domain-enrichment
Enriches Domain indicators with reputation data from multiple integrations and outputs a consolidated DomainEnrichment object. This script exclusively supports indicators of type Domain and will automatically create the indicator in TIM if it is not already exists.
python · Aggregated Scripts
Details
| ID | domain-enrichment |
|---|---|
| Language | python |
| From Version | 8.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Tags | basescript |
README
Enriches Domain indicators with reputation data from multiple integrations and outputs a consolidated DomainEnrichment object. This script exclusively supports indicators of type Domain and will automatically create the indicator in TIM if it is not already exists.
Note: This script is supported in Cortex XSOAR 8.0 and later, and in Cortex XSIAM.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 8.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| domain_list | Accepts a list of domains to enrich. - From CLI: Provide a comma-separated list. If a Domain contains a comma, wrap the domains in a JSON array. Example: “[\“example.com/search:yellow,red\”, \“example2.com\”]”. - From Context: Pass JSON arrays directly, without modification. |
| external_enrichment | Whether to call external integrations for enrichment: - ‘true’: enrich using enabled external integrations (e.g., VirusTotal (API v3), AlienVault OTX v2) and run internal commands. - ‘false’: use only existing TIM data and run internal commands; skip external integrations. If the ‘brands’ argument is provided, this flag is ignored and enrichment/internal commands will run only on the brands provided. |
| verbose | Retrieve a human-readable entry for each command; if false, only the final result is summarized and errors are suppressed. |
| brands | A list of integration brands to run enrichment against. Example: `“VirusTotal (API v3), AlienVault OTX v2”`. - If provided, only the selected brands are used. - If left empty, the script runs enrichment on all enabled integrations, depending on the `external_enrichment` flag. - In order to run core-get-IP-analytics-prevalence, add Cortex Core - IR to the brands list. To see the available brands for the `domain` command, run: `!ProvidesCommand command=domain`. |
| additional_fields | When set to true, the output includes an `AdditionalFields` object for each of the indicator result. `AdditionalFields` contains all fields returned by TIM or the integrations that are not part of the standard output keys: `Name`, `Brand`, `Score`, `Verdict`, `DetectionEngines`, `PositiveDetections`. When set to false, only the standard keys are returned. |
Outputs
| Path | Description | Type |
|---|---|---|
| DomainEnrichment.Value | The Domain. | string |
| DomainEnrichment.MaxScore | The max score of all the indicators found. | number |
| DomainEnrichment.MaxVerdict | The max verdict of all the indicators found. | string |
| DomainEnrichment.Results | List of all indicators found for the domain. | array |
| DomainEnrichment.TIMScore | The TIM score of the domain. | number |
| DomainEnrichment.Status | The status of the indicator: “Manual” if the score was changed manually, “Fresh” if modified within the last week, “Stale” if modified more than a week ago, and “None” if never modified. | string |
| DomainEnrichment.ModifiedTime | The time the indicator was last modified. | Date |
| DomainEnrichment.Results.Brand | The brand of the indicator. | string |
| DomainEnrichment.Results.Score | The score of the indicator. | number |
| DomainEnrichment.Results.Verdict | The verdict of the indicator. | string |
| DomainEnrichment.Results.DetectionEngines | The detection engines of the indicator. | number |
| DomainEnrichment.Results.PositiveDetections | The positive detections of the indicator. | number |
| DomainEnrichment.Results.Name | The Domain. | string |
| DomainEnrichment.Results.AdditionalFields | All fields extracted from the indicator other then the main keys (“Brand”, “Score”, “Verdict”, “DetectionEngines”, “PositiveDetections”, “Name”). | Object |
| DomainEnrichment.Results.AdditionalFields.Relationships.EntityA | The source of the relationship. | string |
| DomainEnrichment.Results.AdditionalFields.Relationships.EntityB | The destination of the relationship. | string |
| DomainEnrichment.Results.AdditionalFields.Relationships.Relationship | The name of the relationship. | string |
| DomainEnrichment.Results.AdditionalFields.Relationships.EntityAType | The type of the source of the relationship. | string |
| DomainEnrichment.Results.AdditionalFields.Relationships.EntityBType | The type of the destination of the relationship. | string |
| DomainEnrichment.Results.AdditionalFields.DNS | A list of IP objects resolved by DNS. | String |
| DomainEnrichment.Results.AdditionalFields.CreationDate | The date when the domain was created. | Date |
| DomainEnrichment.Results.AdditionalFields.UpdatedDate | The date when the domain was last updated. | String |
| DomainEnrichment.Results.AdditionalFields.ExpirationDate | The expiration date of the domain. | Date |
| DomainEnrichment.Results.AdditionalFields.DomainStatus | The status of the domain. | Date |
| DomainEnrichment.Results.AdditionalFields.NameServers | (List<String>) Name servers of the domain. | Unknown |
| DomainEnrichment.Results.AdditionalFields.Organization | The organization of the domain. | String |
| DomainEnrichment.Results.AdditionalFields.Subdomains | (List<String>) Subdomains of the domain. | Unknown |
| DomainEnrichment.Results.AdditionalFields.Admin.Country | The country of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.Admin.Email | The email address of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.Admin.Name | The name of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.Admin.Phone | The phone number of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.Registrant.Country | The country of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.Registrant.Email | The email address of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.Registrant.Name | The name of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.Registrant.Phone | The phone number to receive abuse reports. | String |
