iDefense

Details

ID	`iDefense_v2`
Provider	Accenture
Category	Data Enrichment & Threat Intelligence
From Version	5.5.0
Docker Image	`demisto/python3:3.10.1.25933`
Supported Modules	Agentix

README

Accenture CTI provides intelligence regarding security threats and vulnerabilities.
This integration was integrated and tested with version v2.58.0 of ACTI

Configure Accenture CTI in Cortex

Parameter	Description	Required
url	URL	True
api_token	API Token	True
Source Reliability	Reliability of the source providing the intelligence data.	B - Usually reliable
insecure	Trust any certificate (not secure)	False
use_proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Checks the reputation of the given IP address.

Base Command

ip

Input

Argument Name	Description	Required
ip	IP address to check.	Optional

Context Output

Path	Type	Description
IP.Address	String	The IP address that was checked.
IP.Malicious.Vendor	String	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	String	For malicious IP addresses, the reason the vendor made that decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor that was used to calculate the score.
DBotScore.Score	String	The actual score.

Command Example

!ip ip=0.0.0.0

Context Example

{
    "DBotScore": {
        "Indicator": "0.0.0.0",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "ip",
        "Vendor": "iDefense_v2"
    },
    "IP": {
        "Address": "0.0.0.0"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse

0 2 2018-04-25 14:20:30 0.0.0.0 Cyber Espionage MALWARE_DOWNLOAD,
MALWARE_C2

Confidence	DbotReputation	LastPublished	Name	ThreatTypes	TypeOfUse
0	2	2018-04-25 14:20:30	0.0.0.0	Cyber Espionage	MALWARE_DOWNLOAD, MALWARE_C2

domain

Checks the reputation of the given domain.

Base Command

domain

Input

Argument Name	Description	Required
domain	The domain to check.	Optional

Context Output

Path	Type	Description
Domain.Name	String	The name of the domain that was checked.
Domain.Malicious.Vendor	String	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	String	For malicious domains, the reason the vendor made that decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

Command Example

!domain domain=example.org

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "iDefense_v2"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse

50 2 2019-09-18 15:56:49 example.org Cyber Crime MALWARE_C2

Confidence	DbotReputation	LastPublished	Name	ThreatTypes	TypeOfUse
50	2	2019-09-18 15:56:49	example.org	Cyber Crime	MALWARE_C2

url

Checks the reputation of the given URL.

Base Command

url

Input

Argument Name	Description	Required
url	The URL to check (must start with “http://”).	Optional

Context Output

Path	Type	Description
URL.Data	String	The URL that was checked.
URL.Malicious.Vendor	String	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	String	For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

Command Example

!url url=http://example.com

Context Example

{
    "DBotScore": {
        "Indicator": "http://example.com",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "url",
        "Vendor": "iDefense_v2"
    },
    "URL": {
        "Data": "http://example.com"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse

50 2 2020-09-16 20:29:35 http://example.com Cyber Crime MALWARE_C2

Confidence	DbotReputation	LastPublished	Name	ThreatTypes	TypeOfUse
50	2	2020-09-16 20:29:35	http://example.com	Cyber Crime	MALWARE_C2

idefense-get-ioc-by-uuid

Get specific indicator reputation

Base Command

idefense-get-ioc-by-uuid

Input

Argument Name	Description	Required
uuid	Unique User ID.	Required

Context Output

Path	Type	Description
IP.Address	String	The IP address.
IP.Malicious.Vendor	String	For malicious IP addresses, the vendor that made the decision.
IP.Malicious.Description	String	For malicious IP addresses, the reason the vendor made that decision.
Domain.Name	String	The domain name.
Domain.Malicious.Vendor	String	For malicious domains, the vendor that made the decision.
Domain.Malicious.Description	String	For malicious domains, the reason the vendor made that decision.
URL.Data	String	The URL.
URL.Malicious.Vendor	String	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	String	For malicious URLs, the reason the vendor made that decision.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.

