Reputation Commands

163 integrations implement generic reputation commands.

These are the standard Cortex reputation commands (ip, domain, url, file, email, cve) that integrations can implement to enrich indicators. The matrix below shows which integrations implement each command.

Download CSV
Integration Pack !ip !domain !url !file !email !cve Total
6437c006-1d86-4cdc-89d5-23305f207e3a PhishUp ✓ 1
ACTI Indicator Query Accenture CTI v2 ✓ ✓ ✓ 3
AMPv2 Cisco AMP ✓ 1
ANY.RUN TI Lookup ANY.RUN ✓ ✓ ✓ ✓ 4
APIVoid APIVoid ✓ ✓ ✓ 3
AbuseIPDB AbuseIPDB ✓ 1
Alexa Rank Indicator Deprecated Alexa Rank Indicator (Deprecated) ✓ 1
Alexa Rank Indicator v2 Deprecated Alexa Rank Indicator (Deprecated) ✓ 1
AlienVault OTX v2 AlienVault OTX ✓ ✓ ✓ ✓ 4
Analyst1 Analyst1 ✓ ✓ ✓ ✓ ✓ 5
Anomali Enterprise Anomali Enterprise ✓ 1
Anomali ThreatStream Deprecated Anomali ThreatStream ✓ ✓ ✓ 3
Anomali ThreatStream v2 Deprecated Anomali ThreatStream ✓ ✓ ✓ ✓ 4
Anomali ThreatStream v3 Anomali ThreatStream ✓ ✓ ✓ ✓ 4
AutoFocus V2 Deprecated AutoFocus by Palo Alto Networks ✓ ✓ ✓ ✓ 4
Autofocus Deprecated AutoFocus by Palo Alto Networks ✓ 1
Awake Security Awake Security ✓ ✓ ✓ 3
Barracuda Reputation Block List - BRBL Barracuda ✓ 1
BotDefender PerimeterX ✓ 1
BrandefenseDRPS Brandefense Digital Risk Protection Services ✓ ✓ ✓ ✓ 4
CIRCL CVE Search CIRCL ✓ 1
CIRCLEHashlookup CIRCL hashlookup (hashlookup.circl.lu) ✓ 1
CSCDomainManager CSCDomainManager ✓ 1
CTIX Deprecated Cyware Intel Exchange ✓ ✓ ✓ ✓ 4
CTIX v3 Cyware Intel Exchange ✓ ✓ ✓ ✓ ✓ 5
CVE Search v2 Deprecated CVE Search (Deprecated) ✓ 1
CensysV2 Censys ✓ ✓ 2
CheckPhish CheckPhish ✓ 1
CheckPointSandBlast Check Point Threat Emulation (SandBlast) ✓ 1
Cisco Umbrella Investigate Cisco Umbrella Investigate ✓ 1
CiscoAMP Deprecated Cisco AMP (Deprecated) ✓ 1
Cofense Intelligence Deprecated Cofense Intelligence (Deprecated) ✓ ✓ ✓ ✓ 4
CofenseIntelligenceV2 Cofense Intelligence v2 ✓ ✓ ✓ ✓ ✓ 5
Cortex Xpanse Cortex Xpanse ✓ ✓ 2
CrowdSec CrowdSec ✓ 1
CrowdStrike Falcon Intel v2 CrowdStrike Falcon Intel ✓ ✓ ✓ ✓ 4
CrowdStrike Falcon Sandbox V2 CrowdStrike Falcon Sandbox ✓ 1
CrowdStrike Falcon X CrowdStrike Falcon Intelligence Sandbox ✓ 1
CrowdStrikeMalquery CrowdStrike Malquery ✓ 1
CrowdstrikeFalcon CrowdStrike Falcon ✓ 1
CyberTotal CyberTotal ✓ ✓ ✓ ✓ 4
Cymon Deprecated Deprecated Content (Deprecated) ✓ ✓ 2
Darkmon Darkmon ✓ ✓ ✓ ✓ ✓ 5
DeHashed DeHashed ✓ 1
DomainTools Deprecated DomainTools Enterprise (Deprecated) ✓ 1
DomainTools Iris DomainTools Iris Investigate ✓ 1
EclecticIQ Intelligence Center v3 EclecticIQ Platform ✓ ✓ ✓ ✓ ✓ 5
