CreateHashIndicatorWrapper
This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.
python · Malware Core
Details
| ID | CreateHashIndicatorWrapper |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | basescript |
README
This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| hash | Array of SHA256 hashes. |
| action | The action to apply to the hash - allow or block. |
Outputs
| Path | Description | Type |
|---|---|---|
| MicrosoftATP.Indicators.id | Created by the system when the indicator is ingested. Generated GUID/unique identifier. | String |
| MicrosoftATP.Indicators.action | The action to apply if the indicator is matched within the targetProduct security tool. Possible values: “unknown”, “allow”, “block”, or “alert”. | String |
| MicrosoftATP.Indicators.additionalInformation | A catchall area where extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not utilized by the targetProduct security tool. | String |
| MicrosoftATP.Indicators.azureTenantId | Stamped by the system when the indicator is ingested. The Entra ID submitting client tenant ID. | String |
| MicrosoftATP.Indicators.confidence | An integer representing confidence the indicator data accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest. | Number |
| MicrosoftATP.Indicators.description | Brief description (100 characters or less) of the threat represented by the indicator. | String |
| MicrosoftATP.Indicators.diamondModel | The area of the Diamond Model in which this indicator exists. Possible values: “unknown”, “adversary”, “capability”, “infrastructure”, and “victim”. | String |
| MicrosoftATP.Indicators.domainName | Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain. | String |
| MicrosoftATP.Indicators.expirationDateTime | DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ‘2014-01-01T00:00:00Z’ | Date |
| MicrosoftATP.Indicators.externalId | An identification number that ties the indicator back to the indicator provider’s system (for example, a foreign key). | String |
| MicrosoftATP.Indicators.fileCompileDateTime | DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ‘2014-01-01T00:00:00Z’ | Date |
| MicrosoftATP.Indicators.fileCreatedDateTime | DateTime the file was created.The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ‘2014-01-01T00:00:00Z’ | Date |
| MicrosoftATP.Indicators.fileHashType | The type of hash stored in fileHashValue. Possible values: “unknown”, “sha1”, “sha256”, “md5”, “authenticodeHash256”, “lsHash”, and “ctph”. | String |
| MicrosoftATP.Indicators.fileHashValue | The file hash value. | String |
| MicrosoftATP.Indicators.fileMutexName | The Mutex name used in file-based detections. | String |
| MicrosoftATP.Indicators.fileName | The name of the file if the indicator is file-based. Multiple file names may be delimited by commas. | String |
| MicrosoftATP.Indicators.filePacker | The packer used to build the file in question. | String |
| MicrosoftATP.Indicators.filePath | The path of the file indicating a compromise. Can be a Windows or *nix style path. | String |
| MicrosoftATP.Indicators.fileSize | The size of the file in bytes. | Number |
| MicrosoftATP.Indicators.fileType | The text description of the type of file. For example, “Word Document” or “Binary”. | String |
| MicrosoftATP.Indicators.ingestedDateTime | The timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ‘2014-01-01T00:00:00Z’ | Date |
| MicrosoftATP.Indicators.isActive | Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system. | Boolean |
| MicrosoftATP.Indicators.knownFalsePositives | Scenarios in which the indicator may cause false positives. This should be human-readable text. | String |
| MicrosoftATP.Indicators.lastReportedDateTime | The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ‘2014-01-01T00:00:00Z’ | Date |
| MicrosoftATP.Indicators.networkCidrBlock | The CIDR Block notation representation of the network referenced in this indicator. Use only if the source and destination cannot be identified. | String |
| MicrosoftATP.Indicators.networkDestinationAsn | The destination autonomous system identifier of the network referenced in the indicator. | Number |
| MicrosoftATP.Indicators.networkDestinationCidrBlock | The CIDR Block notation representation of the destination network in this indicator. | String |
| MicrosoftATP.Indicators.networkDestinationIPv4 | The IPv4 IP address destination. | String |
