MaliciousRatioReputation

Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.

python · Common Scripts

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def get_indicator_from_value(indicator_value):
    try:
        res = demisto.executeCommand("findIndicators", {"value": indicator_value})
        indicator = res[0]["Contents"][0]
        return indicator
    except Exception:
        pass


def get_indicator_result(indicator):
    res = demisto.executeCommand("maliciousRatio", {"value": indicator["value"]})

    mr_score = res[0]["Contents"][0]["maliciousRatio"]
    if mr_score > float(demisto.args()["threshold"]):  # noqa: RET503
        ec = {}
        ec["DBotScore"] = {
            "Type": indicator["indicator_type"].lower(),
            "Score": 2,  # suspicious
            "Vendor": "DBot-MaliciousRatio",
            "Indicator": indicator["value"],
        }
        entry = {
            "Type": entryTypes["note"],
            "EntryContext": ec,
            "Contents": ec["DBotScore"]["Score"],
            "ContentsFormat": formats["text"],
            "HumanReadable": f"Malicious ratio for {indicator['value']} is {mr_score}",
            "ReadableContentsFormat": formats["markdown"],
        }
        return entry


def main():
    indicator_value = demisto.args().get("input")
    indicator = get_indicator_from_value(indicator_value)
    if indicator:
        try:
            demisto.results(get_indicator_result(indicator))
        except Exception:
            pass


if __name__ == "__builtin__" or __name__ == "builtins":
    main()

README

Sets the indicators reputation to “suspicious” when the malicious ratio is above the threshold.
The malicious ratio is the ration between the number of “bad” incidents to the total number of incidents the indicator appears in.

Script Data

Name	Description
Script Type	python
Tags	reputation
Cortex XSOAR Version	4.0.0+

Inputs

Argument Name	Description
input	The value of the indicator.
threshold	The malicious ratio threshold to set the indicator as suspicious.

Outputs

There are no outputs for this script.