Domain Enrichment - Generic v2

id: Domain Enrichment - Generic v2
version: -1
fromversion: 5.0.0
name: Domain Enrichment - Generic v2
description: |-
  Enrich domains using one or more integrations.
  Domain enrichment includes:
  * Threat information
  * Domain reputation using !domain command
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3f6b8522-c653-4608-800d-f7da232392fb
    type: start
    task:
      id: 3f6b8522-c653-4608-800d-f7da232392fb
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    continueonerrortype: ""
    isautoswitchedtoquietmode: false
    isoversize: false
    quietmode: 0
    skipunavailable: false
  "16":
    id: "16"
    taskid: 86e8324e-34fa-4726-8cc0-2f61e6de5395
    type: condition
    task:
      id: 86e8324e-34fa-4726-8cc0-2f61e6de5395
      version: -1
      name: Is there a domain to enrich?
      description: Checks whether the playbook's input contains at least one domain name to enrich.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "33"
      - "32"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.Domain
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 530
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "24":
    id: "24"
    taskid: f6da103d-6baa-4afb-8b7d-65740714dcf2
    type: title
    task:
      id: f6da103d-6baa-4afb-8b7d-65740714dcf2
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 60,
          "y": 1235
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "29":
    id: "29"
    taskid: 7b77b6ff-906f-46cc-8e96-fd9d02778d63
    type: regular
    task:
      id: 7b77b6ff-906f-46cc-8e96-fd9d02778d63
      version: -1
      name: Get domain category
      description: Gets the category of the domain as found in Cisco Umbrella Investigation records.
      script: '|||umbrella-domain-categorization'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      domain:
        complex:
          root: inputs.Domain
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -200,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "30":
    id: "30"
    taskid: ec9764d9-3eea-44d8-8da7-538766ac0670
    type: condition
    task:
      id: ec9764d9-3eea-44d8-8da7-538766ac0670
      version: -1
      name: Is Cisco Umbrella Investigate enabled?
      description: Checks if there is an active instance of the Cisco Umbrella Investigate integration enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "29"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cisco Umbrella Investigate
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -200,
          "y": 855
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 230be3d0-b15b-446e-8e9e-5eaf8aa47c2b
    type: title
    task:
      id: 230be3d0-b15b-446e-8e9e-5eaf8aa47c2b
      version: -1
      name: Domain Reputation
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 1dd7328d-b062-4a7c-8b80-55acc42bb92b
    type: title
    task:
      id: 1dd7328d-b062-4a7c-8b80-55acc42bb92b
      version: -1
      name: Cisco Umbrella enrichment
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "30"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -200,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "34":
    id: "34"
    taskid: 5b429a1c-ec97-4f6a-877b-0e5dbff30e9f
    type: condition
    task:
      id: 5b429a1c-ec97-4f6a-877b-0e5dbff30e9f
      version: -1
      name: Should use !domain command?
      description: Check whether to run domain reputation command.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "24"
      "yes":
      - "35"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.UseReputationCommand
            iscontext: true
          right:
            value:
              simple: "True"
          ignorecase: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 855
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "35":
    id: "35"
    taskid: 6feef606-9d2b-4ce9-8aa7-024b49568b13
    type: regular
    task:
      id: 6feef606-9d2b-4ce9-8aa7-024b49568b13
      version: -1
      name: Check Reputation
      description: Checks the reputation of a domain.
      script: '|||domain'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      domain:
        complex:
          root: inputs.Domain
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 320,
          "y": 1060
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "16_24_#default#": 0.13,
      "30_24_#default#": 0.43,
      "30_29_yes": 0.5,
      "34_24_#default#": 0.41,
      "34_35_yes": 0.47
    },
    "paper": {
      "dimensions": {
        "height": 900,
        "width": 900,
        "x": -200,
        "y": 400
      }
    }
  }
inputs:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
      transformers:
      - operator: uniq
  required: false
  description: The domain name to enrich.
  playbookInputQuery:
- description: |-
    Define if you would like to use the !url command.
    Note: This input should be used whenever there is no auto-extract enabled in the investigation flow.
    Possible values: True / False.
  key: UseReputationCommand
  playbookInputQuery:
  required: true
  value:
    simple: "False"
outputs:
- contextPath: Domain
  description: The domain objects.
  type: string
- contextPath: DBotScore
  description: Indicator, Score, Type, and Vendor.
  type: string
- contextPath: Domain.Name
  description: Bad domain found.
  type: string
- contextPath: Domain.Malicious.Vendor
  description: For malicious domains, the vendor that made the decision.
  type: string
- contextPath: DBotScore.Indicator
  description: The indicator that was tested.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Score
  description: The actual DBot score.
  type: number
- contextPath: Domain.SecurityCategories
  description: The Umbrella security category, or categories, that match this domain
  type: string
- contextPath: Domain.ContentCategories
  description: The Umbrella content category or categories that match this domain
  type: string
- contextPath: Domain.Malicious.Description
  description: For malicious domains, the reason for the vendor to make the decision
  type: string
- contextPath: Domain.CreationDate
  description: The date on which the domain was created.
  type: string
- contextPath: Domain.DomainStatus
  description: The status of the domain.
  type: string
- contextPath: Domain.UpdatedDate
  description: The date on which the domain was last updated.
  type: string
- contextPath: Domain.ExpirationDate
  description: The expiration date of the domain.
  type: string
- contextPath: Domain.Umbrella.RiskScore
  description: The status will be "-1" if the domain is believed to be malicious, "1" if the domain is believed to be benign, "0" if it hasn't been classified yet.
  type: string
- contextPath: Domain.Umbrella.SecureRank 
  description: Suspicious rank for a domain that reviews based on the lookup behavior of client IP for the domain. Securerank is designed to identify hostnames requested by known infected clients but never requested by clean clients, assuming these domains are more likely to be bad. Scores returned range from -100 (suspicious) to 100 (benign). Note, this parameter is deprecated by the API, and will be equal to 0.
  type: string
- contextPath: Domain.Umbrella.FirstQueriedTime
  description: The time when the attribution for this Domain was made.
  type: string
- contextPath: Domain.Umbrella.ContentCategories
  description: The Umbrella content category or categories that match this domain. If none of them match, the return will be blank.
  type: string
- contextPath: Domain.Umbrella.MalwareCategories
  description: The Umbrella security category, or categories, that match this domain or that this domain is associated with. If none match, the return will be blank.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: Domain.Admin.Country
  description: The country of the domain administrator.
  type: string
- contextPath: Domain.Admin.Email
  description: The email address of the domain administrator.
  type: string
- contextPath: Domain.Admin.Name
  description: The name of the domain administrator.
  type: string
- contextPath: Domain.Admin.Phone
  description: The phone number of the domain administrator.
  type: string
- contextPath: Domain.Registrant.Country
  description: The country of the registrant.
  type: string
- contextPath: Domain.Registrant.Email
  description: The email address of the registrant.
  type: string
- contextPath: Domain.Registrant.Name
  description: The name of the registrant.
  type: string
- contextPath: Domain.Registrant.Phone
  description: The phone number of the registrant.
  type: string
- contextPath: Domain.Registrar.Name
  description: The name of the registrar, such as "GoDaddy".
  type: string
tests:
- Domain Enrichment - Generic v2 - Test
marketplaces:
- xsoar
- marketplacev2
- platform