OnionURLReputation

This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.

python · Common Scripts

Source

import demistomock as demisto
from CommonServerPython import *  # noqa: E402 lgtm [py/polluting-import]


def main():
    url_list = argToList(demisto.args().get("input"))
    entry_list = []

    for url in url_list:
        entry_list.append(
            {
                "Type": entryTypes["note"],
                "ContentsFormat": formats["json"],
                "Contents": 2,
                "EntryContext": {
                    "DBotScore": {
                        "Indicator": url,
                        "Type": "Onion URL",
                        "Score": 2,  # suspicious
                        "Vendor": "DBot",
                    }
                },
            }
        )

    demisto.results(entry_list)


if __name__ in ("__main__", "builtin", "builtins"):
    main()

README

This script adds the reputation to Onion URL indicators. The script is automatically triggered when a Onion URL indicator is auto-extracted. For instance, if you run a Cortex XSOAR CLI on a valid Onion URL, the indicators are extracted automatically and this script is triggered for the extracted indicators.

Script Data

Name Description
Script Type python3
Tags reputation
Cortex XSOAR Version 5.0.0

Inputs

Argument Name Description
input The indicators to which to add reputation.

Outputs

There are no outputs for this script.