FetchIndicatorsFromFile

Details

ID	`FetchIndicatorsFromFile`
Language	python
From Version	6.5.0
Docker Image	`demisto/py3-tools:1.0.0.11597437`
Tags	indicators

README

Fetches indicators from a file.

Supported File Types

TXT
XLS, XLSX
CSV
DOC, DOCX

If an Excel file is supplied (XLS, XLSX, CSV), you need to specify the column_number argument, which defines the column to fetch from.

Script Data

Name	Description
Script Type	python3
Tags	indicators
Cortex XSOAR Version	5.5.0

Inputs

Argument Name	Description
entry_id	The file entry_id from which to fetch the indicators.
auto_detect	Whether to auto-detect the indicator type from the file.
default_type	Sets a default indicator type.
limit	The maximum number of indicators to fetch. If this argument is not specified, will parse the entire file.
offset	The index for the first indicator to fetch.
indicator_column_number	Only for spreadsheet files. The column number in the spreadsheet that contains the indicators. The first column number is 1. If this argument is not specified, will use at the first column.
sheet_name	Only for spreadsheet files. The name of the Excel sheet to fetch indicators from. If this argument is not specified, will fetch from the first sheet of the workbook.
indicator_type_column_number	Only for spreadsheet files. The column number in the spreadsheet that contains the indicator types. The first column number is 1.
starting_row	Only for spreadsheet files. The starting row of the spreadsheet to fetch from. The first row is 1.

Automation Example

!FetchIndicatorsFromFile auto_detect=True entry_id={entry_id}

Human Readable Output

Indicators from indicator.csv:

value	type
xsoar.com	Domain
8.8.8.8	IP
8.8.8.8/12	CIDR

Source

FetchIndicatorsFromFile.py FetchIndicatorsFromFile_test.py FetchIndicatorsFromFile.yml command_examples.txt

Download History Raw

args:
- description: The file entry_id from which to fetch the indicators.
  name: entry_id
  required: true
- auto: PREDEFINED
  defaultValue: 'True'
  description: Whether to auto-detect the indicator type from the file.
  name: auto_detect
  predefined:
  - 'True'
  - 'False'
  required: true
- auto: PREDEFINED
  description: Sets a default indicator type.
  name: default_type
  predefined:
  - CVE
  - Domain
  - Email
  - File
  - FQDN
  - File MD5
  - File SHA-1
  - File SHA-256
  - Host
  - IP
  - CIDR
  - IPv6
  - IPv6CIDR
  - Registry Key
  - ssdeep
  - URL
  - Account
- description: The maximum number of indicators to fetch. If this argument is not specified, will parse the entire file.
  name: limit
- defaultValue: '0'
  description: The index for the first indicator to fetch.
  name: offset
- defaultValue: '1'
  description: Only for spreadsheet files. The column number in the spreadsheet that contains the indicators. The first column number is 1. If this argument is not specified, will use at the first column.
  name: indicator_column_number
- description: Only for spreadsheet files. The name of the Excel sheet to fetch indicators from. If this argument is not specified, will fetch from the first sheet of the workbook.
  name: sheet_name
- description: Only for spreadsheet files. The column number in the spreadsheet that contains the indicator types. The first column number is 1.
  name: indicator_type_column_number
- defaultValue: '1'
  description: Only for spreadsheet files. The starting row of the spreadsheet to fetch from. The first row is 1.
  name: starting_row
comment: Fetches indicators from a file. Supports TXT, XLS, XLSX, CSV, DOC and DOCX file types.
commonfields:
  id: FetchIndicatorsFromFile
  version: -1
name: FetchIndicatorsFromFile
outputs:
- contextPath: Indicator.value
  description: The value of the indicator.
  type: String
- contextPath: Indicator.type
  description: The indicator type.
  type: String
script: '-'
subtype: python3
tags:
- indicators
timeout: '0'
type: python
dockerimage: demisto/py3-tools:1.0.0.11597437
fromversion: 6.5.0
tests:
- No tests (auto formatted)