IsMaliciousIndicatorFound

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.

Type
javascript
Pack
CommonScripts

Source

minScore = (args.includeSuspicious == 'yes') ? 2 : 3;

// Gather malicious indicators
files = dq(invContext, "DBotScore(val.Type.toLowerCase()=='file' && val.Score>=" + minScore + ")");
hashes = dq(invContext, "DBotScore(val.Type.toLowerCase()=='hash' && val.Score>=" + minScore + ")");
ips = dq(invContext, "DBotScore(val.Type.toLowerCase()=='ip' && val.Score>=" + minScore + ")");
urls = dq(invContext, "DBotScore(val.Type.toLowerCase()=='url' && val.Score>=" + minScore + ")");
domains = dq(invContext, "DBotScore(val.Type.toLowerCase()=='domain' && val.Score>=" + minScore + ")");
emails = dq(invContext, "DBotScore(val.Type.toLowerCase()=='email' && val.Score>=" + minScore + ")");

var filesIndicators = [];
for (var indicatorObject in files) {
    if (files[indicatorObject] && files[indicatorObject].Indicator && filesIndicators.indexOf(files[indicatorObject].Indicator) === -1) {
        filesIndicators.push(files[indicatorObject].Indicator);
    }
}
var hashesIndicators = [];
for (var indicatorObject in hashes) {
    if (hashes[indicatorObject] && hashes[indicatorObject].Indicator && hashesIndicators.indexOf(hashes[indicatorObject].Indicator) === -1) {
        hashesIndicators.push(hashes[indicatorObject].Indicator);
    }
}
var ipsIndicators = [];
for (var indicatorObject in ips) {
    if (ips[indicatorObject] && ips[indicatorObject].Indicator && ipsIndicators.indexOf(ips[indicatorObject].Indicator) === -1) {
        ipsIndicators.push(ips[indicatorObject].Indicator);
    }
}
var urlsIndicators = [];
for (var indicatorObject in urls) {
    if (urls[indicatorObject] && urls[indicatorObject].Indicator && urlsIndicators.indexOf(urls[indicatorObject].Indicator) === -1) {
        urlsIndicators.push(urls[indicatorObject].Indicator);
    }
}
var domainsIndicators = [];
for (var indicatorObject in domains) {
    if (domains[indicatorObject] && domains[indicatorObject].Indicator && domainsIndicators.indexOf(domains[indicatorObject].Indicator) === -1) {
        domainsIndicators.push(domains[indicatorObject].Indicator);
    }
}
var emailsIndicators = [];
for (var indicatorObject in emails) {
    if (emails[indicatorObject] && emails[indicatorObject].Indicator && emailsIndicators.indexOf(emails[indicatorObject].Indicator) === -1) {
        emailsIndicators.push(emails[indicatorObject].Indicator);
    }
}

// Unite into one array
maliciousIndicators = []
maliciousIndicators = maliciousIndicators.concat(filesIndicators);
maliciousIndicators = maliciousIndicators.concat(hashesIndicators);
maliciousIndicators = maliciousIndicators.concat(ipsIndicators);
maliciousIndicators = maliciousIndicators.concat(urlsIndicators);
maliciousIndicators = maliciousIndicators.concat(domainsIndicators);
maliciousIndicators = maliciousIndicators.concat(emailsIndicators);