| DomainEnrichment.Results.AdditionalFields.Tags | (List) Tags of the domain. | Unknown |
| DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.value | Indicators that are associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.type | The type of the indicators that are associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.description | The description of the indicators that are associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.MalwareFamily | The malware family associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.DomainStatus | The status of the domain. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.NameServers | (List<String>) Name servers of the domain. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.CreationDate | The date that the domain was created. | Date |
| DomainEnrichment.Results.AdditionalFields.WHOIS.UpdatedDate | The date that the domain was last updated. | Date |
| DomainEnrichment.Results.AdditionalFields.WHOIS.ExpirationDate | The expiration date of the domain. | Date |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Name | The name of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Email | The email address of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Phone | The phone number of the registrant. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.Name | The name of the registrar, for example, GoDaddy. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.AbuseEmail | The email address of the contact to report abuse. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.AbusePhone | The phone number of the contact to report abuse. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Name | The name of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Email | The email address of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Phone | The phone number of the domain administrator. | String |
| DomainEnrichment.Results.AdditionalFields.WHOIS.History | List of Whois objects. | String |
| DomainEnrichment.Results.AdditionalFields.Malicious.Vendor | The vendor reporting the domain as malicious. | String |
| DomainEnrichment.Results.AdditionalFields.Malicious.Description | Reason the domain was reported as malicious. | String |
| DomainEnrichment.Results.AdditionalFields.DomainIDNName | The internationalized domain name (IDN) of the domain. | String |
| DomainEnrichment.Results.AdditionalFields.Port | Ports associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.Internal | Whether the domain is internal or external. | Bool |
| DomainEnrichment.Results.AdditionalFields.Category | The category associated with the indicator. | String |
| DomainEnrichment.Results.AdditionalFields.Campaign | The campaign associated with the domain. | String |
| DomainEnrichment.Results.AdditionalFields.TrafficLightProtocol | The Traffic Light Protocol (TLP) color that is suitable for the domain. | String |
| DomainEnrichment.Results.AdditionalFields.ThreatTypes.threatcategory | The threat category associated to this indicator by the source vendor, for example, Phishing, Control, TOR, etc. | String |
| DomainEnrichment.Results.AdditionalFields.ThreatTypes.threatcategoryconfidence | Threat Category Confidence is the confidence level provided by the vendor for the threat type category. For example, a confidence of 90 for the threat type category ‘malware’ means the vendor estimates a 90% likelihood that it is malware. | String |
| DomainEnrichment.Results.AdditionalFields.Geo.Location | The geolocation where the domain address is located, in the format: latitude:longitude. | String |
| DomainEnrichment.Results.AdditionalFields.Geo.Country | The country in which the domain address is located. | String |
| DomainEnrichment.Results.AdditionalFields.Geo.Description | Additional information about the location. | String |
| DomainEnrichment.Results.AdditionalFields.Tech.Country | The country of the domain technical contact. | String |
| DomainEnrichment.Results.AdditionalFields.Tech.Name | The name of the domain technical contact. | String |
| DomainEnrichment.Results.AdditionalFields.Tech.Organization | The organization of the domain technical contact. | String |
| DomainEnrichment.Results.AdditionalFields.Tech.Email | The email address of the domain technical contact. | String |
| DomainEnrichment.Results.AdditionalFields.CommunityNotes.note | Notes on the domain that were given by the community. | String |
| DomainEnrichment.Results.AdditionalFields.CommunityNotes.timestamp | Time the note was published. | Date |
| DomainEnrichment.Results.AdditionalFields.Publications.source | The source where the article was published. | String |
| DomainEnrichment.Results.AdditionalFields.Publications.title | The name of the article. | String |
| DomainEnrichment.Results.AdditionalFields.Publications.link | A link to the original article. | String |
| DomainEnrichment.Results.AdditionalFields.Publications.timestamp | Time the article was published. | Date |
| DomainEnrichment.Results.AdditionalFields.Billing | Billing address of the domain. | String |
| Core.AnalyticsPrevalence.Domain.value | Whether the domain is prevalent or not. | Boolean |
| Core.AnalyticsPrevalence.Domain.data.global_prevalence.value | The global prevalence of the domain. | Number |
| Core.AnalyticsPrevalence.Domain.data.local_prevalence.value | The local prevalence of the domain. | Number |
| Core.AnalyticsPrevalence.Domain.data.prevalence.value | The prevalence of the domain. | Number |
