MaliciousRatioReputation

Set indicator reputation to "suspicious" when malicious ratio is above threshold. Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.

python · Common Scripts

Details

ID	`MaliciousRatioReputation`
Language	python
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	reputation

README

Sets the indicators reputation to “suspicious” when the malicious ratio is above the threshold.
The malicious ratio is the ration between the number of “bad” incidents to the total number of incidents the indicator appears in.

Script Data

Name	Description
Script Type	python
Tags	reputation
Cortex XSOAR Version	4.0.0+

Inputs

Argument Name	Description
input	The value of the indicator.
threshold	The malicious ratio threshold to set the indicator as suspicious.

Outputs

There are no outputs for this script.

Source

MaliciousRatioReputation.py MaliciousRatioReputation_test.py MaliciousRatioReputation.yml

Download History Raw

commonfields:
  id: MaliciousRatioReputation
  version: -1
name: MaliciousRatioReputation
fromversion: "6.5.0"
script: ''
type: python
subtype: python3
tags:
- reputation
comment: |-
  Set indicator reputation to "suspicious" when malicious ratio is above threshold.
  Malicious ratio is the ration between number of "bad" incidents to total number of incidents the indicator appears in.
enabled: true
args:
- name: input
  description: Value of the indicator.
- name: threshold
  description: 'Malicious ratio threshold to set indicator as suspicious. '
  defaultValue: "0.3"
scripttarget: 0
dockerimage: demisto/python3:3.12.13.10404775
tests:
- No tests (auto formatted)