PTEnrich Deprecated
Deprecated. No available replacement. Enrich the given IP or domain with metadata, malware, osint.
javascript · PassiveTotal
Details
| ID | PTEnrich |
|---|---|
| Language | javascript |
| From Version | 5.0.0 |
| Tags | passive-total server threat-intel |
README
Enriches the given IP address or domain with metadata, malware, or osint.
Script Data
| Name | Description |
|---|---|
| Script Type | javascript |
| Tags | passive-total, server, threat-intel |
Dependencies
This script uses the following commands and scripts.
- pt-osint
- pt-malware
- pt-enrichment
- pt-get-subdomains
- pt-ssl-cert
- pt-whois
- pt-passive-dns
Inputs
| Argument Name | Description |
|---|---|
| query | The IP address or domain to enrich. |
Outputs
| Path | Description | Type |
|---|---|---|
| subdomains | The list of subdomains as strings. | Unknown |
| Domain.Name | The name of the queries domain. | Unknown |
| Domain.DNS.Address | The resolved address of the domain. | Unknown |
| passivetotal.whois.email | The contact email for the queried domain. | Unknown |
| passivetotal.resolves | The various resolves from the passive DNS collection. | Unknown |
| IP.Address | The bad IP addresses found during enrichment. | Unknown |
| IP.Malicious.Vendor | The vendor that made the decision that the IP addresses are malicious. | Unknown |
| IP.Malicious.Description | The reason that the vendor decided that the IP addresses were malicious. | Unknown |
| Domain.Name | The bad domains found during the enrichment. | Unknown |
| Domain.Malicious.Vendor | The vendor that made the decision that the domains are malicious. | Unknown |
| Domain.Malicious.Description | The reason that the vendor decided that the domains were malicious. | Unknown |
| File.MD5 | The bad MD5 hash of teh file. | Unknown |
| File.SHA1 | The bad SHA1 hash of the file. | Unknown |
| File.SHA256 | The bad SHA256 hash of the file. | Unknown |
| File.Malicious.Vendor | The vendor that made the decision that the files are malicious. | Unknown |
| File.Malicious.Description | The bad SHA256 hash of the file. | Unknown |
| DBotScore.Indicator | The indicator that was tested. | Unknown |
| DBotScore.Type | The type of the indicator. | Unknown |
| DBotScore.Vendor | The vendor used to calculate the score. | Unknown |
| DBotScore.Score | The actual score. | Unknown |
commonfields: id: PTEnrich version: -1 name: PTEnrich script: '' type: javascript tags: - passive-total - server - threat-intel comment: Deprecated. No available replacement. Enrich the given IP or domain with metadata, malware, osint. system: true args: - name: query required: true default: true description: The IP or domain to enrich outputs: - contextPath: subdomains description: List of subdomains as strings - contextPath: Domain.Name description: The name of the queries domain - contextPath: Domain.DNS.Address description: The resolved address of the domain - contextPath: passivetotal.whois.email description: Contact email for the queried domain - contextPath: passivetotal.resolves description: The various resolves from the passive DNS collection - contextPath: IP.Address description: Bad IPs found during enrichment - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domains found during enrichment - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: File.MD5 description: Bad hash MD5 - contextPath: File.SHA1 description: Bad hash SHA1 - contextPath: File.SHA256 description: Bad hash SHA256 - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score scripttarget: 0 dependson: must: - pt-enrichment - pt-malware - pt-osint - pt-get-subdomains - pt-passive-dns - pt-whois - pt-ssl-cert timeout: 0s tests: - No test fromversion: 5.0.0 deprecated: true