Command Example

!idefense-get-ioc-by-uuid uuid=xxxx

Context Example

{
    "DBotScore": {
        "Indicator": "example.org",
        "Reliability": "B - Usually reliable",
        "Score": 2,
        "Type": "domain",
        "Vendor": "iDefense_v2"
    },
    "Domain": {
        "Name": "example.org"
    }
}

Human Readable Output

Results

Confidence DbotReputation LastPublished Name ThreatTypes TypeOfUse

0 2 2017-01-11 20:56:22 example.org Cyber Espionage MALWARE_C2

Confidence	DbotReputation	LastPublished	Name	ThreatTypes	TypeOfUse
0	2	2017-01-11 20:56:22	example.org	Cyber Espionage	MALWARE_C2

Configuration parameters

url — URL (required)
api_token — (required)
integrationReliability — Source Reliability (required)
insecure — Trust any certificate (not secure)
use_proxy — Use system proxy settings

Commands (4)

domain
Checks the reputation of the given domain.
idefense-get-ioc-by-uuid
Get specific indicator reputation
ip
Checks the reputation of the given IP address.
url
Checks the reputation of the given URL.

Source

iDefense_v2.py iDefense_v2_test.py iDefense_v2.yml iDefense_v2_description.md

Download History Raw

import requests_mock
from iDefense_v2 import IDEFENSE_URL_TEMPLATE, Client, domain_command, url_command, ip_command, uuid_command, _calculate_dbot_score                             # noqa: E501
from CommonServerPython import DemistoException, DBotScoreReliability
from test_data.response_constants import *
import demistomock as demisto
import pytest

API_URL = "https://test.com"

DBOT_KEY = 'DBotScore(val.Indicator && val.Indicator == obj.Indicator && ' \
           'val.Vendor == obj.Vendor && val.Type == obj.Type)'

INTEGRATION_NAME = 'iDefense'

ENDPOINTS = {
    'threatindicator': '/rest/threatindicator',
    'document': '/rest/document',
    'fundamental': '/rest/fundamental'
}


@pytest.fixture(autouse=True)
def handle_calling_context(mocker):
    mocker.patch.object(demisto, 'callingContext', {'context': {'IntegrationBrand': INTEGRATION_NAME}})


def test_ip_command():
    """
    Given:
        - an IP

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=0.0.0.0'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=0.0.0.0&type.values=intelligence_alert&type.values=intelligence_report'                                 # noqa: E501
    status_code = 200
    json_data = IP_RES_JSON
    intel_json_data = IP_INTEL_JSON

    expected_output = {
        'IP': [{'Address': '0.0.0.0'}],
        'DBOTSCORE': [{'Indicator': '0.0.0.0', 'Type': 'ip', 'Vendor': 'iDefense', 'Score': 2,
                       'Reliability': 'B - Usually reliable'}]}

    ip_to_check = {'ip': '0.0.0.0'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()

        output = results[0].to_context().get('EntryContext', {})

        assert output.get('IP(val.Address && val.Address == obj.Address)', []) == expected_output.get('IP')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_ip_command_when_api_key_not_authorised_for_document_search():
    """
    Given:
        - a ip and api key not authorized for doc search

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=0.0.0.0'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=0.0.0.0&type.values=intelligence_alert&type.values=intelligence_report'                                                        # noqa: E501

    status_code = 200
    error_status_code = 403
    json_data = IP_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'IP': [{'Address': '0.0.0.0'}],
        'DBOTSCORE': [{'Indicator': '0.0.0.0', 'Type': 'ip', 'Vendor': 'iDefense', 'Score': 2,
                       'Reliability': 'B - Usually reliable'}]}

    ip_to_check = {'ip': '0.0.0.0'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('IP(val.Address && val.Address == obj.Address)', []) == expected_output.get('IP')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_domain_command():
    """
    Given:
        - a domain

    When:
        - running domain command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/domain?key.values=mydomain.com'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report'                                            # noqa: E501

    status_code = 200
    json_data = DOMAIN_RES_JSON
    intel_json_data = DOMAIN_INTEL_JSON
    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                      # noqa: E501
    }

    domain_to_check = {'domain': 'mydomain.com'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = domain_command(client, domain_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()

        output = results[0].to_context().get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_domain_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a domain and api key not authorized for doc search

    When:
        - running domain command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/domain?key.values=mydomain.com'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report'                                                                                # noqa: E501

    status_code = 200
    error_status_code = 403
    json_data = DOMAIN_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                                         # noqa: E501
    }

    domain_to_check = {'domain': 'mydomain.com'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = domain_command(client, domain_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def _is_intelligence_data_present_in_command_result(context_result, test_intel_json_data) -> bool:
    """
        Function to verify whether context result includes intelligence alert and report information

