XFE_v2

IBM X-Force Exchange lets you receive threat intelligence about applications, IP addresses, URls and hashes.

Data Enrichment & Threat Intelligence · IBM X-Force Exchange

Details

IDXFE_v2
ProviderIBM
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

IBM X-Force Exchange lets you receive threat intelligence about applications, IP addresses, URls and hashes

Configure XFE v2 in Cortex

Parameter Description Required
url Server URL (e.g. https://api.xforce.ibmcloud.com) True
credentials API Key True
Source Reliability Reliability of the source providing the intelligence data. The default value is C - Fairly reliable. True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
ip_threshold IP Threshold. Minimum risk score for the IP to be consodered malicious (ranges from 1 to 10). False
url_threshold URL Threshold. Minimum risk score for the URL to be consodered malicious (ranges from 1 to 10). False
cve_threshold CVE Threshold. Minimum risk score for the URL to be consodered malicious (ranges from 1 to 10). False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

IP to check

Base Command

ip

Input
Argument Name Description Required
ip IP to check Required
threshold score threshold Optional
Context Output
Path Type Description
IP.Address Unknown The IP address.
IP.Malicious.Vendor Unknown For malicious IPs, the vendor that made the decision.
IP.Malicious.Description Unknown For malicious IPs, the reason for the vendor to make the decision.
IP.Malicious.Score Unknown For malicious IPs, the score from the vendor.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
XFE.IP.Reason String The reason for the given score from X-Force Exchange.
XFE.IP.Reasondescription String Additional details of the score’s reason.
XFE.IP.Subnets Unknown The subnets of the IP.
Command Example

!ip ip=8.8.8.8

Context Example
{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 1,
        "Type": "ip",
        "Vendor": "XFE"
    },
    "IP": {
        "Address": "8.8.8.8",
        "Geo": {
            "Country": "United States"
        },
        "Score": 1
    },
    "XFE": {
        "IP": {
            "Reason": "Regional Internet Registry",
            "Reasondescription": "One of the five RIRs announced a (new) location mapping of the IP.",
            "Subnets": [
                {
                    "asns": {
                        "3356": {
                            "cidr": 8,
                            "removed": true
                        }
                    },
                    "categoryDescriptions": {},
                    "cats": {},
                    "created": "2018-04-24T06:22:00.000Z",
                    "ip": "8.0.0.0",
                    "reason": "Regional Internet Registry",
                    "reasonDescription": "One of the five RIRs announced a (new) location mapping of the IP.",
                    "reason_removed": true,
                    "score": 1,
                    "subnet": "8.0.0.0/8"
                },
                {
                    "asns": {
                        "3356": {
                            "cidr": 9,
                            "removed": true
                        }
                    },
                    "categoryDescriptions": {},
                    "cats": {},
                    "created": "2020-03-22T07:54:00.000Z",
                    "geo": {
                        "country": "United States",
                        "countrycode": "US"
                    },
                    "ip": "8.0.0.0",
                    "reason": "Regional Internet Registry",
                    "reasonDescription": "One of the five RIRs announced a (new) location mapping of the IP.",
                    "reason_removed": true,
                    "score": 1,
                    "subnet": "8.0.0.0/9"
                },
                {
                    "asns": {
                        "15169": {
                            "cidr": 24,
                            "removed": true
                        }
                    },
                    "categoryDescriptions": {},
                    "cats": {},
                    "created": "2020-03-22T07:54:00.000Z",
                    "ip": "8.8.8.0",
                    "reason": "Regional Internet Registry",
                    "reasonDescription": "One of the five RIRs announced a (new) location mapping of the IP.",
                    "reason_removed": true,
                    "score": 1,
                    "subnet": "8.8.8.0/24"
                }
            ]
        }
    }
}
Human Readable Output

X-Force IP Reputation for: 8.8.8.8

https://exchange.xforce.ibmcloud.com/ip/8.8.8.8

Reason Score Subnets
Regional Internet Registry:One of the five RIRs announced a (new) location mapping of the IP. 1 8.0.0.0/8, 8.0.0.0/9, 8.8.8.0/24

url

Check the given URL reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input
Argument Name Description Required
threshold If the score is above the given threshold, will be considered malicious. If threshold is not specified, the default URL threshold, as configured in the instance settings, will be used. Optional
url The URL to check Required
Context Output
Path Type Description
URL.Data String The given URL from the user.
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Command Example

!url url="https://www.google.com"

Context Example
{
    "DBotScore": {
        "Indicator": "https://www.google.com",
        "Score": 1,
        "Type": "url",
        "Vendor": "XFE"
    },
    "URL": {
        "Data": "https://www.google.com"
    }
}
Human Readable Output

X-Force URL Reputation for: https://www.google.com

https://exchange.xforce.ibmcloud.com/url/https://www.google.com

Categories Score
Search Engines / Web Catalogues / Portals 1

file

Check file reputation

Base Command

file

Input
Argument Name Description Required
file The file hash md5/sha1/sha256 to check Required
Context Output
Path Type Description
File.MD5 String The file’s MD5.
File.SHA1 String The file’s SHA1.
File.SHA256 String The file’s SHA256.
File.Malicious.Vendor String For malicious files, the vendor that made the decision.
File.Malicious.Description String For malicious files, the reason for the vendor to make the decision.
File.Relationships.EntityA String The source of the relationship.
File.Relationships.EntityB String The destination of the relationship.
File.Relationships.Relationship String The name of the relationship.
File.Relationships.EntityAType String The type of the source of the relationship.
File.Relationships.EntityBType String The type of the destination of the relationship.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
XFE.File.CnCServers Unknown C&C servers related to the given file.
XFE.File.emails Unknown Emails related to the given file.
XFE.File.downloadServers Unknown Download servers related to the given file.
XFE.File.subjects Unknown Subjects related to the given file.
XFE.File.external Unknown Additional information about the given file.
Command Example

!file file="f2b8d790dab6d2c6945f9a0bce441921"

Context Example
{
    "DBotScore": {
        "Indicator": "f2b8d790dab6d2c6945f9a0bce441921",
        "Score": 3,
        "Type": "file",
        "Vendor": "XFE"
    },
    "File": {
        "MD5": "f2b8d790dab6d2c6945f9a0bce441921",
        "Malicious": {
            "Description": null,
            "Vendor": "XFE"
        }
    },
    "XFE": {
        "File": {
            "CnCServers": {},
            "Family": "kryptik",
            "FamilyMembers": null,
            "downloadServers": {},
            "emails": {
                "count": 1,
                "rows": [
                    {
                        "count": 1,
                        "domain": "dtest.com",
                        "filepath": "Case File 5368.zip",
                        "firstseen": "2018-08-13T07:15:00Z",
                        "ip": "217.76.151.72",
                        "lastseen": "2018-08-13T07:15:00Z",
                        "md5": "F2B8D790DAB6D2C6945F9A0BCE441921",
                        "origin": "SPM",
                        "type": "SPM",
                        "uri": "Case File 5368.zip"
                    }
                ]
            },
            "external": {
                "detectionCoverage": 34,
                "family": [
                    "kryptik"
                ],
                "firstSeen": "2018-08-13T07:48:30Z",
                "lastSeen": "2018-08-14T09:22:00Z",
                "malwareType": "Trojan",
                "platform": "ByteCode",
                "source": "reversingLabs",
                "subPlatform": "JAVA"
            },
            "subjects": {
                "count": 1,
                "rows": [
                    {
                        "count": 1,
                        "firstseen": "2018-08-13T07:15:00Z",
                        "ips": [
                            "217.76.151.72"
                        ],
                        "lastseen": "2018-08-13T07:15:00Z",
                        "md5": "F2B8D790DAB6D2C6945F9A0BCE441921",
                        "origin": "email",
                        "subject": "Court Order",
                        "type": "email"
                    }
                ]
            }
        }
    }
}
Human Readable Output

