USTA

Details

ID	`USTA`
Provider	PRODAFT
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

USTA is an Cyber Intelligence Platform that responds directly and effectively to today’s complex cyber threats.

Configure USTA in Cortex

Parameter	Description	Required
Server URL (e.g. https://usta.prodaft.com)		True
API Key	You can reach out your access token : https://usta.prodaft.com/#/api-documents	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

usta-get-malicious-urls

You can get malicious URLs with this command

Base Command

usta-get-malicious-urls

Input

Argument Name	Description	Required
format	Format type of the returned result. Possible values are: json, stix, stix2, txt. Default is json.	Optional
url	Filtering by URL Address.	Optional
is_domain	You can search only those with or without domain name registration. Possible values are: true, false. Default is true.	Optional
url_type	Filtering by malicious type.	Optional
tag	Filtering by tags. Example: tag=Keitaro.	Optional
start	Starting date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).	Optional
end	End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).	Optional

Context Output

Path	Type	Description
Usta.MaliciousUrl.country	unknown	Country
Usta.MaliciousUrl.created	unknown	Created Date
Usta.MaliciousUrl.domain	unknown	Domain
Usta.MaliciousUrl.ip_addresses	unknown	IP Addresses
Usta.MaliciousUrl.is_domain	unknown	Is Domain
Usta.MaliciousUrl.modified	unknown	Modified Date
Usta.MaliciousUrl.tags	unknown	Tags
Usta.MaliciousUrl.threat_type	unknown	Threat Type
Usta.MaliciousUrl.url	unknown	URL

Command Example


#### Human Readable Output

### usta-get-malware-hashs

***
You can get malware hashs with this command

#### Base Command

`usta-get-malware-hashs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| format | Format type of the returned result. Possible values are: json, stix, stix2. Default is json. | Optional |
| md5 | Filtering by md5. | Optional |
| sha1 | Filtering by sha1. | Optional |
| tag | Filtering by tags. Example: tag=Keitaro. | Optional |
| start | Starting Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm). | Optional |
| end | End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Usta.MalwareHash.created | unknown | Created Date |
| Usta.MalwareHash.md5 | unknown | MD5 |
| Usta.MalwareHash.sha1 | unknown | SHA1 |
| Usta.MalwareHash.tags | unknown | Tags |
| Usta.MalwareHash.yara_rule | unknown | Yara Rule |

#### Command Example

Human Readable Output

usta-get-phishing-sites

You can get phishing sites with this command

Base Command

usta-get-phishing-sites

Input

Argument Name	Description	Required
status	Filtering by status. Possible values are: open, close, in_progress, out_of_scope, passive.	Optional
source	Filtering by source(URL).	Optional
page	Paginiation.	Optional

Context Output

Path	Type	Description
Usta.PhishingSites.current_page	unknown	Current page
Usta.PhishingSites.last_page	unknown	Last page
Usta.PhishingSites.next_page_url	unknown	Next page URL
Usta.PhishingSites.per_page	unknown	Content count per page
Usta.PhishingSites.prev_page_url	unknown	Prev page URL
Usta.PhishingSites.results	unknown	Results
Usta.PhishingSites.total	unknown	Content count
Usta.PhishingSites.total_pages	unknown	Total Page

Command Example


#### Human Readable Output

### usta-get-identity-leaks

***
With the Identity Leak API, you can access the hashed version of the credentials added to the platform.SHA256(MD5(Identity_Number))

#### Base Command

`usta-get-identity-leaks`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| start | Staring Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm). | Optional |
| end | End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Usta.IdentityLeaks.created | unknown | Created date |
| Usta.IdentityLeaks. signature | unknown | Signature |

#### Command Example

Human Readable Output

usta-get-stolen-client-accounts

You can access stolen customer accounts via Stolen-Client-accounts API.

