Unit 42 Intelligence

Details

ID	`Unit 42 Intelligence`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix Cortex Cloud EDR XSIAM Cloud Runtime Security Cloud Posture Security

README

Enrich indicators with Unit 42 threat intelligence context including verdicts, threat object associations, and relationships.

Configure Unit 42 Intelligence in Cortex

Parameter	Description	Required
Source Reliability	Reliability of the source providing the intelligence data	True
Create relationships	Create relationships between indicators and threat objects	False
Create threat objects as separate indicators	Whether to create threat objects (malware families, actors, campaigns, etc.) as separate XSOAR indicators	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Enrich an IP address with Unit 42 threat intelligence context.

Base Command

ip

Input

Argument Name	Description	Required
ip	The IP address to enrich.	Required

Context Output

Path	Type	Description
IP.Address	String	The IP address.
IP.Malicious.Vendor	String	The vendor reporting the IP as malicious.
IP.Malicious.Description	String	Description of the malicious IP.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Unit42.IP.Value	String	The IP address.
Unit42.IP.Type	String	The indicator type.
Unit42.IP.Counts	Unknown	Counts.
Unit42.IP.Verdict	String	The verdict for the IP.
Unit42.IP.VerdictCategory	Unknown	The verdict category.
Unit42.IP.FirstSeen	Date	First seen date.
Unit42.IP.LastSeen	Date	Last seen date.
Unit42.IP.SeenBy	Unknown	Sources that have seen this IP.
Unit42.IP.EnrichedThreatObjectAssociation	Unknown	Enriched threat object association.

Command example

!ip ip="8.8.8.8"

Context Example

{
    "Unit42.IP": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 246022,
                    "grayware": 214,
                    "malware": 3176800
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "IP",
        "Value": "8.8.8.8",
        "Verdict": "malicious",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for IP: 8.8.8.8

Value Verdict Verdict Category Seen By First Seen Last Seen

8.8.8.8 malicious wf_sample

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
8.8.8.8	malicious		wf_sample

domain

Enrich a domain with Unit 42 threat intelligence context.

Base Command

domain

Input

Argument Name	Description	Required
domain	Domain to enrich.	Required

Context Output

Path	Type	Description
Domain.Name	String	The domain name.
Domain.Malicious.Vendor	String	The vendor reporting the domain as malicious.
Domain.Malicious.Description	String	Description of the malicious domain.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Unit42.Domain.Value	String	The domain name.
Unit42.Domain.Type	String	The indicator type.
Unit42.Domain.Counts	Unknown	Counts.
Unit42.Domain.Verdict	String	The verdict for the domain.
Unit42.Domain.VerdictCategory	Unknown	The verdict category.
Unit42.Domain.FirstSeen	Date	First seen date.
Unit42.Domain.LastSeen	Date	Last seen date.
Unit42.Domain.SeenBy	Unknown	Sources that have seen this domain.
Unit42.Domain.EnrichedThreatObjectAssociation	Unknown	Enriched threat object association.

Command example

!domain domain="example.com"

Context Example

{
    "Unit42.Domain":{
        "Counts": null,
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": null,
        "Type": "Domain",
        "Value": "example.com",
        "Verdict": "benign",
        "VerdictCategory": [
            "allowlist_dict_dga"
        ]
    }
}

Human Readable Output

Unit 42 Intelligence results for Domain: example.com

Value Verdict Verdict Category Seen By First Seen Last Seen

example.com benign allowlist_dict_dga wf_sample

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
example.com	benign	allowlist_dict_dga	wf_sample

url

Enrich a URL with Unit 42 threat intelligence context.

Base Command

url

Input

Argument Name	Description	Required
url	URL to enrich.	Required

Context Output

Path	Type	Description
URL.Data	String	The URL.
URL.Malicious.Vendor	String	The vendor reporting the URL as malicious.
URL.Malicious.Description	String	Description of the malicious URL.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Unit42.URL.Value	String	The URL.
Unit42.URL.Type	String	The indicator type.
Unit42.URL.Counts	Unknown	Counts.
Unit42.URL.Verdict	String	The verdict for the URL.
Unit42.URL.VerdictCategory	Unknown	The verdict category.
Unit42.URL.FirstSeen	Date	First seen date.
Unit42.URL.LastSeen	Date	Last seen date.
Unit42.URL.SeenBy	Unknown	Sources that have seen this URL.
Unit42.URL.EnrichedThreatObjectAssociation	Unknown	Enriched threat object association.

