Recorded Future IOC Reputation

Entity Reputation using sub-playbooks

Pack

RecordedFuture

Tasks

7

Inputs

• IP — The IP addresses to enrich
• MD5 — MD5 to enrich
• SHA256 — SHA256 to enrich
• SHA1 — SHA1 to enrich
• URL — URL to enrich
• Domain — The domain name to enrich

Outputs

• DBotScore.Indicator — The indicator that was tested
• DBotScore.Type — Indicator type
• DBotScore.Vendor — Vendor used to calculate the score
• DBotScore.Score — The actual score
• CVE.ID — Vulnerability name
• Domain.Name — Domain name
• Domain.Malicious.Vendor — For malicious domains, the vendor that made the decision
• Domain.Malicious.Description — For malicious domains, the reason that the vendor made the decision
• IP.Address — IP address
• IP.Malicious.Vendor — For malicious IP addresses, the vendor that made the decision
• IP.Malicious.Description — For malicious IP addresses, the reason that the vendor made the decision
• URL.Data — URL name
• URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision
• URL.Malicious.Description — For malicious URLs, the reason that the vendor made the decision
• File.SHA256 — File SHA-256
• File.SHA512 — File SHA-512
• File.SHA1 — File SHA-1
• File.MD5 — File MD5
• File.CRC32 — File CRC32
• File.CTPH — File CTPH
• File.Malicious.Vendor — For malicious files, the vendor that made the decision
• File.Malicious.Description — For malicious files, the reason that the vendor made the decision
• RecordedFuture.File.riskScore — Recorded Future Hash Risk Score
• RecordedFuture.File.riskLevel — Recorded Future Hash Risk Level
• RecordedFuture.File.Evidence.rule — Recorded Future Risk Rule Name
• RecordedFuture.File.Evidence.mitigation — Recorded Future Risk Rule Mitigation
• RecordedFuture.File.Evidence.description — Recorded Future Risk Rule description
• RecordedFuture.File.Evidence.timestamp — Recorded Future Risk Rule timestamp
• RecordedFuture.File.Evidence.level — Recorded Future Risk Rule Level
• RecordedFuture.File.Evidence.ruleid — Recorded Future Risk Rule ID
• RecordedFuture.File.name — Hash
• RecordedFuture.File.maxRules — Maximum count of Recorded Future Hash Risk Rules
• RecordedFuture.File.ruleCount — Number of triggered Recorded Future Hash Risk Rules
• RecordedFuture.IP.riskScore — Recorded Future IP Risk Score
• RecordedFuture.IP.riskLevel — Recorded Future IP Risk Level
• RecordedFuture.IP.Evidence.rule — Recorded Future Risk Rule Name
• RecordedFuture.IP.Evidence.mitigation — Recorded Future Risk Rule Mitigation
• RecordedFuture.IP.Evidence.description — Recorded Future Risk Rule Description
• RecordedFuture.IP.Evidence.timestamp — Recorded Future Risk Rule Timestamp
• RecordedFuture.IP.Evidence.level — Recorded Future Risk Rule Level
• RecordedFuture.IP.Evidence.ruleid — Recorded Future Risk Rule ID
• RecordedFuture.IP.name — IP Address
• RecordedFuture.IP.maxRules — Maximum count of Recorded Future IP Risk Rules
• RecordedFuture.IP.ruleCount — Number of triggered Recorded Future IP Risk Rules
• RecordedFuture.CVE.riskLevel — Recorded Future Vulnerability Risk Level
• RecordedFuture.CVE.riskScore — Risk Score
• RecordedFuture.CVE.Evidence.rule — Recorded Future Risk Rule Name
• RecordedFuture.CVE.Evidence.mitigation — Recorded Future Risk Rule Mitigation
• RecordedFuture.CVE.Evidence.description — Recorded Future Risk Rule description
• RecordedFuture.CVE.Evidence.timestamp — Recorded Future Risk Rule timestamp
• RecordedFuture.CVE.Evidence.level — Recorded Future Risk Rule Level
• RecordedFuture.CVE.Evidence.ruleid — Recorded Future Risk Rule ID
• RecordedFuture.CVE.name — Vulnerability name
• RecordedFuture.CVE.maxRules — Maximum count of Recorded Future Vulnerability Risk Rules
• RecordedFuture.CVE.ruleCount — Number of triggered Recorded Future Vulnerability Risk Rules
• RecordedFuture.Domain.riskScore — Recorded Future Domain Risk Score
• RecordedFuture.Domain.riskLevel — Recorded Future Domain Risk Level
• RecordedFuture.Domain.Evidence.rule — Recorded Future Risk Rule Name
• RecordedFuture.Domain.Evidence.mitigation — Recorded Future Risk Rule Mitigation
• RecordedFuture.Domain.Evidence.description — Recorded Future Risk Rule description
• RecordedFuture.Domain.Evidence.timestamp — Recorded Future Risk Rule timestamp
• RecordedFuture.Domain.Evidence.level — Recorded Future Risk Rule Level
• RecordedFuture.Domain.Evidence.ruleid — Recorded Future Risk Rule ID
• RecordedFuture.Domain.name — Domain name
• RecordedFuture.Domain.maxRules — Maximum count of Recorded Future Domain Risk Rules
• RecordedFuture.Domain.ruleCount — Number of triggered Recorded Future Domain Risk Rules
• RecordedFuture.URL.riskScore — Recorded Future URL Risk Score
• RecordedFuture.URL.riskLevel — Recorded Future URL Risk Level
• RecordedFuture.URL.Evidence.rule — Recorded Future Risk Rule Name
• RecordedFuture.URL.Evidence.mitigation — Recorded Future Risk Rule Mitigation
• RecordedFuture.URL.Evidence.description — Recorded Future Risk Rule description
• RecordedFuture.URL.Evidence.timestamp — Recorded Future Risk Rule timestamp
• RecordedFuture.URL.Evidence.level — Recorded Future Risk Rule Level
• RecordedFuture.URL.Evidence.ruleid — Recorded Future Risk Rule ID
• RecordedFuture.URL.name — URL
• RecordedFuture.URL.maxRules — Maximum count of Recorded Future URL Risk Rules
• RecordedFuture.URL.ruleCount — Number of triggered Recorded Future URL Risk Rules