args: - description: | Accepts a list of domains to enrich. - From CLI: Provide a comma-separated list. If a Domain contains a comma, wrap the domains in a JSON array. Example: "[\"example.com/search:yellow,red\", \"example2.com\"]". - From Context: Pass JSON arrays directly, without modification. name: domain_list required: true isArray: true - name: external_enrichment description: "Whether to call external integrations for enrichment: - 'true': enrich using enabled external integrations (e.g., VirusTotal (API v3), AlienVault OTX v2) and run internal commands. - 'false': use only existing TIM data and run internal commands; skip external integrations. If the 'brands' argument is provided, this flag is ignored and enrichment/internal commands will run only on the brands provided." auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' required: false - name: verbose description: Retrieve a human-readable entry for each command; if false, only the final result is summarized and errors are suppressed. auto: PREDEFINED predefined: - 'true' - 'false' defaultValue: 'false' required: false - name: brands description: | A list of integration brands to run enrichment against. Example: `"VirusTotal (API v3), AlienVault OTX v2"`. - If provided, only the selected brands are used. - If left empty, the script runs enrichment on all enabled integrations, depending on the `external_enrichment` flag. - In order to run core-get-IP-analytics-prevalence, add Cortex Core - IR to the brands list. To see the available brands for the `domain` command, run: `!ProvidesCommand command=domain`. isArray: true required: false - name: additional_fields description: | When set to true, the output includes an `AdditionalFields` object for each of the indicator result. `AdditionalFields` contains all fields returned by TIM or the integrations that are not part of the standard output keys: `Name`, `Brand`, `Score`, `Verdict`, `DetectionEngines`, `PositiveDetections`. When set to false, only the standard keys are returned. auto: PREDEFINED predefined: - 'true' - 'false' required: false defaultValue: 'false' comment: 'Enriches Domain indicators with reputation data from multiple integrations and outputs a consolidated DomainEnrichment object. This script exclusively supports indicators of type Domain and will automatically create the indicator in TIM if it is not already exists.' commonfields: id: domain-enrichment version: -1 enabled: false name: domain-enrichment outputs: # DomainEnrichment - contextPath: DomainEnrichment.Value description: The Domain. type: string - contextPath: DomainEnrichment.MaxScore description: The max score of all the indicators found. type: number - contextPath: DomainEnrichment.MaxVerdict description: The max verdict of all the indicators found. type: string - contextPath: DomainEnrichment.Results description: List of all indicators found for the domain. type: array - contextPath: DomainEnrichment.TIMScore description: The TIM score of the domain. type: number - contextPath: DomainEnrichment.Status description: 'The status of the indicator: "Manual" if the score was changed manually, "Fresh" if modified within the last week, "Stale" if modified more than a week ago, "Error" if enrichment Failed, and "None" if never modified.' type: string - contextPath: DomainEnrichment.Message description: The error message explaining the reason for the failure (e.g., "Invalid", "createIndicator failed", etc.). type: string - contextPath: DomainEnrichment.ModifiedTime description: The time the indicator was last modified. type: Date # DomainEnrichment Main Keys - contextPath: DomainEnrichment.Results.Brand description: The brand of the indicator. type: string - contextPath: DomainEnrichment.Results.Score description: The score of the indicator. type: number - contextPath: DomainEnrichment.Results.Verdict description: The verdict of the indicator. type: string - contextPath: DomainEnrichment.Results.DetectionEngines description: The detection engines of the indicator. type: number - contextPath: DomainEnrichment.Results.PositiveDetections description: The positive detections of the indicator. type: number - contextPath: DomainEnrichment.Results.Name description: The Domain. type: string - contextPath: DomainEnrichment.Results.Reliability description: The reliability of the Brand. type: string # DomainEnrichment Additional Fields - contextPath: DomainEnrichment.Results.AdditionalFields description: All fields extracted from the indicator other then the main keys ("Brand", "Score", "Verdict", "DetectionEngines", "PositiveDetections", "Name"). type: Object - contextPath: DomainEnrichment.Results.AdditionalFields.Relationships.EntityA description: The source of the relationship. type: string - contextPath: DomainEnrichment.Results.AdditionalFields.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: DomainEnrichment.Results.AdditionalFields.Relationships.Relationship description: The name of the relationship. type: string - contextPath: DomainEnrichment.Results.AdditionalFields.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: DomainEnrichment.Results.AdditionalFields.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: DomainEnrichment.Results.AdditionalFields.DNS description: A list of IP objects resolved by DNS. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.CreationDate description: The date when the domain was created. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.UpdatedDate description: The date when the domain was last updated. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.DomainStatus description: The status of the domain. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.NameServers description: (List<String>) Name servers of the domain. type: Unknown - contextPath: DomainEnrichment.Results.AdditionalFields.Organization description: The organization of the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Subdomains description: (List<String>) Subdomains of the domain. type: Unknown - contextPath: DomainEnrichment.Results.AdditionalFields.Admin.Country description: The country of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Admin.Email description: The email address of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Admin.Name description: The name of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Registrant.Country description: The country of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Registrant.Email description: The email address of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Registrant.Name description: The name of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Registrant.Phone description: The phone number to receive abuse reports. