ParseCSV
This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.
python · Common Scripts
Details
| ID | ParseCSV |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | file csv Utility |
README
This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context.
Script Data
| Name | Description |
|---|---|
| Script Type | python2 |
| Tags | file, csv, Utility |
Used In
This script is used in the following playbooks and scripts.
- Block IOCs from CSV - External Dynamic List
Inputs
| Argument Name | Description |
|---|---|
| entryID | The war room entryID of the file. |
| file | The name of the file. The file must be uploaded to the War Room. |
| ips | The column number that contains IP Addresses. (First column is column 0) |
| domains | The column number that contains domains. (First column is column 0) |
| hashes | The column number that contains file hashes. (First column is column 0) |
| parseAll | Parses and converts all of the rows in the CSV into JSON and puts them into the context. |
| codec | The codec type used to parse the file. (some character sets are not UTF-8 supported) |
Outputs
| Path | Description | Type |
|---|---|---|
| IP.Address | IP address found in the parsed file. | Unknown |
| Domain.Name | Domain found in the parsed file. | Unknown |
| File.MD5 | MD5 found in the parsed file. | Unknown |
| File.SHA1 | SHA1 found in the parsed file. | Unknown |
| File.SHA256 | SHA256 found in the parsed file. | Unknown |
| ParseCSV.ParsedCSV | Parsed csv in the form of JSON array. | Unknown |
args: - default: true description: The war room entryID of the file. name: entryID - description: The name of the file. The file must be uploaded to the War Room. name: file deprecated: true - description: The column number that contains IP Addresses. Other IOC types should not be in that column. (First column is column 0). name: ips - description: The column number that contains domains. Other IOC types should not be in that column. (First column is column 0). name: domains - description: The column number that contains file hashes. Other IOC types should not be in that column. (First column is column 0). name: hashes - auto: PREDEFINED defaultValue: 'yes' description: Parses and converts all of the rows in the CSV into JSON and puts them into the context. name: parseAll predefined: - 'yes' - 'no' - defaultValue: utf-8 description: The codec type used to parse the file. (some character sets are not UTF-8 supported). name: codec comment: This script will parse a CSV file and place the unique IPs, Domains and Hashes into the context. commonfields: id: ParseCSV version: -1 enabled: true name: ParseCSV outputs: - contextPath: IP.Address description: IP address found in the parsed file. type: Unknown - contextPath: Domain.Name description: Domain found in the parsed file. type: Unknown - contextPath: File.MD5 description: MD5 found in the parsed file. type: Unknown - contextPath: File.SHA1 description: SHA1 found in the parsed file. type: Unknown - contextPath: File.SHA256 description: SHA256 found in the parsed file. type: Unknown - contextPath: ParseCSV.ParsedCSV description: Parsed csv in the form of JSON array. type: Unknown script: '-' tags: - file - csv - Utility timeout: '0' type: python subtype: python3 runas: DBotWeakRole tests: - No tests fromversion: 5.0.0 dockerimage: demisto/python3:3.12.13.10404775