = f'TruSTAR reports that contain the term {search_term}'
        entry = self.get_entry(title, reports, ec)
        return entry

    def add_to_whitelist(self, indicators=None):
        """
        Adds a list of indicators to the Company's whitelist.

        :param indicators: list of indicators to be whitelisted.

        :return: Message indicating if the request was successful or not.
        """
        response = self.client.add_terms_to_whitelist(indicators)
        if not response:
            return 'Indicator could not be added to the whitelist.'

        return f'{indicators} added to the whitelist successfully'

    def remove_from_whitelist(self, indicator=None, indicator_type=None):
        """
        Deletes an indicator from the Company's whitelist.

        :param indicator: Indicator to be deleted.
        :param indicator_type: type of the indicator to be deleted.

        :return: Message with the result of the request.
        """
        ts_indicator = Indicator(
            value=indicator,
            type=indicator_type
        )
        try:
            self.client.delete_indicator_from_whitelist(ts_indicator)
            return f'{indicator} removed from the whitelist successfully'
        except Exception:
            return 'Indicator could not be removed from the whitelist.'

    def get_indicators_metadata(self, indicators=None, enclave_ids=None):
        """
        Provide metadata associated with a list of indicators. The metadata is determined based on the
        enclaves the user making the request has READ access to.

        :param indicators: indicators list to search the corresponding metadata.
        :param enclave_ids: list of enclave IDs to restrict to. By default, uses all of the user's enclaves.

        :return: Entry context with indicators metadata.
        """

        ts_indicators = [Indicator(value=i) for i in indicators]
        response = self.client.get_indicators_metadata(ts_indicators, enclave_ids)

        if not response:
            return 'No indicators metadata were found.'

        results = self.context_manager.get_indicators_context(response, "IndicatorsMetadata")
        return results

    def get_indicator_summaries(self, values=None, enclave_ids=None, limit=None):
        """
        Provides structured summaries about indicators, which are derived from
        intelligence sources on the TruSTAR Marketplace.

        :param values: list of indicator values to search on TruSTAR.
        :param enclave_ids: list of enclave_ids to restrict the query.
        :param limit: Maximum value of entries to return.

        :return: Entry Context with indicator summaries.
        """
        response = self.client.get_indicator_summaries_page(
            values,
            enclave_ids=enclave_ids,
            page_number=0,
            page_size=limit
        )

        if not response:
            return 'No indicator summaries were found.'

        results = self.context_manager.get_indicator_summaries_context(response.items, "IndicatorSummaries")
        return results

    def move_report(self, report_id=None, dest_enclave_id=None):
        """
        Moves report from one user enclave to another.

        :param report_id: Report ID.
        :dest_enclave_id: Enclave ID where the report will be moved.

        :return: Success Message.
        """
        response = self.client.move_report(report_id=report_id, dest_enclave_id=dest_enclave_id)
        return f"{response} has been moved to enclave id: {dest_enclave_id}"

    def copy_report(self, report_id=None, dest_enclave_id=None):
        """
        Copies report from one user enclave to another.

        :param report_id: Report ID.
        :dest_enclave_id: Enclave ID where the report will be moved.

        :return: Success Message.
        """

        response = self.client.copy_report(src_report_id=report_id, dest_enclave_id=dest_enclave_id)
        return f"{report_id} has been copied to enclave id: {dest_enclave_id} with id: {response}"

    def get_whitelist(self, limit=None):
        """
        Gets a list of indicators that the user's company has whitelisted.

        :param limit: Maximum number of whitelisted indicators to return.
        :return: Entry context with whitelisted indicators.
        """

        response = self.client.get_whitelist_page(page_number=0, page_size=limit)
        if not response:
            return 'No Whitelist was found.'

        results = self.context_manager.get_indicators_context(response.items, 'WhitelistedIndicators')
        return results

    def get_indicators_for_report(self, report_id=None, limit=None):
        """
        Return a list of indicators extracted from a report.

        :param report_id: Report ID to extract indicators from.
        :param limit: Max number of indicators to return.

        :return: Entry context with extracted indicators.
        """

        response = self.client.get_indicators_for_report_page(
            report_id=report_id,
            page_number=0,
            page_size=limit
        )

        if not response:
            return f'No Indicators were found in report {report_id}.'

        results = self.context_manager.get_indicators_context(response.items)
        return results

    def get_all_phishing_indicators(self,
                                    priority_event_score=None,
                                    normalized_indicator_score=None,
                                    from_time=None,
                                    to_time=None,
                                    status=None,
                                    limit=None):
        """
        Get phishing indicators that match the given criteria.