| MicrosoftATP.Indicators.networkDestinationIPv6 | The IPv6 IP address destination. | String |
| MicrosoftATP.Indicators.networkDestinationPort | The TCP port destination. | Number |
| MicrosoftATP.Indicators.networkIPv4 | The IPv4 IP address. | String |
| MicrosoftATP.Indicators.networkIPv6 | The IPv6 IP address. | String |
| MicrosoftATP.Indicators.networkPort | The TCP port. | Number |
| MicrosoftATP.Indicators.networkProtocol | The decimal representation of the protocol field in the IPv4 header. | Number |
| MicrosoftATP.Indicators.networkSourceAsn | The source autonomous system identifier of the network referenced in the indicator. | Number |
| MicrosoftATP.Indicators.networkSourceCidrBlock | The CIDR Block notation representation of the source network in this indicator. | String |
| MicrosoftATP.Indicators.networkSourceIPv4 | The IPv4 IP address source. | String |
| MicrosoftATP.Indicators.networkSourceIPv6 | The IPv6 IP address source. | String |
| MicrosoftATP.Indicators.networkSourcePort | The TCP port source. | Number |
| MicrosoftATP.Indicators.passiveOnly | Determines if the indicator should trigger an event that is visible to an end-user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false. | Boolean |
| MicrosoftATP.Indicators.severity | An integer representing the severity of the malicious behavior identified by the data within the indicator. Possible values: “Informational”, “Low”, “MediumLow”, “MediumHigh”, and “High”, where High is the most severe and Informational is not severe at all. | Number |
| MicrosoftATP.Indicators.targetProduct | A string representing a single security product to which the indicator should be applied. | String |
| MicrosoftATP.Indicators.threatType | Each indicator must have a valid Indicator Threat Type. Possible values: “Botnet”, “C2”, “CryptoMining”, “Darknet”, “DDoS”, “MaliciousUrl”, “Malware”, “Phishing”, “Proxy”, “PUA”, and “WatchList”. | String |
| MicrosoftATP.Indicators.tlpLevel | Traffic Light Protocol value for the indicator. Possible values: “unknown”, “white”, “green”, “amber”, and “red”. | String |
| MicrosoftATP.Indicators.url | Uniform Resource Locator. This URL complies with RFC 1738. | String |
| MicrosoftATP.Indicators.userAgent | User-Agent string from a web request that could indicate compromise. | String |
| MicrosoftATP.Indicators.vendorInformation | Information about the vendor. | String |
| File.Name | The full file name (including file extension). | String |
| File.Size | The size of the file in bytes. | Number |
| File.MD5 | The MD5 hash of the file. | String |
| File.SHA1 | The SHA1 hash of the file. | String |
| File.SHA256 | The SHA256 hash of the file. | String |
| File.SHA512 | The SHA512 hash of the file. | String |
| File.Type | The file type, as determined by libmagic (same as displayed in file entries). | String |
| File.Path | The path where the file is located. | String |
| CrowdStrike.IOC.Type | The type of the IOC. | string |
| CrowdStrike.IOC.Value | The string representation of the indicator. | string |
| CrowdStrike.IOC.ID | The full ID of the indicator (type:value). | string |
| CrowdStrike.IOC.Policy | The policy of the indicator. | string |
| CrowdStrike.IOC.Source | The source of the IOC. | string |
| CrowdStrike.IOC.ShareLevel | The level at which the indicator will be shared. | string |
| CrowdStrike.IOC.Expiration | The datetime the indicator will expire. | string |
| CrowdStrike.IOC.Description | The description of the IOC. | string |
| CrowdStrike.IOC.CreatedTime | The datetime the IOC was created. | string |
| CrowdStrike.IOC.CreatedBy | The identity of the user/process who created the IOC. | string |
| CrowdStrike.IOC.ModifiedTime | The date and time the indicator was last modified. | string |
| CrowdStrike.IOC.ModifiedBy | The identity of the user/process who last updated the IOC. | string |
Script Examples
Example command
!CreateHashIndicatorWrapper action=block hash=9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a
Context Example
{
"PaloAltoNetworksXDR": {
"blackList": {
"fileHash": [
"9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a"
]
}
},
"CrowdStrike": {
"IOC": [
{
"Description": "Blacklisted based on XSOAR inc ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"ModifiedTime": "2022-03-27T09:58:22.418527196Z",
"Platforms": [
"linux",
"mac",
"windows"
],