X-Force md5 Reputation for f2b8d790dab6d2c6945f9a0bce441921

https://exchange.xforce.ibmcloud.com/malware/f2b8d790dab6d2c6945f9a0bce441921

Created Date Source Type
2018-08-13T07:48:30Z reversingLabs Trojan

domain

Check domain reputation

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input
Argument Name Description Required
domain The domain to check Required
threshold If the score is above the given threshold, will be considered malicious. If threshold is not specified, the default URL threshold, as configured in the instance settings, will be used. Optional
Context Output
Path Type Description
Domain.Name String Domain.
Domain.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
Command Example

!domain domain="google.com"

Context Example
{
    "DBotScore": {
        "Indicator": "google.com",
        "Score": 1,
        "Type": "domain",
        "Vendor": "XFE"
    },
    "Domain": {
        "Name": "google.com"
    }
}
Human Readable Output

X-Force Domain Reputation for: google.com

https://exchange.xforce.ibmcloud.com/url/google.com

Categories Score
Search Engines / Web Catalogues / Portals 1

cve-search

Search for details about the given CVE

Base Command

cve-search

Input
Argument Name Description Required
cve_id The cve to search for Required
Context Output
Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS String The CVSS of the CVE.
CVE.Published Date The date this was published.
CVE.Description Unknown The CVE description.
XFE.CVE.Xfdbid String The XFBID of the CVE.
XFE.CVE.RiskLevel Number The risk level of the CVE.
XFE.CVE.Reported Date The reported date of the CVE.
XFE.CVE.Cvss Unknown The CVSS information of the CVE.
XFE.CVE.Stdcode Unknown The CVE stdcodes.
XFE.CVE.Title String The title of the CVE.
XFE.CVE.Description String The description of the CVE.
XFE.CVE.PlatformsAffected Unknown The affetcted platforms due to the CVE.
XFE.CVE.Exploitability String The exploitability of the CVE.
Command Example

!cve-search cve_id="CVE-2020-3142"

Context Example
{
    "CVE": {
        "CVSS": "3.0",
        "Description": "Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow a remote attacker to obtain sensitive information, caused by unintended meeting information exposure in a specific meeting join flow for mobile applications. By accessing a known meeting ID or meeting URL from the mobile device\u0092s web browser, an attacker could exploit this vulnerability to join a password-protected meeting without providing the meeting password.",
        "ID": "CVE-2020-3142",
        "Malicious": {
            "Description": "Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow a remote attacker to obtain sensitive information, caused by unintended meeting information exposure in a specific meeting join flow for mobile applications. By accessing a known meeting ID or meeting URL from the mobile device\u0092s web browser, an attacker could exploit this vulnerability to join a password-protected meeting without providing the meeting password.",
            "Vendor": "XFE"
        },
        "Published": "2020-01-24T00:00:00Z"
    },
    "DBotScore": {
        "Indicator": "CVE-2020-3142",
        "Score": 3,
        "Type": "cve",
        "Vendor": "XFE"
    },
    "XFE": {
        "CVE": {
            "Cvss": {
                "access_complexity": "Low",
                "access_vector": "Network",
                "availability_impact": "None",
                "confidentiality_impact": "High",
                "integrity_impact": "None",
                "privilegesrequired": "None",
                "remediation_level": "Official Fix",
                "scope": "Unchanged",
                "userinteraction": "None",
                "version": "3.0"
            },
            "Description": "Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow a remote attacker to obtain sensitive information, caused by unintended meeting information exposure in a specific meeting join flow for mobile applications. By accessing a known meeting ID or meeting URL from the mobile device\u0092s web browser, an attacker could exploit this vulnerability to join a password-protected meeting without providing the meeting password.",
            "Exploitability": "Unproven",
            "PlatformsAffected": [
                "Cisco Webex Meetings Suite sites 39.11.0",
                "Cisco Webex Meetings Suite sites 40.1.0",
                "Cisco Webex Meetings Online sites 39.11.0",
                "Cisco Webex Meetings Online sites 40.1.0"
            ],
            "Reported": "2020-01-24T00:00:00Z",
            "RiskLevel": 7.5,
            "Stdcode": [
                "CVE-2020-3142"
            ],
            "Tagname": "cisco-webex-cve20203142-info-disc",
            "Title": "Cisco Webex Meetings Suite sites information disclosure",
            "Xfdbid": 175033
        }
    }
}
Human Readable Output

X-Force CVE Reputation for CVE-2020-3142

https://exchange.xforce.ibmcloud.com/vulnerability/search/CVE-2020-3142

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network Cisco Webex Meetings Suite sites 39.11.0
Cisco Webex Meetings Suite sites 40.1.0
Cisco Webex Meetings Online sites 39.11.0
Cisco Webex Meetings Online sites 40.1.0
 Low Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites could allow a remote attacker to obtain sensitive information, caused by unintended meeting information exposure in a specific meeting join flow for mobile applications. By accessing a known meeting ID or meeting URL from the mobile device’s web browser, an attacker could exploit this vulnerability to join a password-protected meeting without providing the meeting password. Unproven 2020-01-24T00:00:00Z 7.5 CVE-2020-3142 Cisco Webex Meetings Suite sites information disclosure 3.0

cve-latest

Return the latest vulnerabilities found

Base Command

cve-latest

Input
Argument Name Description Required
limit The number of results to return Optional
start_date The start of the date range for searching.
The format should be YYYY-MM-DDThh:mm:ssZ (e.g. 2016-01-01T00:00:00Z).		 Optional
end_date The end of the date range for searching.
The format should be YYYY-MM-DDThh:mm:ssZ (e.g. 2016-01-01T00:00:00Z).		 Optional
Context Output
Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS String The CVSS of the CVE.
CVE.Published Date The date this was published.
CVE.Description Unknown The CVE description.
XFE.CVE.Xfdbid String The XFBID of the CVE.
XFE.CVE.RiskLevel Number The risk level of the CVE.
XFE.CVE.Reported Date The reported date of the CVE.
XFE.CVE.Cvss Unknown The CVSS information of the CVE.
XFE.CVE.Stdcode Unknown The CVE stdcodes.
XFE.CVE.Title String The title of the CVE.
XFE.CVE.Description String The description of the CVE.
XFE.CVE.PlatformsAffected Unknown The affetcted platforms due to the CVE.
XFE.CVE.Exploitability String The exploitability of the CVE.
Command Example

