Unit 42 Intelligence

Enrich indicators with Unit 42 threat intelligence context including verdicts, threat object associations, and relationships.

Configure Unit 42 Intelligence in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Enrich an IP address with Unit 42 threat intelligence context.

Base Command

ip

Input

Context Output

Command example

!ip ip="8.8.8.8"

Context Example

{
    "Unit42.IP": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 246022,
                    "grayware": 214,
                    "malware": 3176800
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "IP",
        "Value": "8.8.8.8",
        "Verdict": "malicious",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for IP: 8.8.8.8

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
8.8.8.8	malicious		wf_sample

domain

Enrich a domain with Unit 42 threat intelligence context.

Base Command

domain

Input

Context Output

Command example

!domain domain="example.com"

Context Example

{
    "Unit42.Domain":{
        "Counts": null,
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": null,
        "Type": "Domain",
        "Value": "example.com",
        "Verdict": "benign",
        "VerdictCategory": [
            "allowlist_dict_dga"
        ]
    }
}

Human Readable Output

Unit 42 Intelligence results for Domain: example.com

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
example.com	benign	allowlist_dict_dga	wf_sample

url

Enrich a URL with Unit 42 threat intelligence context.

Base Command

url

Input

Context Output

Command example

!url url="https://en.wikipedia.org/wiki/URL"

Context Example

{
    "Unit42.URL": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 97,
                    "grayware": 0,
                    "malware": 0
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "URL",
        "Value": "https://en.wikipedia.org/wiki/URL",
        "Verdict": "unknown",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for URL: https://en.wikipedia.org/wiki/URL

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
https://en.wikipedia.org/wiki/URL	unknown		wf_sample

file

Enrich a file hash with Unit 42 threat intelligence context.

Base Command

file

Input

Context Output

Command example

!file file="123456abcdef"

Context Example

{
    "Unit42.File": {
        "Counts": [
            {
                "count_type": "wf_sample",
                "count_values": {
                    "benign": 0,
                    "grayware": 0,
                    "malware": 3
                }
            }
        ],
        "EnrichedThreatObjectAssociation": null,
        "FirstSeen": "",
        "LastSeen": "",
        "SeenBy": [
            "wf_sample"
        ],
        "Type": "File",
        "Value": "123456abcdef",
        "Verdict": "malicious",
        "VerdictCategory": null
    }
}

Human Readable Output

Unit 42 Intelligence results for File: 123456abcdef

Value	Verdict	Verdict Category	Seen By	First Seen	Last Seen
123456abcdef	malicious		wf_sample

Known Limitations

URL Enrichment Format Requirements

To ensure successful URL enrichment and avoid HTTP 400 errors, follow these guidelines:

URL Length

• Maximum recommended length: 2000 characters
• Observed maximum length for URL arguments in similar indicator submission commands within the Cortex platform

Special Characters

• URLs must be properly encoded
• Characters like commas (,), less-than (<), and greater-than (>) can cause parsing conflicts or API request failures (Status 400)
• Remove or URL-encode these characters before submission

Comma Handling

• If a URL contains a comma, the playbook task supplying the input must enclose the URL within a JSON list format to ensure it is treated as a single string, even if it is the only URL
• Example: ["https://example.com/path?param=value,value2"]

General Guidelines

• Ensure URLs are valid and well-formed
• Use proper URL encoding for special characters
• Test URLs with special characters in a non-production environment first