ThreatstreamBuildIocImportJson

Details

ID	`ThreatstreamBuildIocImportJson`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	basescript

README

Builds A JSON array based on the values provided by the user for the ‘threatstream-import-indicator-without-approval’ command.

Script Data

Name	Description
Script Type	python3
Tags	basescript
Cortex XSOAR Version	6.8.0

Inputs

Argument Name	Description
email_values	A comma-separated list of emails.
md5_values	A comma-separated list of MD5 hashes.
ip_values	A comma-separated list of IPs.
url_values	A comma-separated list of URLs.
domain_values	A comma-separated list of domains.
email_indicator_type	The indicator type (Itype) of the emails provided. By default the type will be “Malware Email” (mal_email).
md5_indicator_type	The indicator type (Itype) of the hashes provided. By default the type will be “Malware MD5” (mal_md5).
ip_indicator_type	The indicator type (Itype) of the ip provided. By default the type will be “Malware IP” (mal_ip).
url_indicator_type	The indicator type (Itype) of the URLs provided. By default the type will be “Malware URL” (mal_url).
domain_indicator_type	The indicator type (Itype) of the domains provided. By default the type will be “Malware Domain” (mal_domain).
indicator_query	The indicators query, based lucene search syntax.

Note: If both a query (indicator_query) and values (e.g., email_values) are provided as arguments, the values will be ignored.

Outputs

Path	Description	Type
ThreatstreamBuildIocImportJson	The string output represents a JSON object.	String

Script Examples

Example command

!ThreatstreamBuildIocImportJson indicator_query="type: Domain"

Context Example

{
    "ThreatstreamBuildIocImportJson": "{'objects': [{'value': 'my.domain1.com', 'itype': 'mal_domain'}, {'value': 'my.domain2.com', 'itype': 'mal_domain'}]}"
}

Human Readable Output

{‘objects’: [{‘value’: ‘my.domain1.com’, ‘itype’: ‘mal_domain’}, {‘value’: ‘my.domain2.com’, ‘itype’: ‘mal_domain’}]}

Example command

!ThreatstreamBuildIocImportJson indicator_query="type: Domain" domain_indicator_type=spam_domain

Context Example

{
    "ThreatstreamBuildIocImportJson": "{'objects': [{'value': 'my.domain1.com', 'itype': 'spam_domain'}, {'value': 'my.domain2.com', 'itype': 'spam_domain'}]}"
}

Human Readable Output

{‘objects’: [{‘value’: ‘my.domain1.com’, ‘itype’: ‘spam_domain’}, {‘value’: ‘my.domain2.com’, ‘itype’: ‘spam_domain’}]}

Source

ThreatstreamBuildIocImportJson.py ThreatstreamBuildIocImportJson_test.py ThreatstreamBuildIocImportJson.yml

Download History Raw

args:
- description: A comma-separated list of emails.
  isArray: true
  name: email_values
- description: A comma-separated list of MD5 hashes.
  isArray: true
  name: md5_values
- description: A comma-separated list of IPs.
  isArray: true
  name: ip_values
- description: A comma-separated list of URLs.
  isArray: true
  name: url_values
- description: A comma-separated list of domains.
  isArray: true
  name: domain_values
- description: The indicator type (Itype) of the emails provided. By default the type will be “Malware Email” (mal_email).
  name: email_indicator_type
- description: The indicator type (Itype) of the hashes provided. By default the type will be “Malware MD5” (mal_md5).
  name: md5_indicator_type
- description: The indicator type (Itype) of the ip provided. By default the type will be “Malware IP” (mal_ip).
  name: ip_indicator_type
- description: The indicator type (Itype) of the URLs  provided. By default the type will be “Malware URL” (mal_url).
  name: url_indicator_type
- description: The indicator type (Itype) of the domains provided. By default the type will be “Malware Domain” (mal_domain).
  name: domain_indicator_type
- description: The indicators query, based lucene search syntax.
  name: indicator_query
comment: "Builds A JSON array based on the values provided by the user for the 'threatstream-import-indicator-without-approval' command."
commonfields:
  id: ThreatstreamBuildIocImportJson
  version: -1
name: ThreatstreamBuildIocImportJson
outputs:
- contextPath: ThreatstreamBuildIocImportJson
  description: The string output represents a JSON object.
  type: String
script: '-'
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.8.0
tests:
- No tests (auto formatted)