!cve-latest limit=2

Context Example
{
    "CVE": [
        {
            "CVSS": "3.0",
            "Description": "Sunnet eHRD could allow a remote attacker to obtain sensitive information, caused by improperly storing system files. By using a specific URL, a remote attacker could exploit this vulnerability to obtain sensitive information.",
            "ID": "CVE-2020-10508",
            "Published": "2020-03-27T00:00:00Z"
        },
        {
            "CVSS": "3.0",
            "Description": "Sunnet eHRD is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",
            "ID": "CVE-2020-10509",
            "Malicious": {
                "Description": "Sunnet eHRD is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",
                "Vendor": "XFE"
            },
            "Published": "2020-03-27T00:00:00Z"
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2020-10508",
            "Score": 2,
            "Type": "cve",
            "Vendor": "XFE"
        },
        {
            "Indicator": "CVE-2020-10509",
            "Score": 3,
            "Type": "cve",
            "Vendor": "XFE"
        }
    ],
    "XFE": {
        "CVE": [
            {
                "Cvss": {
                    "access_complexity": "Low",
                    "access_vector": "Network",
                    "availability_impact": "None",
                    "confidentiality_impact": "Low",
                    "integrity_impact": "None",
                    "privilegesrequired": "None",
                    "remediation_level": "Official Fix",
                    "scope": "Unchanged",
                    "userinteraction": "None",
                    "version": "3.0"
                },
                "Description": "Sunnet eHRD could allow a remote attacker to obtain sensitive information, caused by improperly storing system files. By using a specific URL, a remote attacker could exploit this vulnerability to obtain sensitive information.",
                "Exploitability": "Unproven",
                "PlatformsAffected": [
                    "Sunnet eHRD 9.0",
                    "Sunnet eHRD 8.0"
                ],
                "Reported": "2020-03-27T00:00:00Z",
                "RiskLevel": 5.3,
                "Stdcode": [
                    "CVE-2020-10508"
                ],
                "Tagname": "sunnet-ehrd-cve202010508-info-disc",
                "Title": "Sunnet eHRD information disclosure",
                "Xfdbid": 178668
            },
            {
                "Cvss": {
                    "access_complexity": "Low",
                    "access_vector": "Network",
                    "availability_impact": "None",
                    "confidentiality_impact": "Low",
                    "integrity_impact": "Low",
                    "privilegesrequired": "None",
                    "remediation_level": "Official Fix",
                    "scope": "Changed",
                    "userinteraction": "Required",
                    "version": "3.0"
                },
                "Description": "Sunnet eHRD is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.",
                "Exploitability": "High",
                "PlatformsAffected": [
                    "Sunnet eHRD 9.0",
                    "Sunnet eHRD 8.0"
                ],
                "Reported": "2020-03-27T00:00:00Z",
                "RiskLevel": 6.1,
                "Stdcode": [
                    "CVE-2020-10509"
                ],
                "Tagname": "sunnet-ehrd-cve202010509-xss",
                "Title": "Sunnet eHRD cross-site scripting",
                "Xfdbid": 178664
            }
        ]
    }
}
Human Readable Output

X-Force CVE Reputation for CVE-2020-10508

https://exchange.xforce.ibmcloud.com/vulnerability/search/CVE-2020-10508

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network Sunnet eHRD 9.0
Sunnet eHRD 8.0		 Low Sunnet eHRD could allow a remote attacker to obtain sensitive information, caused by improperly storing system files. By using a specific URL, a remote attacker could exploit this vulnerability to obtain sensitive information. Unproven 2020-03-27T00:00:00Z 5.3 CVE-2020-10508 Sunnet eHRD information disclosure 3.0

X-Force CVE Reputation for CVE-2020-10509

https://exchange.xforce.ibmcloud.com/vulnerability/search/CVE-2020-10509

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network Sunnet eHRD 9.0
Sunnet eHRD 8.0		 Low Sunnet eHRD is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials. High 2020-03-27T00:00:00Z 6.1 CVE-2020-10509 Sunnet eHRD cross-site scripting 3.0

xfe-whois

Gets information about the given host address

Base Command

xfe-whois

Input
Argument Name Description Required
host The host or address to search inside X-Force Exchange (e.g. google.com) Required
Context Output
Path Type Description
XFE.Whois.Host String The given host from the user.
XFE.Whois.RegistrarName String The domain name registrar of the host.
XFE.Whois.Created Date The date the host was created.
XFE.Whois.Updated Date The date the host’s information has been updated.
XFE.Whois.Expires Date The date the host will be expired.
XFE.Whois.Email String The contact email of the host owners.
XFE.Whois.Contact Unknown Contact information of the host’s organization.
Domain.Name String The name of the domain.
Domain.CreationDate Date The creation date of the domain.
Domain.ExpirationDate Date The expiration date of the domain.
Domain.UpdatedDate Date The date the domain has been updated.
Domain.Organization String The organizaton which owns the domain.
Domain.Registrant.Country String The country of the domain’s registrant.
Domain.Registrant.Name String The name of the domain’s registrant.
Domain.WHOIS.Registrar.Name String The name of the domain’s registar.
Domain.WHOIS.Registrar.Email String The email of the domain’s registar.
Domain.WHOIS.UpdatedDate String The date the domain has been updated.
Domain.WHOIS.ExpirationDate Unknown The date the domain has been updated.
Domain.WHOIS.CreationDate String The creation date of the domain.
Domain.WHOIS.Registrant.Country String The country of the domain’s registrant.
Domain.WHOIS.Registrant.Name String The name of the domain’s registrant.
Command Example

!xfe-whois host="google.com"

Context Example
{
    "Domain": {
        "CreationDate": "1997-09-15T07:00:00.000Z",
        "ExpirationDate": "2028-09-13T07:00:00.000Z",
        "Name": "google.com",
        "Organization": "Google LLC",
        "Registrant": {
            "Country": "United States",
            "Name": "Google LLC"
        },
        "UpdatedDate": "2019-09-09T15:39:04.000Z",
        "WHOIS": {
            "CreationDate": "1997-09-15T07:00:00.000Z",
            "ExpirationDate": "2028-09-13T07:00:00.000Z",
            "Registrant": {
                "Country": "United States",
                "Name": "Google LLC"
            },
            "Registrar": {
                "Email": "abusecomplaints@markmonitor.com",
                "Name": "MarkMonitor, Inc."
            },
            "UpdatedDate": "2019-09-09T15:39:04.000Z"
        }
    },
    "XFE": {
        "Whois": {
            "Contact": [
                {
                    "Country": "United States",
                    "Organization": "Google LLC",
                    "Type": "registrant"
                }
            ],
            "Created": "1997-09-15T07:00:00.000Z",
            "Email": "abusecomplaints@markmonitor.com",
            "Expires": "2028-09-13T07:00:00.000Z",
            "Host": "google.com",
            "RegistrarName": "MarkMonitor, Inc.",
            "Updated": "2019-09-09T15:39:04.000Z"
        }
    }
}
Human Readable Output

X-Force Whois result for google.com

Contact Created Email Expires Host RegistrarName Updated
{‘Type’: ‘registrant’, ‘Organization’: ‘Google LLC’, ‘Country’: ‘United States’} 1997-09-15T07:00:00.000Z abusecomplaints@markmonitor.com 2028-09-13T07:00:00.000Z google.com MarkMonitor, Inc. 2019-09-09T15:39:04.000Z

xfe-search-cves

Gets list of all vulnerabilities associated with the search term.