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Tags description: (List) Tags of the domain. type: Unknown - contextPath: DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.value description: Indicators that are associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.type description: The type of the indicators that are associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.FeedRelatedIndicators.description description: The description of the indicators that are associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.MalwareFamily description: The malware family associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.DomainStatus description: The status of the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.NameServers description: (List<String>) Name servers of the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.CreationDate description: The date that the domain was created. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.UpdatedDate description: The date that the domain was last updated. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Name description: The name of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Email description: The email address of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrant.Phone description: The phone number of the registrant. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.Name description: The name of the registrar, for example, GoDaddy. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.AbuseEmail description: The email address of the contact to report abuse. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Registrar.AbusePhone description: The phone number of the contact to report abuse. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Name description: The name of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Email description: The email address of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.Admin.Phone description: The phone number of the domain administrator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.WHOIS.History description: List of Whois objects. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Malicious.Vendor description: The vendor reporting the domain as malicious. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Malicious.Description description: Reason the domain was reported as malicious. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.DomainIDNName description: The internationalized domain name (IDN) of the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Port description: Ports associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Internal description: Whether the domain is internal or external. type: Bool - contextPath: DomainEnrichment.Results.AdditionalFields.Category description: The category associated with the indicator. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Campaign description: The campaign associated with the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.TrafficLightProtocol description: The Traffic Light Protocol (TLP) color that is suitable for the domain. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.ThreatTypes.threatcategory description: The threat category associated to this indicator by the source vendor, for example, Phishing, Control, TOR, etc. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.ThreatTypes.threatcategoryconfidence description: Threat Category Confidence is the confidence level provided by the vendor for the threat type category. For example, a confidence of 90 for the threat type category 'malware' means the vendor estimates a 90% likelihood that it is malware. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Geo.Location description: 'The geolocation where the domain address is located, in the format: latitude:longitude.' type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Geo.Country description: The country in which the domain address is located. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Geo.Description description: Additional information about the location. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Tech.Country description: The country of the domain technical contact. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Tech.Name description: The name of the domain technical contact. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Tech.Organization description: The organization of the domain technical contact. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Tech.Email description: The email address of the domain technical contact. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.CommunityNotes.note description: Notes on the domain that were given by the community. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.CommunityNotes.timestamp description: Time the note was published. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.Publications.source description: The source where the article was published. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Publications.title description: The name of the article. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Publications.link description: A link to the original article. type: String - contextPath: DomainEnrichment.Results.AdditionalFields.Publications.timestamp description: Time the article was published. type: Date - contextPath: DomainEnrichment.Results.AdditionalFields.Billing description: Billing address of the domain. type: String # Core.AnalyticsPrevalence - contextPath: Core.AnalyticsPrevalence.Domain.value description: Whether the domain is prevalent or not. type: Boolean - contextPath: Core.AnalyticsPrevalence.Domain.data.global_prevalence.value description: The global prevalence of the domain. type: Number - contextPath: Core.AnalyticsPrevalence.Domain.data.local_prevalence.value description: The local prevalence of the domain. type: Number - contextPath: Core.AnalyticsPrevalence.Domain.data.prevalence.value description: The prevalence of the domain. type: Number script: '-' system: false tags: - basescript timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 8.0.0 marketplaces: - xsoar_saas - platform - marketplacev2 tests: - DomainEnrichment-Test