Base Command

usta-get-stolen-client-accounts

Input

Argument Name	Description	Required
username	Filtering by username.	Optional
password	Filtering by password.	Optional
source	It allows to filter the stolen customer accounts detected according to the source.Available values : malware, phishing_site, data_leak, clients. Possible values are: malware, phishing_site, data_leak, clients.	Optional
start	Starting Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).	Optional
end	End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).	Optional

Context Output

Path	Type	Description
Usta.StolenClientAccounts.created	unknown	Created date
Usta.StolenClientAccounts.password	unknown	Password
Usta.StolenClientAccounts.source	unknown	Source
Usta.StolenClientAccounts.url	unknown	URL
Usta.StolenClientAccounts.username	unknown	Username

Command Example


#### Human Readable Output

### usta-get-domain

***
If you want to get more detailed information about malicious domain names, you can use this command.

#### Base Command

`usta-get-domain`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| domain | Search with domain name. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Usta.Domain.asn_records | unknown | ASN records |
| Usta.Domain.country | unknown | Country |
| Usta.Domain.dns_records | unknown | DNS records |
| Usta.Domain.domain | unknown | Domain |
| Usta.Domain.ip_addresses | unknown | IP addresses |
| Usta.Domain.ssl_records | unknown | SSL records |
| Usta.Domain.whois_records | unknown | Whois records |

#### Command Example

Human Readable Output

usta-get-ip-address

If you want to get more detailed information about specific IP Address, you can use this command.

Base Command

usta-get-ip-address

Input

Argument Name	Description	Required
ip_address	Search with IP Address.	Optional

Context Output

Path	Type	Description
Usta.IPAddress.asn_records	unknown	ASN records
Usta.IPAddress.country	unknown	Country
Usta.IPAddress.ip_address	unknown	IP address
Usta.IPAddress.ssl_records	unknown	SSL records
Usta.IPAddress.whois_records	unknown	Whois records

Command Example


#### Human Readable Output

### usta-send-referrer-url

***
You can search about the accuracy of the urls referring to your company's websites.

#### Base Command

`usta-send-referrer-url`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| address | URL Value. Example: http://www.google3.com. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Usta.Referrer.error | unknown | If any errors are received, it gives the details of the error |

#### Command Example

Human Readable Output

usta-search-specific-identity-leaks

With this command, you can search specific identity number that hashed in leaks

Base Command

usta-search-specific-identity-leaks

Input

Argument Name	Description	Required
identity_number	Search with this identity number. You can search all identity number with “,” .	Required

Context Output

Path	Type	Description
Usta.SpecificLeaks.existing	unknown	If the identity is leaked, you can see it in existing.
Usta.SpecificLeaks.not_existing	unknown	If the identity is not leaked, you can see it in not_existing

Command Example


#### Human Readable Output

### usta-close-incident

***
You can close the notifications in the status of "In Progress" or "Open", which are currently opened to your institution, via API.

#### Base Command

`usta-close-incident`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Incident ID. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Usta.CloseIncident.id | unknown | If the incident is closed, returns the id value that was closed. |

#### Command Example

Human Readable Output

Configuration parameters

url — Server URL (e.g. https://usta.prodaft.com) (required)
apikey — API Key (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (10)

usta-close-incident
You can close the notifications in the status of "In Progress" or "Open", which are currently opened to your institution, via API.
usta-get-domain
If you want to get more detailed information about malicious domain names, you can use this command.
usta-get-identity-leaks
With the Identity Leak API, you can access the hashed version of the credentials added to the platform.SHA256(MD5(Identity_Number))
usta-get-ip-address
If you want to get more detailed information about specific IP Address, you can use this command.
usta-get-malicious-urls
You can get malicious URLs with this command
usta-get-malware-hashs
You can get malware hashs with this command
usta-get-phishing-sites
You can get phishing sites with this command
usta-get-stolen-client-accounts
You can access stolen customer accounts via Stolen-Client-accounts API.
usta-search-specific-identity-leaks
With this command, you can search specific identity number that hashed in leaks
usta-send-referrer-url
You can search about the accuracy of the urls referring to your company's websites.