Base Command

xfe-search-cves

Input
Argument Name Description Required
q The query for the search.
(https://exchange.xforce.ibmcloud.com/api/doc/?#Vulnerabilities_get_vulnerabilities_fulltext)		 Required
start_date The start of the date range for searching.
The format should be YYYY-MM-DDThh:mm:ssZ (e.g. 2016-01-01T00:00:00Z).		 Optional
end_date The end of the date range for searching.
The format should be YYYY-MM-DDThh:mm:ssZ (e.g. 2016-01-01T00:00:00Z).		 Optional
bookmark Bookmark used to page through results.
(https://exchange.xforce.ibmcloud.com/api/doc/?#Vulnerabilities_get_vulnerabilities_fulltext)		 Optional
Context Output
Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS String The CVSS of the CVE.
CVE.Published Date The date this was published.
CVE.Description Unknown The CVE description.
XFE.CVE.Xfdbid String The XFBID of the CVE.
XFE.CVE.RiskLevel Number The risk level of the CVE.
XFE.CVE.Reported Date The reported date of the CVE.
XFE.CVE.Cvss Unknown The CVSS information of the CVE.
XFE.CVE.Stdcode Unknown The CVE stdcodes.
XFE.CVE.Title String The title of the CVE.
XFE.CVE.Description String The description of the CVE.
XFE.CVE.PlatformsAffected Unknown The affetcted platforms due to the CVE.
XFE.CVE.Exploitability String The exploitability of the CVE.
XFE.CVESearch.TotalRows String The total rows received after search.
XFE.CVESearch.Bookmark String Bookmark used to page through results.
Command Example

!xfe-search-cves q="Heartbleed"

Context Example
{
    "CVE": [
        {
            "CVSS": "2.0",
            "Description": "IBM WebSphere Application Server is not vulnerable to the Heartbleed vulnerability (CVE-2014-0160) where secure data might not be protected. However, there is a potential denial of service on IBM WebSphere Application Server Version 6.1 and 6.0.2 when running the Heartbleed scanning tools or if sending specially-crafted Heartbeat messages.",
            "ID": "CVE-2014-0964",
            "Malicious": {
                "Description": "IBM WebSphere Application Server is not vulnerable to the Heartbleed vulnerability (CVE-2014-0160) where secure data might not be protected. However, there is a potential denial of service on IBM WebSphere Application Server Version 6.1 and 6.0.2 when running the Heartbleed scanning tools or if sending specially-crafted Heartbeat messages.",
                "Vendor": "XFE"
            },
            "Published": "2014-05-08T00:00:00Z"
        },
        {
            "CVSS": "2.0",
            "Description": "HP Integrated Lights-Out 2 (iLO 2) is vulnerable to a denial of service, caused by an error when scanned by vulnerability assessment tools scan for the Heartbleed vulnerability. A remote attacker could exploit this vulnerability to cause the server to crash.",
            "ID": "BID-67054",
            "Malicious": {
                "Description": "HP Integrated Lights-Out 2 (iLO 2) is vulnerable to a denial of service, caused by an error when scanned by vulnerability assessment tools scan for the Heartbleed vulnerability. A remote attacker could exploit this vulnerability to cause the server to crash.",
                "Vendor": "XFE"
            },
            "Published": "2014-04-24T00:00:00Z"
        },
        {
            "CVSS": "2.0",
            "Description": "OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to remotely read system memory contents without needing to log on to the server. Successful exploitation could allow an attacker to retrieve private keys, passwords or other sensitive information.\r\n\r\nThis vulnerability is commonly referred to as \"Heartbleed\".",
            "ID": "CVE-2014-0160",
            "Published": "2014-04-07T00:00:00Z"
        }
    ],
    "DBotScore": [
        {
            "Indicator": "CVE-2014-0964",
            "Score": 3,
            "Type": "cve",
            "Vendor": "XFE"
        },
        {
            "Indicator": "BID-67054",
            "Score": 3,
            "Type": "cve",
            "Vendor": "XFE"
        },
        {
            "Indicator": "CVE-2014-0160",
            "Score": 2,
            "Type": "cve",
            "Vendor": "XFE"
        }
    ],
    "XFE": {
        "CVE": [
            {
                "Cvss": {
                    "access_complexity": "Medium",
                    "access_vector": "Network",
                    "authentication": "None",
                    "availability_impact": "Complete",
                    "confidentiality_impact": "None",
                    "integrity_impact": "None",
                    "remediation_level": "Official Fix",
                    "version": "2.0"
                },
                "Description": "IBM WebSphere Application Server is not vulnerable to the Heartbleed vulnerability (CVE-2014-0160) where secure data might not be protected. However, there is a potential denial of service on IBM WebSphere Application Server Version 6.1 and 6.0.2 when running the Heartbleed scanning tools or if sending specially-crafted Heartbeat messages.",
                "Exploitability": "Unproven",
                "PlatformsAffected": [
                    "IBM WebSphere Application Server 6.0.2",
                    "IBM WebSphere Application Server 6.1"
                ],
                "Reported": "2014-05-08T00:00:00Z",
                "RiskLevel": 7.1,
                "Stdcode": [
                    "CVE-2014-0964",
                    "BID-67322"
                ],
                "Tagname": "ibm-websphere-cve20140964-dos",
                "Title": "IBM WebSphere Application Server and Scanning Tool denial of service",
                "Xfdbid": 92877
            },
            {
                "Cvss": {
                    "access_complexity": "Low",
                    "access_vector": "Network",
                    "authentication": "None",
                    "availability_impact": "Complete",
                    "confidentiality_impact": "None",
                    "integrity_impact": "None",
                    "remediation_level": "Official Fix",
                    "version": "2.0"
                },
                "Description": "HP Integrated Lights-Out 2 (iLO 2) is vulnerable to a denial of service, caused by an error when scanned by vulnerability assessment tools scan for the Heartbleed vulnerability. A remote attacker could exploit this vulnerability to cause the server to crash.",
                "Exploitability": "Unproven",
                "PlatformsAffected": [
                    "HP Integrated Lights-Out 2 (iLO2) 2.23"
                ],
                "Reported": "2014-04-24T00:00:00Z",
                "RiskLevel": 7.8,
                "Stdcode": [
                    "BID-67054",
                    "SA58224",
                    "CVE-2014-2601"
                ],
                "Tagname": "hp-ilo-cve20142601-dos",
                "Title": "HP Integrated Lights-Out 2 Heartbleed denial of service",
                "Xfdbid": 92744
            },
            {
                "Cvss": {
                    "access_complexity": "Low",
                    "access_vector": "Network",
                    "authentication": "None",
                    "availability_impact": "None",
                    "confidentiality_impact": "Partial",
                    "integrity_impact": "None",
                    "remediation_level": "Official Fix",
                    "version": "2.0"
                },
                "Description": "OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to remotely read system memory contents without needing to log on to the server. Successful exploitation could allow an attacker to retrieve private keys, passwords or other sensitive information.\r\n\r\nThis vulnerability is commonly referred to as \"Heartbleed\".",
                "Exploitability": "Functional",
                "PlatformsAffected": [
                    "OpenSSL OpenSSL 1.0.1A",
                    "OpenSSL OpenSSL 1.0.1B",
                    "OpenSSL OpenSSL 1.0.1c",
                    "OpenSSL OpenSSL 1.0.1D",
                    "OpenSSL OpenSSL 1.0.1E",
                    "OpenSSL OpenSSL 1.0.1f"
                ],
                "Reported": "2014-04-07T00:00:00Z",
                "RiskLevel": 5,
                "Stdcode": [
                    "CVE-2014-0160",
                    "US-CERT VU#720951",
                    "BID-66690",
                    "SA57347",
                    "RHSA-2014-0376",
                "SA57742",
                    "SA57785",
                    "SA57805",
                    "RHSA-2014-0396",
                    "SA57887",
                    "SA57858",
                    "SA57863",
                    "SA57894",
                    "SA57881",
                    "SA57774",
                    "SA57866",
                    "SA58176",
                    "BID-67206"
                ],
                "Tagname": "openssl-cve20140160-info-disc",
                "Title": "OpenSSL heartbeat information disclosure",
                "Xfdbid": 92322
            }
        ],
        "CVESearch": {
            "Bookmark": "g1AAAAEpeJzLYWBgYM5gTmFQS0lKzi9KdUhJMjTXy0zK1a1Iyy9KTjUwMNRLzskvTUnMK9HLSy3JAapnSlIAkkn2____zwLzc4GEiJGBoYmuARCZhxgYWIFRVBIDg7NqFsh4VbjxJoRMz2MBkgwNQApowXwsNhiZoNjArY9mgylxNiyA2LAfwwZTXQMLFBs492RlAQAvQE_q",
            "TotalRows": 3
        }
    }
}
Human Readable Output

