ThreatGridv2

Query and upload samples to Cisco threat grid.

Category

Forensics & Malware Analysis

Pack

ThreatGrid

Configuration parameters

• base_url — Server URL (e.g. https://192.168.0.1) (required)
• credentials — (required)
• integrationReliability — Source Reliability (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (34)

• domain — Checks the reputation of a domain.
• file — Checks the file reputation of the specified hash.
• ip — Checks the reputation of an IP address.
• threat-grid-analysis-annotations-get — Returns data regarding the annotations of the analysis.
• threat-grid-analysis-artifacts-get — Returns the sample id artifact with artifact id.
• threat-grid-analysis-iocs-get — Returns data regarding the specified Indicator of Compromise.
• threat-grid-analysis-metadata-get — Returns metadata about the analysis.
• threat-grid-analysis-network-streams-get — Returns data regarding a specific network stream.
• threat-grid-analysis-processes-get — Returns data regarding the specific process id in the analysis.
• threat-grid-domain-associated-ips — Returns a list of IPs associated to the domain.
• threat-grid-domain-associated-urls — Returns a list of URLs associated to the domain.
• threat-grid-domain-samples-list — Returns a list of samples associated with a Domain.
• threat-grid-feed-specific-get — Gets a specific threat feed.
• threat-grid-feeds-artifact — Get artifacts threat feed.
• threat-grid-feeds-domain — Get domain threat feed.
• threat-grid-feeds-ip — Get ips threat feed.
• threat-grid-feeds-network-stream — Get network stream threat feed.
• threat-grid-feeds-path — Get path threat feed.
• threat-grid-feeds-url — Get url threat feed.
• threat-grid-ip-associated-domains — Returns a list of domains associated with the IP.
• threat-grid-ip-associated-urls — Returns a list of URLs associated to the IP.
• threat-grid-ip-samples-list — Returns a list of samples associated with an IP.
• threat-grid-ip-search — Search IPs. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time.
• threat-grid-path-samples-list — Returns a list of samples associated with a Path.
• threat-grid-rate-limit-get — Get rate limit for a specific user name. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by a user. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day.
• threat-grid-registry-key-samples-list — Returns a list of samples associated with a specified registry key.
• threat-grid-sample-list — Search samples on the Threat Grid platform. Input parameters are ANDed together. Only finished samples can be searched (that is, the ones that are having a status of succ or fail.)
• threat-grid-sample-summary-get — Returns summary analysis information.
• threat-grid-sample-upload — Submits a sample to threat grid for analysis. URL or file, not both.
• threat-grid-submissions-search — Search threat grid submissions.
• threat-grid-url-samples-list — Returns a list of samples associated with an URL.
• threat-grid-url-search — Search urls. Please provide the URL in the format http://example.com:80/ (note that ThreatGrid only support '.com' domains).
• threat-grid-who-am-i — Get logged in user.
• url — Checks the reputation of a URL.