ExtractIndicatorsFromTextFile

Extract indicators from a text-based file. Indicators that can be extracted: * IP * Domain * URL * File Hash * Email Address This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script

python · Common Scripts

Details

IDExtractIndicatorsFromTextFile
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775

README

Extract indicators from a text-based file.
Indicators that can be extracted:

  • IP
  • Domain
  • URL
  • File Hash
  • Email Address

This automation runs using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name Description
Script Type python2
Cortex XSOAR Version 5.0.0

Used In

This script is used in the following playbooks and scripts.

  • Extract Indicators From File - Generic
  • Extract Indicators From File - Generic v2

Inputs

Argument Name Description
entryID The War-Room entryID of the file to read.
maxFileSize Maximal file size to load, in bytes. Default is 1000000 (1MB).

Outputs

Path Description Type
Domain.Name Extracted domains string
Account.Email.Address Extracted emails string
File.MD5 Extracted MD5 string
File.SHA1 Extracted SHA1 string
File.SHA256 Extracted SHA256 string
IP.Address Extracted IPs string
URL.Data Extracted URLs string

Source

ExtractIndicatorsFromTextFile.py ExtractIndicatorsFromTextFile_test.py ExtractIndicatorsFromTextFile.yml
Download History Raw 
args:
- description: The War-Room entryID of the file to read.
  name: entryID
  required: true
- description: Maximal file size to load, in bytes. Default is 1000000 (1MB).
  name: maxFileSize
comment: |-
  Extract indicators from a text-based file.
  Indicators that can be extracted:
  * IP
  * Domain
  * URL
  * File Hash
  * Email Address

  This automation runs using the default Limited User role, unless you explicitly change the permissions.
  For more information, see the section about permissions here:
  - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
  - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
  - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
commonfields:
  id: ExtractIndicatorsFromTextFile
  version: -1
enabled: true
name: ExtractIndicatorsFromTextFile
outputs:
- contextPath: Domain.Name
  description: Extracted domains.
  type: string
- contextPath: Account.Email.Address
  description: Extracted emails.
  type: string
- contextPath: File.MD5
  description: Extracted MD5.
  type: string
- contextPath: File.SHA1
  description: Extracted SHA1.
  type: string
- contextPath: File.SHA256
  description: Extracted SHA256.
  type: string
- contextPath: IP.Address
  description: Extracted IPs.
  type: string
- contextPath: URL.Data
  description: Extracted URLs.
  type: string
script: '-'
timeout: '0'
type: python
subtype: python3
runas: DBotRole
tests:
- Extract Indicators From File - Generic v2 - Test
fromversion: 5.0.0
tags: []
dockerimage: demisto/python3:3.12.13.10404775