X-Force CVE Reputation for CVE-2014-0964

https://exchange.xforce.ibmcloud.com/vulnerability/search/CVE-2014-0964

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network IBM WebSphere Application Server 6.0.2
IBM WebSphere Application Server 6.1		 Medium IBM WebSphere Application Server is not vulnerable to the Heartbleed vulnerability (CVE-2014-0160) where secure data might not be protected. However, there is a potential denial of service on IBM WebSphere Application Server Version 6.1 and 6.0.2 when running the Heartbleed scanning tools or if sending specially-crafted Heartbeat messages. Unproven 2014-05-08T00:00:00Z 7.1 CVE-2014-0964
BID-67322		 IBM WebSphere Application Server and Scanning Tool denial of service 2.0

X-Force CVE Reputation for BID-67054

https://exchange.xforce.ibmcloud.com/vulnerability/search/BID-67054

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network HP Integrated Lights-Out 2 (iLO2) 2.23 Low HP Integrated Lights-Out 2 (iLO 2) is vulnerable to a denial of service, caused by an error when scanned by vulnerability assessment tools scan for the Heartbleed vulnerability. A remote attacker could exploit this vulnerability to cause the server to crash. Unproven 2014-04-24T00:00:00Z 7.8 BID-67054
SA58224
CVE-2014-2601		 HP Integrated Lights-Out 2 Heartbleed denial of service 2.0

X-Force CVE Reputation for CVE-2014-0160

https://exchange.xforce.ibmcloud.com/vulnerability/search/CVE-2014-0160

Access Vector Affected Platforms Complexity Description Exploitability Reported Risk Level STD Code Title Version
Network OpenSSL OpenSSL 1.0.1A
OpenSSL OpenSSL 1.0.1B
OpenSSL OpenSSL 1.0.1c
OpenSSL OpenSSL 1.0.1D
OpenSSL OpenSSL 1.0.1E
OpenSSL OpenSSL 1.0.1f		 Low OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to remotely read system memory contents without needing to log on to the server. Successful exploitation could allow an attacker to retrieve private keys, passwords or other sensitive information.

This vulnerability is commonly referred to as “Heartbleed”.		 Functional 2014-04-07T00:00:00Z 5 CVE-2014-0160
US-CERT VU#720951
BID-66690
SA57347
RHSA-2014-0376
RHSA-2014-0378
SA57692
SA57764
SA57759
SA57758
SA57756
SA57786
SA57755
SA57683
SA57810
SA57386
SA57715
SA57822
SA57833
SA57816
SA57772
SA57799
SA57742
SA57785
SA57805
RHSA-2014-0396
SA57887
SA57858
SA57863
SA57894
SA57881
SA57774
SA57866
SA57884
SA57251
SA57775
SA57890
SA57701
SA57888
SA57738
SA57909
SA57900
SA57853
SA57770
SA57773
SA57735
SA57958
SA57483
SA57744
SA57757
SA57850
SA57876
SA57869
SA57921
SA57920
SA57454
SA57628
SA57793
SA57857
SA57972
SA57970
SA57836
SA57966
SA57968
SA58004
SA58005
SA58028
SA57864
SA57979
SA58032
SA57954
SA57999
SA57763
SA57982
SA58024
SA57824
SA58009
SA58033
SA57974
SA58049
SA58046
SA57817
SA58098
SA58048
SA58040
SA58062
SA57815
SA58102
SA58052
SA57941
SA57807
SA57852
SA58113
SA58107
SA58114
SA58115
SA58008
SA57983
SA57969
SA57961
SA57851
SA57960
SA57789
SA57985
SA57984
SA58056
SA58029
SA57512
SA58164
SA58184
SA57911
SA58183
SA58175
SA58166
SA57951
SA57947
SA58171
SA58178
SA57963
SA58167
SA57949
SA58146
SA58019
SA58172
SA57826
SA58182
SA58244
SA58162
SA58188
SA58185
SA58069
SA58058
SA58148
SA58223
SA58124
SA58204
SA58187
SA58190
SA58161
SA58017
SA58195
SA58053
SA58007
SA58022
SA58176
BID-67206		 OpenSSL heartbeat information disclosure 2.0

Configuration parameters

  • url — Server URL (e.g. https://api.xforce.ibmcloud.com) (required)
  • credentials — API Key (required)
  • integrationReliability — Source Reliability (required)
  • ip_threshold — IP Threshold. Minimum risk score for the IP to be considered malicious (ranges from 1 to 10).
  • url_threshold — URL Threshold. Minimum risk score for the URL to be considered malicious (ranges from 1 to 10).
  • cve_threshold — CVE Threshold. Minimum risk score for the URL to be considered malicious (ranges from 1 to 10).
  • create_relationships — Create relationships
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (8)

  • cve-latest

    Return the latest vulnerabilities found.

