InvestigationSummaryParse
Retrieves information from previously run reputation commands and aggregates their results.
python · Malware Investigation and Response
Details
| ID | InvestigationSummaryParse |
|---|---|
| Language | python |
| From Version | 6.2.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
README
Retrieves information from previously run reputation commands and aggregates their results.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Cortex XSOAR Version | 6.2.0 |
Inputs
There are no inputs for this script.
Outputs
| Path | Description | Type |
|---|---|---|
| InvestigationSummary.EvidenceOfPersistence.Tactic | The tactic associated with the evidence of persistence finding. | String |
| InvestigationSummary.EvidenceOfPersistence.Result | The result of the evidence of persistence finding. | String |
| InvestigationSummary.EvidenceOfPersistence.Sources | The sources by which the evidence of persistence value was set. | String |
| InvestigationSummary.EvidenceOfDefenseEvasion.Tactic | The tactic associated with the evidence of defense evasion finding. | String |
| InvestigationSummary.EvidenceOfDefenseEvasion.Result | The result of the evidence of persistence finding. | String |
| InvestigationSummary.EvidenceOfDefenseEvasion.Sources | The sources by which the evidence of defense evasion value was set. | String |
| InvestigationSummary.EvidenceOfExecution.Tactic | The tactic associated with the evidence of execution finding. | String |
| InvestigationSummary.EvidenceOfExecution.Result | The result of the evidence of execution finding. | String |
| InvestigationSummary.EvidenceOfExecution.Sources | The sources by which the evidence of execution value was set. | String |
| InvestigationSummary.EvidenceOfLateralMovement.Tactic | The tactic associated with the evidence of lateral movement finding. | String |
| InvestigationSummary.EvidenceOfLateralMovement.Result | The Result of the evidence of lateral movement finding. | String |
| InvestigationSummary.EvidenceOfLateralMovement.Sources | The sources by which the evidence of lateral movement value was set. | String |
| InvestigationSummary.EvidenceOfPrivilegeEscalation.Tactic | The tactic associated with the evidence of privilege escalation finding. | String |
| InvestigationSummary.EvidenceOfPrivilegeEscalation.Result | The result of the evidence of privilege escalation finding. | String |
| InvestigationSummary.EvidenceOfPrivilegeEscalation.Sources | The sources by which the evidence of privilege escalation value was set. | String |
| InvestigationSummary.EvidenceOfCommandAndControl.Tactic | The tactic associated with the evidence of command and control finding. | String |
| InvestigationSummary.EvidenceOfCommandAndControl.Result | The result of the evidence of command and control finding. | String |
| InvestigationSummary.EvidenceOfCommandAndControl.Sources | The sources by which the evidence of command and control value was set. | String |
args: [] comment: Retrieves information from previously run reputation commands and aggregates their results. commonfields: id: InvestigationSummaryParse version: -1 name: InvestigationSummaryParse outputs: - contextPath: InvestigationSummary.EvidenceOfPersistence.Tactic description: The tactic associated with the evidence of persistence finding. type: String - contextPath: InvestigationSummary.EvidenceOfPersistence.Result description: The result of the evidence of persistence finding. type: String - contextPath: InvestigationSummary.EvidenceOfPersistence.Sources description: The sources by which the evidence of persistence value was set. type: String - contextPath: InvestigationSummary.EvidenceOfDefenseEvasion.Tactic description: The tactic associated with the evidence of defense evasion finding. type: String - contextPath: InvestigationSummary.EvidenceOfDefenseEvasion.Result description: The result of the evidence of persistence finding. type: String - contextPath: InvestigationSummary.EvidenceOfDefenseEvasion.Sources description: The sources by which the evidence of defense evasion value was set. type: String - contextPath: InvestigationSummary.EvidenceOfExecution.Tactic description: The tactic associated with the evidence of execution finding. type: String - contextPath: InvestigationSummary.EvidenceOfExecution.Result description: The result of the evidence of execution finding. type: String - contextPath: InvestigationSummary.EvidenceOfExecution.Sources description: The sources by which the evidence of execution value was set. type: String - contextPath: InvestigationSummary.EvidenceOfLateralMovement.Tactic description: The tactic associated with the evidence of lateral movement finding. type: String - contextPath: InvestigationSummary.EvidenceOfLateralMovement.Result description: The Result of the evidence of lateral movement finding. type: String - contextPath: InvestigationSummary.EvidenceOfLateralMovement.Sources description: The sources by which the evidence of lateral movement value was set. type: String - contextPath: InvestigationSummary.EvidenceOfPrivilegeEscalation.Tactic description: The tactic associated with the evidence of privilege escalation finding. type: String - contextPath: InvestigationSummary.EvidenceOfPrivilegeEscalation.Result description: The result of the evidence of privilege escalation finding. type: String - contextPath: InvestigationSummary.EvidenceOfPrivilegeEscalation.Sources description: The sources by which the evidence of privilege escalation value was set. type: String - contextPath: InvestigationSummary.EvidenceOfCommandAndControl.Tactic description: The tactic associated with the evidence of command and control finding. type: String - contextPath: InvestigationSummary.EvidenceOfCommandAndControl.Result description: The result of the evidence of command and control finding. type: String - contextPath: InvestigationSummary.EvidenceOfCommandAndControl.Sources description: The sources by which the evidence of command and control value was set. type: String script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 fromversion: 6.2.0 tests: - No tests (auto formatted)