Command example

!url url="https://en.wikipedia.org/wiki/URL"

Context Example

{
    "Unit42.URL": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 97,
                    "grayware": 0,
                    "malware": 0
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "URL",
        "Value": "https://en.wikipedia.org/wiki/URL",
        "Verdict": "unknown",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for URL: https://en.wikipedia.org/wiki/URL

Value Verdict Verdict Category Seen By First Seen Last Seen

https://en.wikipedia.org/wiki/URL unknown wf_sample

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
https://en.wikipedia.org/wiki/URL	unknown		wf_sample

file

Enrich a file hash with Unit 42 threat intelligence context.

Base Command

file

Input

Argument Name	Description	Required
file	File hash to enrich (SHA256).	Required

Context Output

Path	Type	Description
File.MD5	String	The MD5 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.Malicious.Vendor	String	The vendor reporting the file as malicious.
File.Malicious.Description	String	Description of the malicious file.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
Unit42.File.Value	String	The file hash.
Unit42.File.Type	String	The indicator type.
Unit42.File.Counts	Unknown	Counts.
Unit42.File.Verdict	String	The verdict for the file.
Unit42.File.VerdictCategory	Unknown	The verdict category.
Unit42.File.FirstSeen	Date	First seen date.
Unit42.File.LastSeen	Date	Last seen date.
Unit42.File.SeenBy	Unknown	Sources that have seen this file.
Unit42.File.EnrichedThreatObjectAssociation	Unknown	Enriched threat object association.

Command example

!file file="123456abcdef"

Context Example

{
    "Unit42.File": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 0,
                    "grayware": 0,
                    "malware": 3
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "File",
        "Value": "123456abcdef",
        "Verdict": "malicious",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for File: 123456abcdef

Value Verdict Verdict Category Seen By First Seen Last Seen

123456abcdef malicious wf_sample

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
123456abcdef	malicious		wf_sample

Known Limitations

URL Enrichment Format Requirements

To ensure successful URL enrichment and avoid HTTP 400 errors, follow these guidelines:

URL Length

Maximum recommended length: 2000 characters
Observed maximum length for URL arguments in similar indicator submission commands within the Cortex platform

Special Characters

URLs must be properly encoded
Characters like commas (,), less-than (<), and greater-than (>) can cause parsing conflicts or API request failures (Status 400)
Remove or URL-encode these characters before submission

Comma Handling

If a URL contains a comma, the playbook task supplying the input must enclose the URL within a JSON list format to ensure it is treated as a single string, even if it is the only URL
Example: ["https://example.com/path?param=value,value2"]

General Guidelines

Ensure URLs are valid and well-formed
Use proper URL encoding for special characters
Test URLs with special characters in a non-production environment first

Configuration parameters

integration_reliability — Source Reliability
create_relationships — Create relationships
create_threat_object_indicators — Create threat objects as separate indicators
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (4)

domain
Enrich a domain with Unit 42 threat intelligence context.
file
Enrich a file hash with Unit 42 threat intelligence context.
ip
Enrich an IP address with Unit 42 threat intelligence context.
url
Enrich a URL with Unit 42 threat intelligence context.