"Value": "73c8c51f9084ec745ddb86c9f1a8da3281b6cf5276300e3df0e32ae44b76f63f",
"CreatedTime": "2022-03-09T09:58:04.151795968Z",
"ModifiedBy": "2bf188d347e44e08946f2e61ef590c24",
"CreatedBy": "2bf188d347e44e08946f2e61ef590c24",
"Action": "prevent",
"Type": "sha256",
"ID": "aa6ab986d7a9bf41d96e0140f373e2806d2d2b8a389eeff160d02d88b4229586",
"Severity": "high"
},
{
"Description": "Blacklisted based on XSOAR inc ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"ModifiedTime": "2022-03-27T09:58:22.83074978Z",
"Platforms": [
"linux",
"mac",
"windows"
],
"Value": "006a103a9f4b9b6273d55b16ba01a704ad3e4fad59f198a77e8b64177a1064ef",
"CreatedTime": "2022-03-09T09:58:03.608685951Z",
"ModifiedBy": "2bf188d347e44e08946f2e61ef590c24",
"CreatedBy": "2bf188d347e44e08946f2e61ef590c24",
"Action": "prevent",
"Type": "sha256",
"ID": "5e6bf43f5de8b64e3d6f37177171d7edceed67d6bcac06a953c3d369151f6f39",
"Severity": "high"
},
{
"Description": "Blacklisted based on XSOAR inc ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"ModifiedTime": "2022-03-27T10:00:24.023778625Z",
"Platforms": [
"linux",
"mac",
"windows"
],
"Value": "9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a",
"CreatedTime": "2022-03-27T10:00:24.023778625Z",
"ModifiedBy": "2bf188d347e44e08946f2e61ef590c24",
"CreatedBy": "2bf188d347e44e08946f2e61ef590c24",
"Action": "prevent",
"Type": "sha256",
"ID": "aaad9ddaf078c49f1d728fb0082a85efa6a9f413106ecca87f5dbdf33626178a",
"Severity": "high"
}
]
},
"DBotScore": [
{
"Vendor": "Microsoft Defender Advanced Threat Protection",
"Indicator": "006a103a9f4b9b6273d55b16ba01a704ad3e4fad59f198a77e8b64177a1064ef",
"Score": 0,
"Type": "file"
},
{
"Vendor": "Microsoft Defender Advanced Threat Protection",
"Indicator": "73c8c51f9084ec745ddb86c9f1a8da3281b6cf5276300e3df0e32ae44b76f63f",
"Score": 0,
"Type": "file"
},
{
"Vendor": "Microsoft Defender Advanced Threat Protection",
"Indicator": "9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a",
"Score": 0,
"Type": "file"
}
],
"File": [
{
"SHA256": "006a103a9f4b9b6273d55b16ba01a704ad3e4fad59f198a77e8b64177a1064ef"
},
{
"SHA256": "73c8c51f9084ec745ddb86c9f1a8da3281b6cf5276300e3df0e32ae44b76f63f"
},
{
"SHA256": "9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a"
}
],
"MicrosoftATP": {
"Indicators": [
{
"mitreTechniques": [],
"description": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"historicalDetection": false,
"title": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"creationTimeDateTimeUtc": "2022-03-27T09:58:21.8200142Z",
"generateAlert": true,
"rbacGroupIds": [],
"@^^^odata.context^^^": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators/$entity",
"createdBySource": "PublicApi",
"rbacGroupNames": [],
"indicatorValue": "006a103a9f4b9b6273d55b16ba01a704ad3e4fad59f198a77e8b64177a1064ef",
"indicatorType": "FileSha256",
"createdBy": "2f48b784-5da5-4e61-9957-012d2630f1e4",
"lastUpdateTime": "2022-03-27T09:58:21.8292459Z",
"action": "BlockAndRemediate",
"expirationTime": "2022-04-10T09:58:21Z",
"id": "5299",
"createdByDisplayName": "MS Graph ATP DEV",
"severity": "Informational"
},
{
"mitreTechniques": [],
"description": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"historicalDetection": false,
"title": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"creationTimeDateTimeUtc": "2022-03-27T09:58:22.071616Z",
"generateAlert": true,
"rbacGroupIds": [],
"@^^^odata.context^^^": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators/$entity",
"createdBySource": "PublicApi",
"rbacGroupNames": [],
"indicatorValue": "73c8c51f9084ec745ddb86c9f1a8da3281b6cf5276300e3df0e32ae44b76f63f",
"indicatorType": "FileSha256",
"createdBy": "2f48b784-5da5-4e61-9957-012d2630f1e4",
"lastUpdateTime": "2022-03-27T09:58:22.079299Z",
"action": "BlockAndRemediate",
"expirationTime": "2022-04-10T09:58:21Z",
"id": "5300",
"createdByDisplayName": "MS Graph ATP DEV",
"severity": "Informational"
},
{
"mitreTechniques": [],
"description": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"historicalDetection": false,
"title": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116",
"creationTimeDateTimeUtc": "2022-03-27T10:00:23.6840683Z",
"generateAlert": true,
"rbacGroupIds": [],
"@^^^odata.context^^^": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators/$entity",
"createdBySource": "PublicApi",
"rbacGroupNames": [],
"indicatorValue": "9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a",
"indicatorType": "FileSha256",
