ExtractDomainFromIOCDomainMatchRes

Extracts domain and its details from the Chronicle IOC Domain match response.

Type: python
Pack: GoogleChronicleBackstory

Source

import json
import traceback
from typing import Any

from CommonServerPython import *


def get_entry_context(json_res) -> dict[str, Any]:
    return {
        outputPaths["domain"]: {"Name": json_res["Artifact"]},
        "ChronicleIOCDomainMatches": {
            "Domain": json_res["Artifact"],
            "IOCIngestTime": json_res["IocIngestTime"],
            "FirstSeen": json_res["FirstAccessedTime"],
            "LastSeen": json_res["LastAccessedTime"],
        },
    }


def main() -> None:
    try:
        json_res = demisto.args().get("json_response", {})
        json_res = json.loads(json_res)

        ec = get_entry_context(json_res)
        demisto.results({"Type": entryTypes["note"], "EntryContext": ec, "Contents": {}, "ContentsFormat": formats["json"]})
    except Exception as e:
        demisto.error(traceback.format_exc())
        return_error(f"Error occurred while extracting Domain from IOC Domain Matches response:\n{e}")


# python2 uses __builtin__ python3 uses builtins
if __name__ == "__builtin__" or __name__ == "builtins":
    main()

README

Extracts domain and its details from the Chronicle IOC Domain match response.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
json_response	JSON response of IOC Domain Match

Outputs

Path	Description	Type
Domain.Name	The suspicious domain name recently observed in enterprise.	string
ChronicleIOCDomainMatches.Domain	The suspicious domain name recently observed in enterprise.	string
ChronicleIOCDomainMatches.IOCIngestTime	Time(UTC) the IOC was first seen by Chronicle.	date
ChronicleIOCDomainMatches.FirstSeen	Time(UTC) the artifact was first seen within your enterprise.	date
ChronicleIOCDomainMatches.LastSeen	Time(UTC) the artifact was most recently seen within your enterprise.	date

Script Example

!ExtractDomainFromIOCDomainMatchRes json_response="{\"Artifact\": \"e9428.b.akamaiedge.net\", \"IocIngestTime\": \"2020-07-17T20:00:00Z\", \"FirstAccessedTime\": \"2018-11-05T12:01:29Z\", \"LastAccessedTime\": \"2018-11-09T11:51:03Z\", \"Sources\": [{\"Category\": \"Observed serving executables\", \"IntRawConfidenceScore\": 0, \"NormalizedConfidenceScore\": \"Low\", \"RawSeverity\": \"Low\", \"Source\": \"ET Intelligence Rep List\"}]}"

Context Example

{
    "ChronicleIOCDomainMatches": {
        "Domain": "e9428.b.akamaiedge.net",
        "FirstSeen": "2018-11-05T12:01:29Z",
        "IOCIngestTime": "2020-07-17T20:00:00Z",
        "LastSeen": "2018-11-09T11:51:03Z"
    },
    "Domain": {
        "Name": "e9428.b.akamaiedge.net"
    }
}

Human Readable Output

{}