Source

Unit42Intelligence.py Unit42Intelligence_test.py Unit42Intelligence.yml Unit42Intelligence_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Unit 42 Intelligence
  version: -1
configuration:
- display: Source Reliability
  name: integration_reliability
  additionalinfo: Reliability of the source providing the intelligence data.
  type: 15
  options:
  - A++ - Reputation script
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  defaultvalue: A++ - Reputation script
  required: false
  section: Collect
  advanced: true
- display: Create relationships
  name: create_relationships
  additionalinfo: Create relationships between indicators and threat objects
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
  advanced: true
- display: Create threat objects as separate indicators
  name: create_threat_object_indicators
  additionalinfo: Whether to create threat objects (malware families, actors, campaigns, etc.) as separate indicators
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
description: Enrich indicators with Unit 42 threat intelligence context including verdicts, threat object associations, and relationships.
display: Unit 42 Intelligence
name: Unit 42 Intelligence
script:
  commands:
  - arguments:
    - description: IP address to enrich.
      name: ip
      required: true
      default: true
      isArray: true
    description: Enrich an IP address with Unit 42 threat intelligence context.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: Description of the malicious IP.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Unit42.IP.Value
      description: The IP address.
      type: String
    - contextPath: Unit42.IP.Type
      description: The indicator type.
      type: String
    - contextPath: Unit42.IP.Counts
      description: Counts.
      type: Unknown
    - contextPath: Unit42.IP.Verdict
      description: The verdict for the IP.
      type: String
    - contextPath: Unit42.IP.VerdictCategory
      description: The verdict category.
      type: Unknown
    - contextPath: Unit42.IP.FirstSeen
      description: First seen date.
      type: Date
    - contextPath: Unit42.IP.LastSeen
      description: Last seen date.
      type: Date
    - contextPath: Unit42.IP.SeenBy
      description: Sources that have seen this IP.
      type: Unknown
    - contextPath: Unit42.IP.EnrichedThreatObjectAssociation
      description: Enriched threat object association.
      type: Unknown
  - arguments:
    - description: Domain to enrich.
      name: domain
      default: true
      required: true
      isArray: true
    description: Enrich a domain with Unit 42 threat intelligence context.
    name: domain
    outputs:
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: Description of the malicious domain.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Unit42.Domain.Value
      description: The domain name.
      type: String
    - contextPath: Unit42.Domain.Type
      description: The indicator type.
      type: String
    - contextPath: Unit42.Domain.Counts
      description: Counts.
      type: Unknown
    - contextPath: Unit42.Domain.Verdict
      description: The verdict for the domain.
      type: String
    - contextPath: Unit42.Domain.VerdictCategory
      description: The verdict category.
      type: Unknown
    - contextPath: Unit42.Domain.FirstSeen
      description: First seen date.
      type: Date
    - contextPath: Unit42.Domain.LastSeen
      description: Last seen date.
      type: Date
    - contextPath: Unit42.Domain.SeenBy
      description: Sources that have seen this domain.
      type: Unknown
    - contextPath: Unit42.Domain.EnrichedThreatObjectAssociation
      description: Enriched threat object association.
      type: Unknown
  - arguments:
    - description: URL to enrich.
      name: url
      default: true
      required: true
      isArray: true
    description: Enrich a URL with Unit 42 threat intelligence context.
    name: url
    outputs:
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: Description of the malicious URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Unit42.URL.Value
      description: The URL.
      type: String
    - contextPath: Unit42.URL.Type
      description: The indicator type.
      type: String
    - contextPath: Unit42.URL.Counts
      description: Counts.
      type: Unknown
    - contextPath: Unit42.URL.Verdict
      description: The verdict for the URL.
      type: String
    - contextPath: Unit42.URL.VerdictCategory
      description: The verdict category.
      type: Unknown
    - contextPath: Unit42.URL.FirstSeen
      description: First seen date.
      type: Date
    - contextPath: Unit42.URL.LastSeen
      description: Last seen date.
      type: Date
    - contextPath: Unit42.URL.SeenBy
      description: Sources that have seen this URL.
      type: Unknown
    - contextPath: Unit42.URL.EnrichedThreatObjectAssociation
      description: Enriched threat object association.
      type: Unknown
  - arguments:
    - description: File hash to enrich (SHA256).
      name: file
      default: true
      required: true
      isArray: true
    description: Enrich a file hash with Unit 42 threat intelligence context.
    name: file
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor reporting the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: Description of the malicious file.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: Unit42.File.Value
      description: The file hash.
      type: String
    - contextPath: Unit42.File.Type
      description: The indicator type.
      type: String
    - contextPath: Unit42.File.Counts
      description: Counts.
      type: Unknown
    - contextPath: Unit42.File.Verdict
      description: The verdict for the file.
      type: String
    - contextPath: Unit42.File.VerdictCategory
      description: The verdict category.
      type: Unknown
    - contextPath: Unit42.File.FirstSeen
      description: First seen date.
      type: Date
    - contextPath: Unit42.File.LastSeen
      description: Last seen date.
      type: Date
    - contextPath: Unit42.File.SeenBy
      description: Sources that have seen this file.
      type: Unknown
    - contextPath: Unit42.File.EnrichedThreatObjectAssociation
      description: Enriched threat object association.
      type: Unknown
  dockerimage: demisto/python3:3.12.13.10404775
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Unit 42 Intelligence Test
fromversion: 6.10.0