TopMaliciousRatioIndicators

Find the top malicious ratio indicators. Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.

python · Common Scripts

Details

ID	`TopMaliciousRatioIndicators`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	widget

README

Finds the top malicious ratio indicators. The malicious ratio is defined by the ratio between the number of “bad” incidents divided by the total number of incidents that the indicators appears in.

Script Data

Name	Description
Script Type	python
Tags	widget
Cortex XSOAR Version	4.0.0+

Inputs

Argument Name	Description
maxNumberOfIndicators	The maximum number of indicators for malicious ratio calculation.
minimumNumberOfInvs	The minimum number of investigations the indicator has to appear in.
maximumNumberOfResults	The maximum number of results to display.

Outputs

There are no outputs for this script.

Source

TopMaliciousRatioIndicators.py TopMaliciousRatioIndicators_test.py TopMaliciousRatioIndicators.yml

Download History Raw

commonfields:
  id: TopMaliciousRatioIndicators
  version: -1
name: TopMaliciousRatioIndicators
fromversion: "5.0.0"
script: ''
type: python
subtype: python3
tags:
- widget
comment: |-
  Find the top malicious ratio indicators.
  Malicious ratio is defined by the ratio between the number of "bad" incidents divided by the number of total number of incidents that the indicators appears in.
enabled: true
args:
- name: maxNumberOfIndicators
  description: Maximum number of indicators for malicious ratio calculation.
  defaultValue: "1000"
- name: minimumNumberOfInvs
  description: Minimum number of investigation the indicator has to appear in.
  defaultValue: "3"
- name: maximumNumberOfResults
  description: Maximum number of results to display.
  defaultValue: "100"
scripttarget: 0
dockerimage: demisto/python3:3.12.13.10404775
tests:
- No tests (auto formatted)