Source

USTA.py USTA.yml USTA_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: PRODAFT
commonfields:
  id: USTA
  version: -1
configuration:
- defaultvalue: https://usta.prodaft.com
  display: Server URL (e.g. https://usta.prodaft.com)
  name: url
  required: true
  type: 0
- additionalinfo: 'You can reach out your access token : https://usta.prodaft.com/#/api-documents'
  display: API Key
  name: apikey
  required: true
  type: 4
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: 'USTA is an Cyber Intelligence Platform that responds directly and effectively to today''s complex cyber threats. '
display: USTA
name: USTA
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: json
      description: Format type of the returned result.
      name: format
      predefined:
      - json
      - stix
      - stix2
      - txt
    - description: Filtering by URL Address.
      name: url
    - auto: PREDEFINED
      default: true
      defaultValue: 'true'
      description: You can search only those with or without domain name registration.
      name: is_domain
      predefined:
      - 'true'
      - 'false'
    - description: Filtering by malicious type.
      name: url_type
    - description: 'Filtering by tags. Example: tag=Keitaro.'
      name: tag
    - description: 'Starting date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: start
    - description: 'End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: end
    description: You can get malicious URLs with this command
    outputs:
    - contextPath: Usta.MaliciousUrl.country
      description: Country.
    - contextPath: Usta.MaliciousUrl.created
      description: Created Date.
    - contextPath: Usta.MaliciousUrl.domain
      description: Domain.
    - contextPath: Usta.MaliciousUrl.ip_addresses
      description: IP Addresses.
    - contextPath: Usta.MaliciousUrl.is_domain
      description: Is Domain.
    - contextPath: Usta.MaliciousUrl.modified
      description: Modified Date.
    - contextPath: Usta.MaliciousUrl.tags
      description: Tags.
    - contextPath: Usta.MaliciousUrl.threat_type
      description: Threat Type.
    - contextPath: Usta.MaliciousUrl.url
      description: URL.
    name: usta-get-malicious-urls
  - arguments:
    - auto: PREDEFINED
      defaultValue: json
      description: Format type of the returned result.
      name: format
      predefined:
      - json
      - stix
      - stix2
    - description: Filtering by md5.
      name: md5
    - description: Filtering by sha1.
      name: sha1
    - description: 'Filtering by tags. Example: tag=Keitaro.'
      name: tag
    - description: 'Starting Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: start
    - description: 'End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: end
    description: You can get malware hashs with this command
    outputs:
    - contextPath: Usta.MalwareHash.created
      description: Created Date.
    - contextPath: Usta.MalwareHash.md5
      description: MD5.
    - contextPath: Usta.MalwareHash.sha1
      description: SHA1.
    - contextPath: Usta.MalwareHash.tags
      description: Tags.
    - contextPath: Usta.MalwareHash.yara_rule
      description: Yara Rule.
    name: usta-get-malware-hashs
  - arguments:
    - auto: PREDEFINED
      description: Filtering by status.
      name: status
      predefined:
      - open
      - close
      - in_progress
      - out_of_scope
      - passive
    - description: Filtering by source(URL).
      name: source
    - description: Paginiation.
      name: page
    description: You can get phishing sites with this command
    outputs:
    - contextPath: Usta.PhishingSites.current_page
      description: Current page.
    - contextPath: Usta.PhishingSites.last_page
      description: Last page.
    - contextPath: Usta.PhishingSites.next_page_url
      description: Next page URL.
    - contextPath: Usta.PhishingSites.per_page
      description: Content count per page.
    - contextPath: Usta.PhishingSites.prev_page_url
      description: Prev page URL.
    - contextPath: Usta.PhishingSites.results
      description: Results.
    - contextPath: Usta.PhishingSites.total
      description: Content count.
    - contextPath: Usta.PhishingSites.total_pages
      description: Total Page.
    name: usta-get-phishing-sites
  - arguments:
    - description: 'Staring Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: start