        Args:
            context_result from demisto command
            test_intel_json_data mock response data used for document search api

        Returns:
            True if intelligence alert and report are present else False
    """

    test_data = test_intel_json_data.get('results')
    alerts, reports = {}, {}

    for result in test_data:
        if result['type'] == 'intelligence_alert':
            alerts[result['title']] = IDEFENSE_URL_TEMPLATE.format(result['type'], result['uuid'])
        if result['type'] == 'intelligence_report':
            reports[result['title']] = IDEFENSE_URL_TEMPLATE.format(result['type'], result['uuid'])

    content = context_result['HumanReadable']

    for title, url in alerts.items():
        if url not in content[content.find(title):content.find('|', content.find(title))]:
            return False

    for title, url in reports.items():
        if url not in content[content.find(title):content.find('|', content.find(title))]:
            return False
    return True


def test_uuid_command():
    """
    Given:
        - a domain uuid

    When:
        - running uuid command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report'                                                           # noqa: E501

    status_code = 200
    json_data = UUID_RES_JSON
    intel_json_data = DOMAIN_INTEL_JSON
    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                  # noqa: E501
    }

    uuid_to_check = {'uuid': '461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = uuid_command(client, uuid_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results.to_context()

        output = results.to_context().get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_uuid_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a domain uuid and api key not authorized for doc search

    When:
        - running uuid command and validate whether the domain is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=mydomain.com&type.values=intelligence_alert&type.values=intelligence_report'                                                                                                  # noqa: E501

    status_code = 200
    error_status_code = 403
    json_data = UUID_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'domain': [{'Name': 'mydomain.com'}],
        'DBOTSCORE': [{'Indicator': 'mydomain.com', 'Type': 'domain', 'Vendor': 'iDefense', 'Score': 2, 'Reliability': 'B - Usually reliable'}]                                                                                   # noqa: E501
    }

    uuid_to_check = {'uuid': '461b5ba2-d4fe-4b5c-ac68-35b6636c6edf'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = uuid_command(client, uuid_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results.to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('Domain(val.Name && val.Name == obj.Name)', []) == expected_output.get('domain')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_ip_not_found():
    """
    Given:
        - an IP

    When:
        - running ip command and validate whether the ip is malicious

    Then:
        - return command results with context indicate that no results were found

    """

    url = 'https://test.com/rest/threatindicator/v0/ip?key.values=1.1.1.1'
    status_code = 200
    json_data = {'total_size': 0, 'page': 1, 'page_size': 25, 'more': False}
    expected_output = "No results were found for ip 1.1.1.1"

    ip_to_check = {'ip': '1.1.1.1'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client)
        output = results[0].to_context().get('HumanReadable')
        assert expected_output in output


def test_wrong_ip():
    """
    Given:
        - an IP

    When:
        - running ip command validate at first to check if the given ip is a valid ip

    Then:
        - raise error before calling http request that indicates that the given argument is not valid

    """

    ip_to_check = {'ip': '1'}
    client = Client(API_URL, 'api_token', True, False)
    doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
    try:
        ip_command(client, ip_to_check, DBotScoreReliability.B, doc_search_client)
    except DemistoException as err:
        assert "Received wrong IP value" in str(err)


def test_wrong_connection():
    """
    Given:
        - an api token

    When:
        - checking api access

    Then:
        - raise error if there is no access because of wrong api token

    """

    from iDefense_v2 import test_module
    with requests_mock.Mocker() as m:
        mock_address = 'https://test.com/rest/threatindicator/v0/'
        m.get(mock_address, status_code=401, json={})
        client = Client('bad_api_key', 'wrong_token', True, False)
        try:
            test_module(client)
        except DemistoException as err:
            assert 'Error in API call - check the input parameters' in str(err)


def _test_connection():
    """
    Given:
        - an api token

    When:
        - checking api access

    Then:
        - ok if there is access

    """

    from iDefense_v2 import test_module
    with requests_mock.Mocker() as m:
        mock_address = 'https://test.com/rest/threatindicator/v0/'
        m.get(mock_address, status_code=200, json={})
        client = Client(API_URL, 'api_token', True, False, '/rest/threatindicator/v0')
        assert test_module(client) in "ok"


