URL Enrichment - Generic v2

Enrich URLs using one or more integrations. URL enrichment includes: * SSL verification for URLs. * Threat information. * Providing of URL screenshots. * URL Reputation using !url.

Pack

CommonPlaybooks

Tasks

14

Inputs

• URL — The URLs to enrich.
• Rasterize — Define if you would like the system take safe screenshots of input URLs. Possible values: True / False. The default value is true.
• VerifyURL — Define if you would like the system perform SSL certificate verification on the URLs. Possible values: True / False. The default value is false.
• UseReputationCommand — Define if you would like to use the !url command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.

Outputs

• URL — The URL object.
• URL.Data — The enriched URL.
• DBotScore — The DBotScore object.
• URL.Malicious — Whether the detected URL was malicious.
• URL.Malicious.Vendor — For malicious URLs, the vendor that made the decision.
• URL.Malicious.Description — For malicious URLs, the reason that the vendor made the decision.
• DBotScore.Indicator — The indicator.
• DBotScore.Type — The indicator's type.
• DBotScore.Vendor — The reputation vendor.
• DBotScore.Score — The reputation score.
• DBotScore.Reliability — Reliability of the source providing the intelligence data.
• URL.Relationships.EntityA — The source of the relationship.
• URL.Relationships.EntityB — The destination of the relationship.
• URL.Relationships.Relationship — The name of the relationship.
• URL.Relationships.EntityAType — The type of the source of the relationship.
• URL.Relationships.EntityBType — The type of the destination of the relationship.
• InfoFile.EntryID — The EntryID of the image/pdf file.
• InfoFile.Extension — The extension of the image/pdf file.
• InfoFile.Name — The name of the image/pdf file.
• InfoFile.Info — The info of the image/pdf file.
• InfoFile.Size — The size of the image/pdf file.
• InfoFile.Type — The type of the image/pdf file.

Commands used

• rasterize
• url