IsMaliciousIndicatorFound

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.

javascript · Common Scripts

Details

ID	`IsMaliciousIndicatorFound`
Language	javascript
From Version	5.0.0
Tags	Utility Condition

README

Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). It will returns “yes” if at least one malicious indicator is found.

Script Data

Name	Description
Script Type	javascript
Tags	Utility, Condition

Inputs

Argument Name	Description
includeSuspicious	Whether to check suspicious indicators. The default is “no”.
queryIndicators	Queries all indicators in an investigation. This is relevant if it is running in a sub-playbook.
maliciousQueryOverride	Whether to override the default query for malicious indicators in Cortex XSOAR (Indicators page).
includeManual	Whether to check manually edited indicators. The default is “yes”.

Outputs

Path	Description	Type
yes	Whether any malicious indicators were found in the investigation.	Unknown
no	Whether any malicious indicators were found in the investigation.	Unknown

Source

IsMaliciousIndicatorFound.js IsMaliciousIndicatorFound.yml

Download History Raw

commonfields:
  id: IsMaliciousIndicatorFound
  version: -1
name: IsMaliciousIndicatorFound
script: ''
type: javascript
tags:
- Utility
- Condition
comment: Checks if the investigation found any malicious indicators (file, URL, IP address, domain, or email). Returns "yes" if at least one malicious indicator is found.
enabled: true
args:
- name: includeSuspicious
  default: true
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Whether to check suspicious indicators. Default is "no".
  defaultValue: "no"
- name: queryIndicators
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Query all indicators in an investigation (relevant if running in a sub-playbook).
  defaultValue: "yes"
- name: maliciousQueryOverride
  description: Whether to override the default query for malicious indicators in Demisto (Indicators page).
- name: includeManual
  auto: PREDEFINED
  predefined:
  - "yes"
  - "no"
  description: Whether to check manually edited indicators. Default is "yes".
  defaultValue: "yes"
outputs:
- contextPath: "yes"
  description: Whether any malicious indicators were found in the investigation.
- contextPath: "no"
  description: Whether any malicious indicators were found in the investigation.
scripttarget: 0
runas: DBotWeakRole
fromversion: 5.0.0