"createdBy": "2f48b784-5da5-4e61-9957-012d2630f1e4",
"lastUpdateTime": "2022-03-27T10:00:23.6924233Z",
"action": "BlockAndRemediate",
"expirationTime": "2022-04-10T10:00:23Z",
"id": "5301",
"createdByDisplayName": "MS Graph ATP DEV",
"severity": "Informational"
}
]
}
}
Human Readable Output
Results Summary
| Instance | Command | Result | Comment |
|---|---|---|---|
| Cortex XDR - IR: Cortex XDR - IR_instance_1_copy | command: xdr-blacklist-files args: hash_list: 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a |
Success | |
| Cortex XDR - IR: Cortex XDR - IR_instance_1 | command: xdr-blacklist-files args: hash_list: 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a |
Success | |
| Microsoft Defender Advanced Threat Protection: Microsoft Defender Advanced Threat Protection_instance_1 | command: microsoft-atp-sc-indicator-create args: indicator_value: 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a indicator_type: FileSha256 action: AlertAndBlock indicator_description: XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116 indicator_title: XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116 |
Success | |
| CrowdstrikeFalcon: CrowdstrikeFalcon_instance_1 | command: cs-falcon-upload-custom-ioc args: ioc_type: sha256 platforms: linux,mac,windows applied_globally: true value: 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a action: prevent description: Blacklisted based on XSOAR inc ab57e22c-ad03-4aba-8b6c-b42bd895a116 severity: high |
Success |
Blacklist Files
| File Hash |
|---|
| 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a |
Indicator 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a was updated successfully
| id | action | indicatorValue | indicatorType | severity | title | description |
|---|---|---|---|---|---|---|
| 5301 | BlockAndRemediate | 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a | FileSha256 | Informational | XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116 | XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116 |
Custom IOC 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a was created successfully
| Action | CreatedBy | CreatedTime | Description | ID | ModifiedBy | ModifiedTime | Platforms | Severity | Type | Value |
|---|---|---|---|---|---|---|---|---|---|---|
| prevent | 2bf188d347e44e08946f2e61ef590c24 | 2022-03-27T10:00:24.023778625Z | Blacklisted based on XSOAR inc ab57e22c-ad03-4aba-8b6c-b42bd895a116 | aaad9ddaf078c49f1d728fb0082a85efa6a9f413106ecca87f5dbdf33626178a | 2bf188d347e44e08946f2e61ef590c24 | 2022-03-27T10:00:24.023778625Z | linux, mac, windows |
high | sha256 | 9310daf6d10f4fbfaf390e74bcf1c4d9acc023d7db3e26030f8772528572a22a |
args: - description: 'Array of SHA256 hashes.' isArray: true name: hash required: true - description: 'The action to apply to the hash - allow or block.' name: action required: true auto: PREDEFINED predefined: - 'allow' - 'block' comment: 'This is a wrapper to allow or block hash lists from Cortex XDR, MSDE or CrowdStrike.' commonfields: id: CreateHashIndicatorWrapper version: -1 name: CreateHashIndicatorWrapper outputs: # MSDE outputs - contextPath: MicrosoftATP.Indicators.id description: Created by the system when the indicator is ingested. Generated GUID/unique identifier. type: String - contextPath: MicrosoftATP.Indicators.action description: 'The action to apply if the indicator is matched within the targetProduct security tool. Possible values: "unknown", "allow", "block", or "alert".' type: String - contextPath: MicrosoftATP.Indicators.additionalInformation description: A catchall area where extra data from the indicator not covered by the other indicator properties may be placed. Data placed into additionalInformation is typically not utilized by the targetProduct security tool. type: String - contextPath: MicrosoftATP.Indicators.azureTenantId description: Stamped by the system when the indicator is ingested. The Entra ID submitting client tenant ID. type: String - contextPath: MicrosoftATP.Indicators.confidence description: An integer representing confidence the indicator data accurately identifies malicious behavior. Possible values are 0 – 100, with 100 being the highest. type: Number - contextPath: MicrosoftATP.Indicators.description description: Brief description (100 characters or less) of the threat represented by the indicator. type: String - contextPath: MicrosoftATP.Indicators.diamondModel description: 'The area of the Diamond Model in which this indicator exists. Possible values: "unknown", "adversary", "capability", "infrastructure", and "victim".' type: String - contextPath: MicrosoftATP.Indicators.domainName description: Domain name associated with this indicator. Should be in the format subdomain.domain.topleveldomain. type: String - contextPath: MicrosoftATP.Indicators.expirationDateTime description: 'DateTime string indicating when the indicator expires. To avoid stale indicators persisting in the system, all indicators must have an expiration date. