Recorded Future IP Reputation
IP address reputation using Recorded Future SOAR enrichment
- Pack
- RecordedFuture
- Tasks
- 7
Inputs
- IP — The IP address to get reputation of.
Outputs
- DBotScore.Indicator — The indicator that was tested
- DBotScore.Type — Indicator type
- DBotScore.Vendor — Vendor used to calculate the score
- DBotScore.Score — The actual score
- IP.Malicious.Vendor — For malicious IP addresses, the vendor that made the decision
- IP.Malicious.Description — For malicious IP addresses, the reason that the vendor made the decision
- IP.Address — IP address
- RecordedFuture.IP.riskScore — Recorded Future IP Risk Score
- RecordedFuture.IP.riskLevel — Recorded Future IP Risk Level
- RecordedFuture.IP.Evidence.rule — Recorded Future Risk Rule Name
- RecordedFuture.IP.Evidence.mitigation — Recorded Future Risk Rule Mitigation
- RecordedFuture.IP.Evidence.description — Recorded Future Risk Rule Description
- RecordedFuture.IP.Evidence.timestamp — Recorded Future Risk Rule Timestamp
- RecordedFuture.IP.Evidence.level — Recorded Future Risk Rule Level
- RecordedFuture.IP.Evidence.ruleid — Recorded Future Risk Rule ID
- RecordedFuture.IP.name — IP Address
- RecordedFuture.IP.maxRules — Maximum count of Recorded Future IP Risk Rules
- RecordedFuture.IP.ruleCount — Number of triggered Recorded Future IP Risk Rules
Commands used
- ip
- setIndicator