EclecticIQ Platform Deprecated EclecticIQ Platform ✓ ✓ ✓ ✓ ✓ 5
Email Hippo Email Hippo ✓ ✓ 2
EmailRepIO EmailRepIO ✓ 1
Expanse Deprecated Expanse (Deprecated) ✓ ✓ 2
ExpanseV2 Deprecated Cortex Xpanse by Palo Alto Networks (Deprecated) ✓ ✓ 2
FalconIntel Deprecated CrowdStrike Falcon Intel ✓ ✓ ✓ ✓ 4
FireEye iSIGHT FireEye iSIGHT ✓ ✓ ✓ 3
Flashpoint Deprecated Flashpoint ✓ ✓ ✓ ✓ ✓ 5
FortiSandboxv2 FortiSandbox ✓ ✓ 2
Google Chronicle Backstory Google SecOps ✓ ✓ 2
Google Safe Browsing v2 Google Safe Browsing ✓ 1
GoogleSafeBrowsing Deprecated Google Safe Browsing ✓ 1
GoogleSecOps Google SecOps ✓ ✓ 2
GoogleThreatIntelligence GoogleThreatIntelligence ✓ ✓ ✓ ✓ ✓ 5
GreyNoise GreyNoise ✓ ✓ 2
GreyNoise Community GreyNoise ✓ 1
Group-IB TDS Polygon Polygon ✓ 1
Group-IB Threat Intelligence & Attribution Group-IB Threat Intelligence ✓ ✓ ✓ 3
Have I Been Pwned? V2 Pwned ✓ ✓ 2
HelloWorld HelloWorld ✓ 1
HelloWorldV2 HelloWorld ✓ 1
HostIo HostIo ✓ 1
Hudsonrock Hudsonrock ✓ ✓ 2
IP-API IP-API ✓ 1
IP2LocationIO IP2LocationIO ✓ 1
IPQualityScore IPQualityScore (IPQS) Threat Risk Scoring ✓ ✓ ✓ 3
Ignite Flashpoint ✓ ✓ ✓ ✓ ✓ ✓ 6
InfobloxBloxOneThreatDefense Infoblox Threat Defense with DDI ✓ ✓ ✓ 3
Ipstack Ipstack ✓ 1
IsItPhishing IsItPhishing ✓ 1
JoeSecurityV2 Joe Security ✓ ✓ 2
LastInfoSec LastInfoSec ✓ ✓ ✓ 3
Lastline v2 Lastline ✓ 1
MISP V2 Deprecated MISP ✓ ✓ ✓ 3
MISP V3 MISP ✓ ✓ ✓ ✓ ✓ 5
Maltiverse Maltiverse ✓ ✓ ✓ ✓ 4
MalwareBazaar MalwareBazaar ✓ 1
Mandiant Mandiant Advantage Threat Intelligence ✓ ✓ ✓ ✓ ✓ 5
Mandiant Advantage Threat Intelligence Mandiant Advantage Threat Intelligence ✓ ✓ ✓ ✓ ✓ 5
MaxMind GeoIP2 MaxMind GeoIP2 ✓ 1
McAfee Threat Intelligence Exchange Deprecated McAfee Threat Intelligence Exchange ✓ 1
McAfee Threat Intelligence Exchange V2 McAfee Threat Intelligence Exchange ✓ 1
Microsoft Defender Advanced Threat Protection Microsoft Defender for Endpoint ✓ 1
OpenCVE OpenCVE ✓ 1
OpenPhish Deprecated OpenPhish ✓ 1
OpenPhish_v2 OpenPhish ✓ 1
Palo Alto Minemeld Deprecated Deprecated Content (Deprecated) ✓ ✓ ✓ ✓ 4
Palo Alto Networks Threat Vault Deprecated Threat Vault by Palo Alto Networks ✓ ✓ 2
Palo Alto Networks Threat Vault v2 Threat Vault by Palo Alto Networks ✓ ✓ ✓ 3
PaloAltoNetworks_PrismaCloudCompute Prisma Cloud Compute by Palo Alto Networks ✓ 1
Panorama PAN-OS by Palo Alto Networks ✓ 1
PassiveTotal Deprecated PassiveTotal ✓ ✓ ✓ 3
PassiveTotal v2 PassiveTotal ✓ ✓ 2
PhishTank Deprecated PhishTank ✓ 1
PhishTank V2 PhishTank ✓ 1
Pipl Pipl ✓ 1
PolySwarm Deprecated PolySwarm ✓ ✓ ✓ ✓ 4
PolySwarmV2 PolySwarm ✓ ✓ ✓ ✓ 4
Pulsedive Pulsedive ✓ ✓ ✓ 3
QintelPMI Qintel ✓ 1