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ''2014-01-01T00:00:00Z''.' type: Date - contextPath: MicrosoftATP.Indicators.externalId description: An identification number that ties the indicator back to the indicator provider’s system (for example, a foreign key). type: String - contextPath: MicrosoftATP.Indicators.fileCompileDateTime description: 'DateTime the file was compiled. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ''2014-01-01T00:00:00Z''.' type: Date - contextPath: MicrosoftATP.Indicators.fileCreatedDateTime description: 'DateTime the file was created.The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ''2014-01-01T00:00:00Z''.' type: Date - contextPath: MicrosoftATP.Indicators.fileHashType description: 'The type of hash stored in fileHashValue. Possible values: "unknown", "sha1", "sha256", "md5", "authenticodeHash256", "lsHash", and "ctph".' type: String - contextPath: MicrosoftATP.Indicators.fileHashValue description: The file hash value. type: String - contextPath: MicrosoftATP.Indicators.fileMutexName description: The Mutex name used in file-based detections. type: String - contextPath: MicrosoftATP.Indicators.fileName description: The name of the file if the indicator is file-based. Multiple file names may be delimited by commas. type: String - contextPath: MicrosoftATP.Indicators.filePacker description: The packer used to build the file in question. type: String - contextPath: MicrosoftATP.Indicators.filePath description: The path of the file indicating a compromise. Can be a Windows or *nix style path. type: String - contextPath: MicrosoftATP.Indicators.fileSize description: The size of the file in bytes. type: Number - contextPath: MicrosoftATP.Indicators.fileType description: The text description of the type of file. For example, “Word Document” or “Binary”. type: String - contextPath: MicrosoftATP.Indicators.ingestedDateTime description: 'The timestamp the indicator was ingested into the system. The Timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ''2014-01-01T00:00:00Z''.' type: Date - contextPath: MicrosoftATP.Indicators.isActive description: Used to deactivate indicators within the system. By default, any indicator submitted is set as active. However, providers may submit existing indicators with this set to ‘False’ to deactivate indicators in the system. type: Boolean - contextPath: MicrosoftATP.Indicators.knownFalsePositives description: Scenarios in which the indicator may cause false positives. This should be human-readable text. type: String - contextPath: MicrosoftATP.Indicators.lastReportedDateTime description: 'The last time the indicator was seen. The timestamp type represents date and time information in ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 looks like: ''2014-01-01T00:00:00Z''.' type: Date - contextPath: MicrosoftATP.Indicators.networkCidrBlock description: The CIDR Block notation representation of the network referenced in this indicator. Use only if the source and destination cannot be identified. type: String - contextPath: MicrosoftATP.Indicators.networkDestinationAsn description: The destination autonomous system identifier of the network referenced in the indicator. type: Number - contextPath: MicrosoftATP.Indicators.networkDestinationCidrBlock description: The CIDR Block notation representation of the destination network in this indicator. type: String - contextPath: MicrosoftATP.Indicators.networkDestinationIPv4 description: The IPv4 IP address destination. type: String - contextPath: MicrosoftATP.Indicators.networkDestinationIPv6 description: The IPv6 IP address destination. type: String - contextPath: MicrosoftATP.Indicators.networkDestinationPort description: The TCP port destination. type: Number - contextPath: MicrosoftATP.Indicators.networkIPv4 