    - description: 'End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: end
    description: With the Identity Leak API, you can access the hashed version of the credentials added to the platform.SHA256(MD5(Identity_Number))
    outputs:
    - contextPath: Usta.IdentityLeaks.created
      description: Created date.
    - contextPath: Usta.IdentityLeaks. signature
      description: Signature.
    name: usta-get-identity-leaks
  - arguments:
    - description: Filtering by username.
      name: username
    - description: Filtering by password.
      name: password
    - auto: PREDEFINED
      description: 'It allows to filter the stolen customer accounts detected according to the source.Available values : malware, phishing_site, data_leak, clients.'
      name: source
      predefined:
      - malware
      - phishing_site
      - data_leak
      - clients
    - description: 'Starting Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: start
    - description: 'End Date(Example: 2021-03-18-13-59 / yy-mm-dd-hh-mm).'
      name: end
    description: You can access stolen customer accounts via Stolen-Client-accounts API.
    outputs:
    - contextPath: Usta.StolenClientAccounts.created
      description: Created date.
    - contextPath: Usta.StolenClientAccounts.password
      description: Password.
    - contextPath: Usta.StolenClientAccounts.source
      description: Source.
    - contextPath: Usta.StolenClientAccounts.url
      description: URL.
    - contextPath: Usta.StolenClientAccounts.username
      description: Username.
    name: usta-get-stolen-client-accounts
  - arguments:
    - description: Search with domain name.
      name: domain
      required: true
    description: If you want to get more detailed information about malicious domain names, you can use this command.
    outputs:
    - contextPath: Usta.Domain.asn_records
      description: ASN records.
    - contextPath: Usta.Domain.country
      description: Country.
    - contextPath: Usta.Domain.dns_records
      description: DNS records.
    - contextPath: Usta.Domain.domain
      description: Domain.
    - contextPath: Usta.Domain.ip_addresses
      description: IP addresses.
    - contextPath: Usta.Domain.ssl_records
      description: SSL records.
    - contextPath: Usta.Domain.whois_records
      description: Whois records.
    name: usta-get-domain
  - arguments:
    - description: Search with IP Address.
      name: ip_address
    description: If you want to get more detailed information about specific IP Address, you can use this command.
    outputs:
    - contextPath: Usta.IPAddress.asn_records
      description: ASN records.
    - contextPath: Usta.IPAddress.country
      description: Country.
    - contextPath: Usta.IPAddress.ip_address
      description: IP address.
    - contextPath: Usta.IPAddress.ssl_records
      description: SSL records.
    - contextPath: Usta.IPAddress.whois_records
      description: Whois records.
    name: usta-get-ip-address
  - arguments:
    - description: 'URL Value. Example: http://www.google3.com'
      name: address
      required: true
    description: You can search about the accuracy of the urls referring to your company's websites.
    outputs:
    - contextPath: Usta.Referrer.error
      description: If any errors are received, it gives the details of the error.
    name: usta-send-referrer-url
  - arguments:
    - description: 'Search with this identity number. You can search all identity number with ",".'
      name: identity_number
      required: true
      isArray: true
    description: 'With this command, you can search specific identity number that hashed in leaks '
    outputs:
    - contextPath: Usta.SpecificLeaks.existing
      description: If the identity is leaked, you can see it in existing.
    - contextPath: Usta.SpecificLeaks.not_existing
      description: If the identity is not leaked, you can see it in not_existing.
    name: usta-search-specific-identity-leaks
  - arguments:
    - description: Incident ID.
      name: id
      required: true
    description: You can close the notifications in the status of "In Progress" or "Open", which are currently opened to your institution, via API.
    outputs:
    - contextPath: Usta.CloseIncident.id
      description: If the incident is closed, returns the id value that was closed.
    name: usta-close-incident
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)