  • cve-search

    Search for details about the given CVE.

  • domain

    Check domain reputation.

  • file

    Check file reputation.

  • ip

    IP to check.

  • url

    Check the given URL reputation.

  • xfe-search-cves

    Gets list of all vulnerabilities associated with the search term.

  • xfe-whois

    Gets information about the given host address.

Source

XFE_v2.py XFE_v2_test.py XFE_v2.yml XFE_v2_description.md
Download History Raw 
from collections import defaultdict

from CommonServerPython import *

import urllib3

# Disable insecure warnings
urllib3.disable_warnings()

XFORCE_URL = "https://exchange.xforce.ibmcloud.com"
DEFAULT_THRESHOLD = 7
DBOT_SCORE_KEY = "DBotScore(val.Indicator == obj.Indicator && val.Vendor == obj.Vendor)"


class Client(BaseClient):
    """
    Client for X-Force Exchange RESTful API.

    Args:
          url (str): the URL of X-Force Exchange.
          api_key (str): the API key of X-Force Exchange.
          password (str): password for the API key (required for authentication).
          use_ssl (bool): specifies whether to verify the SSL certificate or not.
          use_proxy (bool): specifies if to use Demisto proxy settings.
          reliability (str): reliability string.
          create_relationships (bool): Whether to create relationships.
    """

    def __init__(
        self,
        url: str,
        api_key: str,
        password: str,
        use_ssl: bool,
        use_proxy: bool,
        reliability: str = DBotScoreReliability.C,
        create_relationships: bool = True,
    ):
        self.reliability = reliability
        self.create_relationships = create_relationships
        super().__init__(url, verify=use_ssl, proxy=use_proxy, headers={"Accept": "application/json"}, auth=(api_key, password))

    def ip_report(self, ip: str) -> dict:
        if not is_ip_valid(ip):
            raise DemistoException("The given IP was invalid")

        return self._http_request("GET", f"/ipr/{ip}")

    def url_report(self, url: str):
        try:
            response = self._http_request("GET", f"/url/{url}")
        except Exception as e:
            if "Not Found" in str(e):
                return "Not Found"
            raise
        return response.get("result")

    def cve_report(self, code: str) -> dict:
        return self._http_request("GET", f"/vulnerabilities/search/{code}")

    def search_cves(self, q: str, start_date: str, end_date: str, bookmark: str) -> dict:
        params = {"q": q, "startDate": start_date, "endDate": end_date, "bookmark": bookmark}
        params = {key: value for key, value in params.items() if value}
        return self._http_request("GET", "/vulnerabilities/fulltext", params=params)

    def file_report(self, file_hash: str) -> dict:
        return self._http_request("GET", f"/malware/{file_hash}").get("malware")

    def get_recent_vulnerabilities(self, start_date: str, end_date: str, limit: int) -> dict:
        params = {"startDate": start_date, "endDate": end_date, "limit": limit}
        params = {key: value for key, value in params.items() if value}
        return self._http_request("GET", "/vulnerabilities", params=params)

    def whois(self, host: str) -> dict:
        return self._http_request("GET", f"/whois/{host}")


def calculate_score(score: int, threshold: int) -> int:
    """
    Calculates and converts X-Force Exchange score into Demisto score.

    Args:
        score (int): the score from X-Force Exchange for certain indicator (1-10).
        threshold (int): the score threshold configured by the user.

    Returns:
        int - Demisto's score for the indicator
    """
    if not score:
        score = 0

    if score > threshold:
        return 3
    elif score > threshold / 2:
        return 2
    return 1


def get_cve_results(client: Client, cve_id: str, report: dict, threshold: int) -> tuple[str, dict, dict]:
    """
    Formats CVE report from X-Force Exchange into Demisto's outputs.

    Args:
        client (Client): X-Force Exchange client.
        cve_id (str): the id (code) of the CVE.
        report (dict): the report from X-Force Exchange about the CVE.
        threshold (int): the score threshold configured by the user.

    Returns:
        str: the markdown to display inside Demisto.
        dict: the context to return into Demisto.
        dict: the report from X-Force Exchange (used for debugging).
    """

    outputs = {
        "ID": cve_id,
        "CVSS": report.get("cvss", {}).get("version"),
        "Published": report.get("reported"),
        "Description": report.get("description"),
    }
    dbot_score = {
        "Indicator": cve_id,
        "Type": "cve",
        "Vendor": "XFE",
        "Score": calculate_score(round(report.get("risk_level", 0)), threshold),
        "Reliability": client.reliability,
    }
    additional_headers = [
        "xfdbid",
        "risk_level",
        "reported",
        "cvss",
        "tagname",
        "stdcode",
        "title",
        "description",
        "platforms_affected",
        "exploitability",
    ]
    additional_info = {string_to_context_key(field): report.get(field) for field in additional_headers}

    if dbot_score["Score"] == 3:
        outputs["Malicious"] = {"Vendor": "XFE", "Description": report.get("description")}

    context = {outputPaths["cve"]: outputs, DBOT_SCORE_KEY: dbot_score, f'XFE.{outputPaths["cve"]}': additional_info}

    table_headers = ["title", "description", "risk_level", "reported", "exploitability"]
    table = {
        "Version": report.get("cvss", {}).get("version"),
        "Access Vector": report.get("cvss", {}).get("access_vector"),
        "Complexity": report.get("cvss", {}).get("access_complexity"),
        "STD Code": "\n".join(report.get("stdcode", [])),
        "Affected Platforms": "\n".join(report.get("platforms_affected", [])),
        **{string_to_table_header(header): report.get(header) for header in table_headers},
    }
    markdown = tableToMarkdown(
        f"X-Force CVE Reputation for {cve_id}\n{XFORCE_URL}/vulnerability/search/{cve_id}", table, removeNull=True
    )

    return markdown, context, report


def test_module(client: Client) -> str:
    """
    Returning 'ok' indicates that the integration works like it is supposed to. Connection to the service is successful.

    Args:
        client (Client): X-Force Exchange client.
    Returns:
        str: 'ok' if test passed, anything else will fail the test.
    """

    return "ok" if client.url_report("google.com") else "Connection failed."


def ip_command(client: Client, args: dict[str, str]) -> tuple[str, dict, Any]:
    """
    Executes IP enrichment against X-Force Exchange.

    Args:
        client (Client): X-Force client.
        args (Dict[str, str]): the arguments for the command.
    Returns:
        str: human readable presentation of the IP report.
        dict: the results to return into Demisto's context.
        Any: the raw data from X-Force client (used for debugging).
    """

    threshold = int(args.get("threshold", demisto.params().get("ip_threshold", DEFAULT_THRESHOLD)))

    markdown = ""
    context: dict = defaultdict(list)
    reports = []

    for ip in argToList(args.get("ip")):
        report = client.ip_report(ip)
        outputs = {
            "Address": report["ip"],
            "Score": report.get("score"),
            "Geo": {"Country": report.get("geo", {}).get("country", "")},
        }
        additional_info: dict = {
            string_to_context_key(field): report.get(field) for field in ["reason", "reasonDescription", "subnets"]
        }
        dbot_score = {
            "Indicator": report["ip"],
            "Type": "ip",
            "Vendor": "XFE",
            "Score": calculate_score(report["score"], threshold),
            "Reliability": client.reliability,
        }

        if dbot_score["Score"] == 3:
            outputs["Malicious"] = {"Vendor": "XFE", "Description": additional_info["Reasondescription"]}

        context[outputPaths["ip"]].append(outputs)
        context[f'XFE.{outputPaths["ip"]}'].append(additional_info)
        context[DBOT_SCORE_KEY].append(dbot_score)

        reason = (
            f'{additional_info["Reason"]}:\n{additional_info["Reasondescription"]}'
            if additional_info["Reason"]
            else "Reason not found."
        )
        subnets = additional_info.get("Subnets", [])
        subnets_list = [subnet.get("subnet") for subnet in subnets]
        table = {"Score": report["score"], "Reason": reason, "Subnets": ", ".join(subnets_list)}
        markdown += tableToMarkdown(
            f'X-Force IP Reputation for: {report["ip"]}\n{XFORCE_URL}/ip/{report["ip"]}', table, removeNull=True
        )
        reports.append(report)

    return markdown, context, reports


def domain_command(client: Client, args: dict[str, str]) -> List[CommandResults]:
    """
    Executes URL enrichment against X-Force Exchange.

    Args:
        client (Client): X-Force client.
        args (Dict[str, str]): the arguments for the command.
    Returns:
        str: human readable presentation of the URL report.
        dict: the results to return into Demisto's context.
        Any: the raw data from X-Force client (used for debugging).
    """

    domains = argToList(args.get("domain", ""))
    threshold = int(args.get("threshold", demisto.params().get("url_threshold", DEFAULT_THRESHOLD)))
    command_results: List[CommandResults] = []

    for domain in domains:
        report = client.url_report(domain)
        if report == "Not Found":
            command_results.append(
                create_indicator_result_with_dbotscore_unknown(
                    indicator=domain, indicator_type=DBotScoreType.DOMAIN, reliability=client.reliability
                )
            )
            continue

        dbot_score = Common.DBotScore(
            indicator=domain,
            indicator_type=DBotScoreType.DOMAIN,
            integration_name="XFE",
            reliability=client.reliability,
            score=calculate_score(report.get("score", 0), threshold),
        )
        indicator_ = Common.Domain(domain=domain, dbot_score=dbot_score)

        table = {"Score": report["score"], "Categories": "\n".join(report["cats"].keys())}

        markdown = tableToMarkdown(
            f'X-Force Domain Reputation for: {report["url"]}\n{XFORCE_URL}/url/{report["url"]}', table, removeNull=True
        )

        command_results.append(CommandResults(readable_output=markdown, raw_response=report, indicator=indicator_))
    return command_results


def url_command(client: Client, args: dict[str, str]) -> List[CommandResults]:
    """
    Executes URL enrichment against X-Force Exchange.

    Args:
        client (Client): X-Force client.
        args (Dict[str, str]): the arguments for the command.
    Returns:
        str: human readable presentation of the URL report.
        dict: the results to return into Demisto's context.
        Any: the raw data from X-Force client (used for debugging).
    """

    urls = argToList(args.get("url", ""))
    threshold = int(args.get("threshold", demisto.params().get("url_threshold", DEFAULT_THRESHOLD)))
    command_results: List[CommandResults] = []

    for url in urls:
        report = client.url_report(url)
        if report == "Not Found":
            command_results.append(
                create_indicator_result_with_dbotscore_unknown(
                    indicator=url, indicator_type=DBotScoreType.URL, reliability=client.reliability
                )
            )
            continue

        dbot_score = Common.DBotScore(
            indicator=url,
            indicator_type=DBotScoreType.URL,
            integration_name="XFE",
            score=calculate_score(report["score"], threshold),
            reliability=client.reliability,
        )

        indicator_ = Common.URL(url=url, dbot_score=dbot_score)

        table = {"Score": report["score"], "Categories": "\n".join(report["cats"].keys())}

        markdown = tableToMarkdown(
            f'X-Force URL Reputation for: {report["url"]}\n{XFORCE_URL}/url/{report["url"]}', table, removeNull=True
        )

        command_results.append(CommandResults(readable_output=markdown, raw_response=report, indicator=indicator_))

    return command_results


def cve_search_command(client: Client, args: dict[str, str]) -> tuple[str, dict, Any]:
    """
    Get details about vulnerabilities (latest / search) from X-Force Exchange.

    Args:
        client (Client): X-Force client.
        args (Dict[str, str]): the arguments for the command.
    Returns:
        str: human readable presentation of the CVEs reports.
        dict: the results to return into Demisto's context.
        Any: the raw data from X-Force Exchange client (used for debugging).
    """

    threshold = int(demisto.params().get("cve_threshold", DEFAULT_THRESHOLD))

    if "q" in args:
        reports = client.search_cves(args["q"], args.get("start_date", ""), args.get("end_date", ""), args.get("bookmark", ""))
        reports, total_rows, bookmark = reports["rows"], reports["total_rows"], reports["bookmark"]
    else:
        reports = client.get_recent_vulnerabilities(
            args.get("start_date", ""), args.get("end_date", ""), int(args.get("limit", 0))
        )
        total_rows, bookmark = "", ""

    total_context: dict[str, Any] = defaultdict(list)
    total_markdown = ""

    for report in reports:
        cve_id = report.get("stdcode", [""])[0]
        markdown, context, _ = get_cve_results(client, cve_id, report, threshold)

        for key, value in context.items():
            total_context[key].append(value)

        total_markdown += markdown

    if total_rows and bookmark:
        total_context["XFE.CVESearch"] = {"TotalRows": total_rows, "Bookmark": bookmark}

    return total_markdown, total_context, reports


def cve_get_command(client: Client, args: dict[str, str]) -> tuple[str, dict, Any]:
    """
    Executes CVE enrichment against X-Force Exchange.

    Args:
        client (Client): X-Force Exchange client.
        args (Dict[str, str]): the arguments for the command.

    Returns:
        str: human readable presentation of the CVE report.
        dict: the results to return into Demisto's context.
        Any: the raw data from X-Force client (used for debugging).
    """

    threshold = int(demisto.params().get("cve_threshold", DEFAULT_THRESHOLD))
    markdown = ""
    context: dict[str, Any] = defaultdict(list)
    reports = []

    for cve_id in argToList(args.get("cve_id")):
        report = client.cve_report(cve_id)
        cve_markdown, cve_context, _ = get_cve_results(client, args["cve_id"], report[0], threshold)

        markdown += cve_markdown
        context[outputPaths["cve"]].append(cve_context[outputPaths["cve"]])
        context[DBOT_SCORE_KEY].append(cve_context[DBOT_SCORE_KEY])
        context[f'XFE.{outputPaths["cve"]}'].append(cve_context[f'XFE.{outputPaths["cve"]}'])

        reports.append(report)

    return markdown, context, reports


def file_command(client: Client, args: dict[str, str]) -> List[CommandResults]:
    """
    Executes file hash enrichment against X-Force Exchange.

