ExtractDomainFromIOCDomainMatchRes
Extracts domain and its details from the Chronicle IOC Domain match response.
python · Google SecOps
Details
| ID | ExtractDomainFromIOCDomainMatchRes |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
Extracts domain and its details from the Chronicle IOC Domain match response.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 5.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| json_response | JSON response of IOC Domain Match |
Outputs
| Path | Description | Type |
|---|---|---|
| Domain.Name | The suspicious domain name recently observed in enterprise. | string |
| ChronicleIOCDomainMatches.Domain | The suspicious domain name recently observed in enterprise. | string |
| ChronicleIOCDomainMatches.IOCIngestTime | Time(UTC) the IOC was first seen by Chronicle. | date |
| ChronicleIOCDomainMatches.FirstSeen | Time(UTC) the artifact was first seen within your enterprise. | date |
| ChronicleIOCDomainMatches.LastSeen | Time(UTC) the artifact was most recently seen within your enterprise. | date |
Script Example
!ExtractDomainFromIOCDomainMatchRes json_response="{\"Artifact\": \"e9428.b.akamaiedge.net\", \"IocIngestTime\": \"2020-07-17T20:00:00Z\", \"FirstAccessedTime\": \"2018-11-05T12:01:29Z\", \"LastAccessedTime\": \"2018-11-09T11:51:03Z\", \"Sources\": [{\"Category\": \"Observed serving executables\", \"IntRawConfidenceScore\": 0, \"NormalizedConfidenceScore\": \"Low\", \"RawSeverity\": \"Low\", \"Source\": \"ET Intelligence Rep List\"}]}"
Context Example
{
"ChronicleIOCDomainMatches": {
"Domain": "e9428.b.akamaiedge.net",
"FirstSeen": "2018-11-05T12:01:29Z",
"IOCIngestTime": "2020-07-17T20:00:00Z",
"LastSeen": "2018-11-09T11:51:03Z"
},
"Domain": {
"Name": "e9428.b.akamaiedge.net"
}
}
Human Readable Output
{}
commonfields: id: ExtractDomainFromIOCDomainMatchRes version: -1 name: ExtractDomainFromIOCDomainMatchRes script: '' type: python tags: [] comment: Extracts domain and its details from the Chronicle IOC Domain match response. enabled: true args: - name: json_response description: JSON response of IOC Domain Match outputs: - contextPath: Domain.Name description: The suspicious domain name recently observed in enterprise. type: string - contextPath: ChronicleIOCDomainMatches.Domain description: The suspicious domain name recently observed in enterprise. type: string - contextPath: ChronicleIOCDomainMatches.IOCIngestTime description: Time(UTC) the IOC was first seen by Chronicle. type: date - contextPath: ChronicleIOCDomainMatches.FirstSeen description: Time(UTC) the artifact was first seen within your enterprise. type: date - contextPath: ChronicleIOCDomainMatches.LastSeen description: Time(UTC) the artifact was most recently seen within your enterprise. type: date scripttarget: 0 subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 runas: DBotWeakRole fromversion: 5.0.0 tests: - No tests (auto formatted)