        :param priority_event_score: A list with the scores to restrict the search to.
        :param normalized_indicator_score: A list with the scores to restrict the search to.
        :param from_time: Start of the polling window.
        :param to_time: End of the polling window.
        :param status: Status of the phishing indicatror.
        :param limit: Limit of results to return. Default is 25.

        :return: Entry Context with Phishing Indicators found.
        """
        args = {'priority_event_score': priority_event_score,
                'normalized_indicator_score': normalized_indicator_score,
                'status': status,
                'page_size': limit,
                'from_time': Utils.date_to_unix(from_time) if from_time else None,
                'to_time': Utils.date_to_unix(to_time) if to_time else None}
        response = self.client.get_phishing_indicators_page(**args)  # pylint: disable=E1123
        if not response:
            return 'No phishing indicators were found.'

        results = self.context_manager.get_indicators_context(response.items, 'PhishingIndicator')
        return results

    def get_phishing_submissions(self,
                                 priority_event_score=None,
                                 from_time=None,
                                 to_time=None,
                                 status=None,
                                 limit=None):
        """
        Fetches all phishing submissions that fit the given criteria.

        :param priority_event_score: List of scores to restrict the search to.
        :param from_time: Start of polling window.
        :param to_time: End of polling window.
        :param status: List of phishing submission status to restrict the search to.
        :param limit: Limit of results to return. Default is 25.

        :return: Entry Context with all phishing submissions found.
        """
        args = {'priority_event_score': priority_event_score,
                'status': status,
                'page_size': limit,
                'from_time': Utils.date_to_unix(from_time) if from_time else None,
                'to_time': Utils.date_to_unix(to_time) if to_time else None}
        response = self.client.get_phishing_submissions_page(**args)  # pylint: disable=E1123
        if not response.items:
            return 'No phishing submissions were found.'

        submissions, ec = self.context_manager.translate_triage_submission(response.items)
        title = 'TruSTAR phishing triage submissions'
        entry = self.get_entry(title, submissions, ec)
        return entry

    def set_triage_status(self, submission_id=None, status=None):
        """
        Marks a phishing email submission with one of the phishing namespace.

        :param submission_id: Phishing Submission ID.
        :param status: Submission status.

        :return: Request status message.
        """
        try:
            response = self.client.mark_triage_status(submission_id, status)
            response.raise_for_status()
            return f'Submission ID {submission_id} is {status}'
        except requests.exceptions.HTTPError as err:
            return str(err)

    def process(self, command, **kwargs):
        """
        Processes the command that the user has selected. Retrieves the params and converts
        them to the methods params syntax. Then makes the call to the helper method of the
        corresponding command and return the results. It puts data on the corresponding context and
        it also shows the data on the War room.
        """
        func = self.command_dict.get(command)
        args = {k.replace("-", "_"): v for k, v in kwargs.items()}
        list_args = {k: argToList(v) for k, v in args.items() if k in self.LIST_ARGS}
        args.update(list_args)
        result = func(**args)
        return return_results(result)


def main():
    """ PARSE AND VALIDATE INTEGRATION PARAMS """

    server = demisto.params().get('server')
    station = demisto.params().get('station')
    api_key = str(demisto.params().get('key'))
    api_secret = str(demisto.params().get('secret'))
    base_url = server + '/api/1.3' if server else None
    insecure = not demisto.params().get('insecure', False)

    LOG(f'command is {demisto.command()}')

    config = {
        'user_api_key': api_key,
        'user_api_secret': api_secret,
        'api_endpoint': base_url,
        'verify': insecure,
        'client_type': "Python_SDK",
        'client_metatag': "demisto-xsoar"
    }

    try:
        client = TrustarClient(config, station)
        client.process(demisto.command(), **demisto.args())

    except requests.exceptions.HTTPError as e:
        if e.response.status_code == 401:
            return_error("Invalid Credentials. Please check your API Key and "
                         "Secret are correct on TruSTAR Station. Settings > API")

        return_error(f'Failed to execute {demisto.command()} command. Error: {str(e)}')

    except Exception as e:
        return_error(f'Failed to execute {demisto.command()} command. Error: {str(e)}')


if __name__ in ('__main__', '__builtin__', 'builtins'):
    main()