// Remove Manually remidated indicators
if (args.includeManual == 'yes') {
    manualFiles = dq(invContext, "DBotScore(val.Type.toLowerCase()=='file' && val.Vendor=='Manual' && val.Score<" + minScore + ")");
    manualHashes = dq(invContext, "DBotScore(val.Type.toLowerCase()=='hash' && val.Vendor=='Manual' && val.Score<" + minScore + ")");
    manualIps = dq(invContext, "DBotScore(val.Type.toLowerCase()=='ip' && val.Vendor=='Manual' && val.Score<" + minScore + ")");
    manualUrls = dq(invContext, "DBotScore(val.Type.toLowerCase()=='url' && val.Vendor=='Manual' && val.Score<" + minScore + ")");
    manualDomains = dq(invContext, "DBotScore(val.Type.toLowerCase()=='domain' && val.Vendor=='Manual' && val.Score<" + minScore + ")");
    manualEmails = dq(invContext, "DBotScore(val.Type.toLowerCase()=='email' && val.Vendor=='Manual' && val.Score<" + minScore + ")");

    for (var indicatorObject in manualFiles) {
        if (manualFiles[indicatorObject] && maliciousIndicators.indexOf(manualFiles[indicatorObject].Indicator) !== -1) {
            maliciousIndicators.splice(maliciousIndicators.indexOf(manualFiles[indicatorObject].Indicator), 1);
        }
    }

    for (var indicatorObject in manualHashes) {
        if (manualHashes[indicatorObject] && maliciousIndicators.indexOf(manualHashes[indicatorObject].Indicator) !== -1) {
             maliciousIndicators.splice(maliciousIndicators.indexOf(manualHashes[indicatorObject].Indicator),1);
        }
    }
    for (var indicatorObject in manualIps) {
        if (manualIps[indicatorObject] && maliciousIndicators.indexOf(manualIps[indicatorObject].Indicator) !== -1) {
             maliciousIndicators.splice(maliciousIndicators.indexOf(manualIps[indicatorObject].Indicator),1);
        }
    }
    for (var indicatorObject in manualUrls) {
        if (manualUrls[indicatorObject] && maliciousIndicators.indexOf(manualUrls[indicatorObject].Indicator) !== -1) {
             maliciousIndicators.splice(maliciousIndicators.indexOf(manualUrls[indicatorObject].Indicator),1);
        }
    }
    for (var indicatorObject in manualDomains) {
        if (manualDomains[indicatorObject] && maliciousIndicators.indexOf(manualDomains[indicatorObject].Indicator) !== -1) {
             maliciousIndicators.splice(maliciousIndicators.indexOf(manualDomains[indicatorObject].Indicator),1);
        }
    }
    for (var indicatorObject in manualEmails) {
        if (manualEmails[indicatorObject] && maliciousIndicators.indexOf(manualEmails[indicatorObject].Indicator) !== -1) {
             maliciousIndicators.splice(maliciousIndicators.indexOf(manualEmails[indicatorObject].Indicator),1);
        }
    }
}

if (maliciousIndicators.length > 0)
    return 'yes';

if (args.queryIndicators == 'yes') {
    var query = "(reputation:Bad"
    if (args.includeSuspicious == 'yes') {
        query = query + " or reputation:Suspicious"
    }
    query = query + ")"

    if ((args.maliciousQueryOverride) && (args.maliciousQueryOverride.length > 0)) {
        query = args.maliciousQueryOverride
    }

    var indicatorsRes = executeCommand("findIndicators", {"query":query+" and investigationIDs:"+investigation.id,"size":1})
    if (indicatorsRes && indicatorsRes[0] && indicatorsRes[0].Contents[0]) {
        // we have results, so we found a maliciuos indicator for this investigation
        return 'yes'
    }
}

return 'no'

README

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). It will returns “yes” if at least one malicious indicator is found.

Script Data

Name Description
Script Type javascript
Tags Utility, Condition

Inputs

Argument Name Description
includeSuspicious Whether to check suspicious indicators. The default is “no”.
queryIndicators Queries all indicators in an investigation. This is relevant if it is running in a sub-playbook.
maliciousQueryOverride Whether to override the default query for malicious indicators in Cortex XSOAR (Indicators page).
includeManual Whether to check manually edited indicators. The default is “yes”.

Outputs

Path Description Type
yes Whether any malicious indicators were found in the investigation. Unknown
no Whether any malicious indicators were found in the investigation. Unknown