def test_url_command():
    """
    Given:
        - url

    When:
        - running url command and validate whether the url is malicious

    Then:
        - return command results containing indicator, dbotscore and associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/url?key.values=http://www.malware.com/path'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=http://www.malware.com/path&type.values=intelligence_alert&type.values=intelligence_report'                                                             # noqa: E501
    status_code = 200
    json_data = URL_RES_JSON
    intel_json_data = URL_INTEL_JSON

    expected_output = {
        'URL': [{'Data': 'http://www.malware.com/path'}],
        'DBOTSCORE': [{'Indicator': 'http://www.malware.com/path', 'Type': 'url', 'Vendor': 'iDefense',
                       'Score': 2, 'Reliability': 'B - Usually reliable'}]}

    url_to_check = {'url': 'http://www.malware.com/path'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=status_code, json=intel_json_data)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = url_command(client, url_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()

        output = results[0].to_context().get('EntryContext', {})
        assert output.get('URL(val.Data && val.Data == obj.Data)', []) == expected_output.get('URL')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert _is_intelligence_data_present_in_command_result(context_result, intel_json_data) is True


def test_url_command_when_api_key_not_authorized_for_document_search():
    """
    Given:
        - a url and api key not authorized for doc search

    When:
        - running url command and validate whether the url is malicious

    Then:
        - return command results containing indicator, dbotscore and NO associated intelligence alerts, reports

    """

    url = 'https://test.com/rest/threatindicator/v0/url?key.values=http://www.malware.com/path'
    doc_url = 'https://test.com/rest/document/v0?links.display_text.query=http://www.malware.com/path&type.values=intelligence_alert&type.values=intelligence_report'                                                                                             # noqa: E501

    status_code = 200
    error_status_code = 403
    json_data = URL_RES_JSON
    doc_search_exception_response = {'timestamp': '2021-11-12T09:09:27.983Z', 'status': 403,
                                     'error': 'Forbidden', 'message': 'Forbidden', 'path': '/rest/document/v0'}

    expected_output = {
        'URL': [{'Data': 'http://www.malware.com/path'}],
        'DBOTSCORE': [{'Indicator': 'http://www.malware.com/path', 'Type': 'url', 'Vendor': 'iDefense',
                       'Score': 2, 'Reliability': 'B - Usually reliable'}]}

    url_to_check = {'url': 'http://www.malware.com/path'}
    with requests_mock.Mocker() as m:
        m.get(url, status_code=status_code, json=json_data)
        m.get(doc_url, status_code=error_status_code, json=doc_search_exception_response)
        client = Client(API_URL, 'api_token', True, False, ENDPOINTS['threatindicator'])
        doc_search_client = Client(API_URL, 'api_token', True, False, ENDPOINTS['document'])
        results = url_command(client, url_to_check, DBotScoreReliability.B, doc_search_client)

        context_result = results[0].to_context()
        content = context_result['HumanReadable']
        output = context_result.get('EntryContext', {})

        assert output.get('URL(val.Data && val.Data == obj.Data)', []) == expected_output.get('URL')
        assert output.get(DBOT_KEY, []) == expected_output.get('DBOTSCORE')
        assert 'Intelligence Alerts' not in content
        assert 'Intelligence Reports' not in content


def test_calculate_dbot_score():
    """
    Given:
        - number represents severity

    When:
        - api call with indicator returns response that includes them severity score

    Then:
        - returns dbotscore according to internal conversion

    """
    assert _calculate_dbot_score(0) == 0
    assert _calculate_dbot_score(1) == 1
    assert _calculate_dbot_score(2) == 1
    assert _calculate_dbot_score(3) == 2
    assert _calculate_dbot_score(4) == 2
    assert _calculate_dbot_score(5) == 3
    assert _calculate_dbot_score(6) == 3
    assert _calculate_dbot_score(7) == 3

iDefense_v2 Deprecated

Details

README

Configure Accenture CTI in Cortex

Commands

ip

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Results

domain

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Results

url

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Results

idefense-get-ioc-by-uuid

Base Command

Input

Context Output

Command Example

Context Example

Human Readable Output

Results

Configuration parameters

Commands (4)

Source