QintelQSentry Qintel ✓ 1
RDAP RDAP ✓ ✓ 2
RST Cloud - Threat Feed API RST Threat Feed ✓ ✓ ✓ ✓ 4
Recorded Future Deprecated Recorded Future (Deprecated) ✓ ✓ ✓ ✓ 4
Recorded Future v2 Recorded Future Intelligence ✓ ✓ ✓ ✓ ✓ 5
ReversingLabs A1000 Deprecated ReversingLabs A1000 ✓ 1
ReversingLabs Titanium Cloud Deprecated ReversingLabs TitaniumCloud ✓ 1
ReversingLabs TitaniumCloud v2 ReversingLabs TitaniumCloud ✓ ✓ ✓ ✓ 4
RubrikPolaris Rubrik Security Cloud ✓ ✓ 2
SEKOIAIntelligenceCenter SEKOIAIntelligenceCenter ✓ ✓ ✓ ✓ ✓ 5
SOCRadarIoCEnrichment SOCRadar ✓ ✓ ✓ ✓ 4
SOCRadarRapidReputation SOCRadar ✓ ✓ ✓ ✓ 4
SOCRadarThreatFusion SOCRadar ✓ ✓ ✓ 3
SecurityTrails SecurityTrails ✓ 1
Shodan_v2 Shodan ✓ 1
Sixgill_Darkfeed_Enrichment Sixgill Darkfeed - Annual Subscription ✓ ✓ ✓ ✓ 4
SlashNext Phishing Incident Response Deprecated SlashNext Phishing Incident Response - Annual Subscription (Direct Subscription) (Deprecated) ✓ ✓ ✓ 3
Spamcop Spamcop ✓ 1
SpurContextAPI Spur Context API ✓ 1
Symantec Deepsight Intelligence Deprecated Accenture Deepsight Intelligence (Deprecated) ✓ ✓ ✓ ✓ 4
SymantecEDR Symantec Endpoint Detection and Response ✓ 1
SymantecICDM SymantecICDM ✓ ✓ ✓ ✓ 4
Synapse Synapse ✓ ✓ ✓ ✓ 4
Team Cymru Scout Team Cymru ✓ 1
TeamCymru Team Cymru ✓ 1
ThreatConnect Deprecated ThreatConnect ✓ ✓ ✓ ✓ 4
ThreatConnect v2 Deprecated ThreatConnect ✓ ✓ ✓ ✓ 4
ThreatConnect v3 ThreatConnect ✓ ✓ ✓ ✓ 4
ThreatCrowd_v2 Deprecated Threat Crowd (Deprecated) ✓ ✓ ✓ ✓ 4
ThreatExchange Deprecated ThreatExchange ✓ ✓ ✓ ✓ 4
ThreatExchange v2 ThreatExchange ✓ ✓ ✓ ✓ 4
ThreatGridv2 Cisco Secure Malware Analytics ✓ ✓ ✓ ✓ 4
ThreatMiner ThreatMiner ✓ ✓ ✓ 3
ThreatQ v2 ThreatQ ✓ ✓ ✓ ✓ ✓ 5
ThreatQ_Beta Deprecated ThreatQ ✓ ✓ ✓ 3
TruSTAR Deprecated TruSTAR (Deprecated) ✓ ✓ ✓ ✓ 4
URLhaus URLhaus ✓ ✓ ✓ 3
Unit 42 Intelligence Unit 42 Threat Intelligence by Palo Alto Networks ✓ ✓ ✓ ✓ 4
VirusTotal Deprecated VirusTotal ✓ ✓ ✓ ✓ 4
VirusTotal (API v3) VirusTotal ✓ ✓ ✓ ✓ 4
VulnDB VulnDB ✓ 1
Whois Whois ✓ ✓ 2
WildFire-v2 WildFire by Palo Alto Networks ✓ 1
XFE Deprecated IBM X-Force Exchange ✓ ✓ ✓ ✓ 4
XFE_v2 IBM X-Force Exchange ✓ ✓ ✓ ✓ 4
Zimperium Zimperium ✓ 1
Zscaler Zscaler Internet Access ✓ ✓ ✓ 3
ZscalerZIdentity Zscaler Internet Access ✓ ✓ ✓ 3
iDefense Deprecated Accenture CTI (Deprecated) ✓ ✓ ✓ 3
iDefense_v2 Deprecated Accenture CTI (Deprecated) ✓ ✓ ✓ 3
iboss iboss ✓ ✓ ✓ 3
illuminate Deprecated Analyst1 ✓ ✓ ✓ ✓ ✓ 5
ipinfo Deprecated Ipinfo ✓ 1
ipinfo_v2 Ipinfo ✓ 1
rapid7_threat_command Rapid7 - Threat Command (IntSights) ✓ ✓ ✓ ✓ 4
urlscan.io URLScan.io ✓ 1
Total implementations 108 94 82 86 21 15