description: The IPv4 IP address. type: String - contextPath: MicrosoftATP.Indicators.networkIPv6 description: The IPv6 IP address. type: String - contextPath: MicrosoftATP.Indicators.networkPort description: The TCP port. type: Number - contextPath: MicrosoftATP.Indicators.networkProtocol description: The decimal representation of the protocol field in the IPv4 header. type: Number - contextPath: MicrosoftATP.Indicators.networkSourceAsn description: The source autonomous system identifier of the network referenced in the indicator. type: Number - contextPath: MicrosoftATP.Indicators.networkSourceCidrBlock description: The CIDR Block notation representation of the source network in this indicator. type: String - contextPath: MicrosoftATP.Indicators.networkSourceIPv4 description: The IPv4 IP address source. type: String - contextPath: MicrosoftATP.Indicators.networkSourceIPv6 description: The IPv6 IP address source. type: String - contextPath: MicrosoftATP.Indicators.networkSourcePort description: The TCP port source. type: Number - contextPath: MicrosoftATP.Indicators.passiveOnly description: Determines if the indicator should trigger an event that is visible to an end-user. When set to ‘true,’ security tools do not notify the end user that a ‘hit’ has occurred. This is most often treated as audit or silent mode by security products where they simply log that a match occurred but do not perform the action. Default value is false. type: Boolean - contextPath: MicrosoftATP.Indicators.severity description: 'An integer representing the severity of the malicious behavior identified by the data within the indicator. Possible values: "Informational", "Low", "MediumLow", "MediumHigh", and "High", where High is the most severe and Informational is not severe at all.' type: Number - contextPath: MicrosoftATP.Indicators.targetProduct description: A string representing a single security product to which the indicator should be applied. type: String - contextPath: MicrosoftATP.Indicators.threatType description: 'Each indicator must have a valid Indicator Threat Type. Possible values: "Botnet", "C2", "CryptoMining", "Darknet", "DDoS", "MaliciousUrl", "Malware", "Phishing", "Proxy", "PUA", and "WatchList".' type: String - contextPath: MicrosoftATP.Indicators.tlpLevel description: 'Traffic Light Protocol value for the indicator. Possible values: "unknown", "white", "green", "amber", and "red".' type: String - contextPath: MicrosoftATP.Indicators.url description: Uniform Resource Locator. This URL complies with RFC 1738. type: String - contextPath: MicrosoftATP.Indicators.userAgent description: User-Agent string from a web request that could indicate compromise. type: String - contextPath: MicrosoftATP.Indicators.vendorInformation description: Information about the vendor. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: File.Path description: The path where the file is located. type: String # XDR outputs # CrowdStrike outputs - contextPath: CrowdStrike.IOC.Type description: The type of the IOC. type: string - contextPath: CrowdStrike.IOC.Value description: The string representation of the indicator. type: string - contextPath: CrowdStrike.IOC.ID description: The full ID of the indicator (type:value). type: string - contextPath: CrowdStrike.IOC.Policy description: The policy of the indicator. type: string - contextPath: CrowdStrike.IOC.Source description: The source of the IOC. type: string - contextPath: CrowdStrike.IOC.ShareLevel description: The level at which the indicator will be shared. type: string - contextPath: CrowdStrike.IOC.Expiration description: The datetime the indicator will expire. type: string - contextPath: CrowdStrike.IOC.Description description: The description of the IOC. type: string - contextPath: CrowdStrike.IOC.CreatedTime description: The datetime the IOC was created. type: string - contextPath: CrowdStrike.IOC.CreatedBy description: The identity of the user/process who created the IOC. type: string - contextPath: CrowdStrike.IOC.ModifiedTime description: The date and time the indicator was last modified. type: string - contextPath: CrowdStrike.IOC.ModifiedBy description: The identity of the user/process who last updated the IOC. type: string script: '-' tags: - basescript timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 fromversion: 6.0.0 tests: - No tests (auto formatted)