MaliciousRatioReputation

Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.

Type

python

Pack

CommonScripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def get_indicator_from_value(indicator_value):
    try:
        res = demisto.executeCommand("findIndicators", {"value": indicator_value})
        indicator = res[0]["Contents"][0]
        return indicator
    except Exception:
        pass


def get_indicator_result(indicator):
    res = demisto.executeCommand("maliciousRatio", {"value": indicator["value"]})

    mr_score = res[0]["Contents"][0]["maliciousRatio"]
    if mr_score > float(demisto.args()["threshold"]):  # noqa: RET503
        ec = {}
        ec["DBotScore"] = {
            "Type": indicator["indicator_type"].lower(),
            "Score": 2,  # suspicious
            "Vendor": "DBot-MaliciousRatio",
            "Indicator": indicator["value"],
        }
        entry = {
            "Type": entryTypes["note"],
            "EntryContext": ec,
            "Contents": ec["DBotScore"]["Score"],
            "ContentsFormat": formats["text"],
            "HumanReadable": f"Malicious ratio for {indicator['value']} is {mr_score}",
            "ReadableContentsFormat": formats["markdown"],
        }
        return entry


def main():
    indicator_value = demisto.args().get("input")
    indicator = get_indicator_from_value(indicator_value)
    if indicator:
        try:
            demisto.results(get_indicator_result(indicator))
        except Exception:
            pass


if __name__ == "__builtin__" or __name__ == "builtins":
    main()

README