TransformIndicatorToMSDefenderIOC

Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the *microsoft-atp-indicator-batch-update* command.

python · Microsoft Defender for Endpoint

Details

IDTransformIndicatorToMSDefenderIOC
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10404775

README

Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the microsoft-atp-indicator-batch-update command.

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description Required
query The indicators query. Required
action The action that will be taken if the indicator will be discovered in the organization. Required
limit The maximum number of indicators to fetch. Optional
offset The results offset page. Only change when the number of the results exceed the limit. Optional

Outputs

Path Description Type
TransformIndicatorToMSDefenderIOC.JsonOutput Json output of the indicators. Should be the input for the *microsoft-atp-indicator-batch-update*. String
TransformIndicatorToMSDefenderIOC.Indicators.indicatorValue The value of the Indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.indicatorType Type of the indicator. Possible values are: FileSha1, FileSha256, FileMd5, CertificateThumbprint, IpAddress, DomainName, Url String
TransformIndicatorToMSDefenderIOC.Indicators.lastUpdateTime The last time the indicator was updated. String
TransformIndicatorToMSDefenderIOC.Indicators.lastUpdatedBy Identity of the user/application that last updated the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.action The action that will be taken if the indicator will be discovered in the organization. Possible values are: “Warn”, “Block”, “Audit”, “Alert”, “AlertAndBlock”, “BlockAndRemediate” and “Allowed”. String
TransformIndicatorToMSDefenderIOC.Indicators.title Indicator title. String
TransformIndicatorToMSDefenderIOC.Indicators.expirationTime The expiration time of the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.description Description of the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.creationTimeDateTimeUtc The date and time when the indicator was created. String
TransformIndicatorToMSDefenderIOC.Indicators.Severity The severity of the indicator. possible values are: Informational, Low, Medium and High. String
TransformIndicatorToMSDefenderIOC.Indicators.application The application associated with the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.externalID Id the customer can submit in the request for custom correlation. String
TransformIndicatorToMSDefenderIOC.Indicators.sourceType User in case the Indicator created by a user. “AadApp” in case it submitted using automated application via the API. String
TransformIndicatorToMSDefenderIOC.Indicators.createdBySource The name of the user or application that submitted the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.createdBy Unique identity of the user or application that submitted the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.recommendedActions Recommended actions for the indicator. String
TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupNames RBAC device group names where the indicator is exposed and active. Empty list in case it exposed to all devices. Unknown
TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupIds RBAC device group ID’s where the indicator is exposed and active. Empty list in case it exposed to all devices. