iDefense_v2 Deprecated

Deprecated. Use Accenture CTI v2 instead.

Data Enrichment & Threat Intelligence · Accenture CTI (Deprecated)

Details

IDiDefense_v2
ProviderAccenture
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.10.1.25933
Supported ModulesAgentix

README

Accenture CTI provides intelligence regarding security threats and vulnerabilities.
This integration was integrated and tested with version v2.58.0 of ACTI

Configure Accenture CTI in Cortex

Parameter Description Required
url URL True
api_token API Token True
Source Reliability Reliability of the source providing the intelligence data. B - Usually reliable
insecure Trust any certificate (not secure) False
use_proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Checks the reputation of the given IP address.

Base Command

ip

Input

Argument Name Description Required
ip IP address to check. Optional

Context Output

Path Type Description
IP.Address String The IP address that was checked.
IP.Malicious.Vendor String For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description String For malicious IP addresses, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor that was used to calculate the score.
DBotScore.Score String The actual score.

Command Example

!ip ip=0.0.0.0

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.0",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "ip",
        "Vendor": "iDefense_v2"
    },
    "IP": {
        "Address": "0.0.0.0"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
0 2 2018-04-25 14:20:30 0.0.0.0 Cyber Espionage MALWARE_DOWNLOAD,
MALWARE_C2

domain

Checks the reputation of the given domain.

Base Command

domain

Input

Argument Name Description Required
domain The domain to check. Optional

Context Output

Path Type Description
Domain.Name String The name of the domain that was checked.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!domain domain=example.org

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "iDefense_v2"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
50 2 2019-09-18 15:56:49 example.org Cyber Crime MALWARE_C2

url

Checks the reputation of the given URL.

Base Command

url

Input

Argument Name Description Required
url The URL to check (must start with “http://”). Optional

Context Output

Path Type Description
URL.Data String The URL that was checked.
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
URL.Malicious.Description String For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!url url=http://example.com

Context Example

{
    "DBotScore": {
        "Indicator": "http://example.com",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "url",
        "Vendor": "iDefense_v2"
    },
    "URL": {
        "Data": "http://example.com"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
50 2 2020-09-16 20:29:35 http://example.com Cyber Crime MALWARE_C2

idefense-get-ioc-by-uuid

Get specific indicator reputation

Base Command

idefense-get-ioc-by-uuid

Input

Argument Name Description Required
uuid Unique User ID. Required

Context Output

Path Type Description
IP.Address String The IP address.
IP.Malicious.Vendor String For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description String For malicious IP addresses, the reason the vendor made that decision.
Domain.Name String The domain name.
Domain.Malicious.Vendor String For malicious domains, the vendor that made the decision.
Domain.Malicious.Description String For malicious domains, the reason the vendor made that decision.
URL.Data String The URL.
URL.Malicious.Vendor String For malicious URLs, the vendor that made the decision.
URL.Malicious.Description String For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.

Command Example

!idefense-get-ioc-by-uuid uuid=xxxx

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "iDefense_v2"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse
0 2 2017-01-11 20:56:22 example.org Cyber Espionage MALWARE_C2

Configuration parameters

  • url — URL (required)
  • api_token — (required)
  • integrationReliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)
  • use_proxy — Use system proxy settings

Commands (4)

  • domain

    Checks the reputation of the given domain.

  • idefense-get-ioc-by-uuid

    Get specific indicator reputation

  • ip

    Checks the reputation of the given IP address.

  • url

    Checks the reputation of the given URL.

Source

iDefense_v2.py iDefense_v2_test.py iDefense_v2.yml iDefense_v2_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Accenture
commonfields:
  id: iDefense_v2
  version: -1
configuration:
- display: URL
  name: url
  defaultvalue: https://api.intelgraph.idefense.com/
  type: 0
  required: true
- displaypassword: API Token
  name: api_token
  type: 9
  required: true
  hiddenusername: true
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: use_proxy
  type: 8
  required: false
description: Deprecated. Use Accenture CTI v2 instead.
display: Accenture CTI (Deprecated)
name: iDefense_v2
deprecated: true
script:
  commands:
  - name: ip
    arguments:
    - name: ip
      default: true
      description: IP address to check.
      isArray: true
    outputs:
    - contextPath: IP.Address
      description: The IP address that was checked.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor that was used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: String
    description: Checks the reputation of the given IP address.
  - name: domain
    arguments:
    - name: domain
      default: true
      description: The domain to check.
      isArray: true
    outputs:
    - contextPath: Domain.Name
      description: The name of the domain that was checked.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: String
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Checks the reputation of the given domain.
  - name: url
    arguments:
    - name: url
      default: true
      description: The URL to check (must start with "http://").
      isArray: true
    outputs:
    - contextPath: URL.Data
      description: The URL that was checked.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Checks the reputation of the given URL.
  - name: idefense-get-ioc-by-uuid
    arguments:
    - name: uuid
      required: true
      description: Unique User ID.
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: For malicious IP addresses, the vendor that made the decision.
      type: String
    - contextPath: IP.Malicious.Description
      description: For malicious IP addresses, the reason the vendor made that decision.
      type: String
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision.
      type: String
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason the vendor made that decision.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason the vendor made that decision.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    description: Get specific indicator reputation

  dockerimage: demisto/python3:3.10.1.25933
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- iDefense_v2_Test