    Args:
        client (Client): X-Force Exchange client.
        args (Dict[str, str]): the arguments for the command.

    Returns:
         List of CommandResults.
    """
    context: dict = defaultdict(list)
    relationship: list = []
    command_results: List[CommandResults] = []

    for file_hash in argToList(args.get("file")):
        try:
            report = client.file_report(file_hash)
        except Exception as err:
            if "Error in API call [404] - Not Found" in str(err):
                command_results.append(
                    create_indicator_result_with_dbotscore_unknown(
                        indicator=file_hash, indicator_type=DBotScoreType.FILE, reliability=client.reliability
                    )
                )
                continue
            else:
                raise ValueError(err)

        scores = {"high": 3, "medium": 2, "low": 1}
        dbot_score = Common.DBotScore(
            indicator=file_hash,
            indicator_type=DBotScoreType.FILE,
            integration_name="XFE",
            score=scores.get(report["risk"], 0),
            reliability=client.reliability,
        )

        report_data = report["origins"].get("external", {})
        family_value = report_data.get("family")
        hash_info = {**report["origins"], "Family": family_value, "FamilyMembers": report_data.get("familyMembers")}
        if client.create_relationships:
            malware = dict_safe_get(hash_info, ["external", "family"], [])
            if malware and isinstance(malware, list):
                malware = malware[0]
                relationship = [
                    EntityRelationship(
                        name=EntityRelationship.Relationships.RELATED_TO,
                        entity_a=file_hash,
                        entity_a_type=FeedIndicatorType.File,
                        entity_b=malware,
                        entity_b_type=FeedIndicatorType.indicator_type_by_server_version("STIX Malware"),
                        source_reliability=client.reliability,
                        brand="XFE",
                    )
                ]

        hash_type = get_hash_type(file_hash)  # if file_hash found, has to be md5, sha1 or sha256
        if hash_type == "md5":
            file = Common.File(md5=file_hash, dbot_score=dbot_score, relationships=relationship)
        elif hash_type == "sha1":
            file = Common.File(sha1=file_hash, dbot_score=dbot_score, relationships=relationship)
        elif hash_type == "sha256":
            file = Common.File(sha256=file_hash, dbot_score=dbot_score, relationships=relationship)
        else:
            file = None
            demisto.debug(f"{hash_type=} doesn't match any condition. {file=}")

        context[f'XFE.{outputPaths["file"]}'] = hash_info

        download_servers = ",".join(server["ip"] for server in hash_info.get("downloadServers", {}).get("rows", []))
        cnc_servers = ",".join(server["domain"] for server in hash_info.get("CnCServers", {}).get("rows", []))
        table = {
            "CnC Servers": cnc_servers,
            "Download Servers": download_servers,
            "Source": hash_info.get("external", {}).get("source"),
            "Created Date": report_data.get("firstSeen"),
            "Type": hash_info.get("external", {}).get("malwareType"),
        }
        markdown = tableToMarkdown(
            f'X-Force {hash_type} Reputation for {args.get("file")}\n{XFORCE_URL}/malware/{args.get("file")}',
            table,
            removeNull=True,
        )

        command_results.append(
            CommandResults(
                readable_output=markdown, outputs=context, indicator=file, raw_response=report, relationships=relationship
            )
        )
    return command_results


def whois_command(client: Client, args: dict[str, str]) -> tuple[str, dict, Any]:
    """
    Gets information about the given host address.

    Args:
        client (Client): X-Force Exchange client.
        args (Dict[str, str]): the arguments for the command.

    Returns:
         str: human readable presentation of the information about the host.
         dict: the results to return into Demisto's context.
         Any: the raw data from X-Force Exchange client (used for debugging).
    """

    result = client.whois(args["host"])

    contact = [{k.title(): v for k, v in contact.items()} for contact in result.get("contact", [])]
    outputs = {
        "Host": args["host"],
        "RegistrarName": result.get("registrarName"),
        "Created": result.get("createdDate"),
        "Updated": result.get("updatedDate"),
        "Expires": result.get("expiresDate"),
        "Email": result.get("contactEmail"),
        "Contact": contact,
    }

    domain = {
        "Name": args["host"],
        "CreationDate": outputs["Created"],
        "ExpirationDate": outputs["Expires"],
        "UpdatedDate": outputs["Updated"],
        "Organization": contact[0]["Organization"] if contact else "",
        "Registrant": {
            "Country": contact[0]["Country"] if contact else "",
            "Name": contact[0]["Organization"] if contact else "",
        },
        "WHOIS": {
            "Registrar": {"Name": result.get("registrarName"), "Email": result.get("contactEmail")},
            "UpdatedDate": outputs["Updated"],
            "ExpirationDate": outputs["Expires"],
            "CreationDate": outputs["Created"],
        },
    }

    domain["WHOIS"]["Registrant"] = domain["Registrant"]  # type: ignore

    context = {outputPaths["domain"]: domain, "XFE.Whois(obj.Host==val.Host)": outputs}
    markdown = tableToMarkdown(f'X-Force Whois result for {args["host"]}', outputs, removeNull=True)

    return markdown, context, result


def main():
    params = demisto.params()
    credentials = params.get("credentials")

    reliability = params.get("integrationReliability")
    reliability = reliability if reliability else DBotScoreReliability.C

    if DBotScoreReliability.is_valid_type(reliability):
        reliability = DBotScoreReliability.get_dbot_score_reliability_from_str(reliability)
    else:
        raise Exception("Please provide a valid value for the Source Reliability parameter.")

    client = Client(
        params.get("url"),
        credentials.get("identifier"),
        credentials.get("password"),
        use_ssl=not params.get("insecure", False),
        use_proxy=params.get("proxy", False),
        reliability=reliability,
        create_relationships=argToBoolean(params.get("create_relationships")),
    )

    commands = {
        "ip": ip_command,
        "url": url_command,
        "domain": domain_command,
        "cve-latest": cve_search_command,
        "cve-search": cve_get_command,
        "file": file_command,
        "xfe-whois": whois_command,
        "xfe-search-cves": cve_search_command,
    }

    command = demisto.command()
    LOG(f"Command being called is {command}")

    try:
        if command == "test-module":
            return_results(test_module(client))
        elif command in ["file", "url", "domain"]:
            return_results(commands[command](client, demisto.args()))
        elif command in commands:
            return_outputs(*commands[command](client, demisto.args()))
        else:
            raise NotImplementedError(f'Command "{command}" is not implemented.')
    except Exception as e:
        return_error(f"Failed to execute {command} command. Error: {e}")


if __name__ in ("__main__", "__builtin__", "builtins"):
    main()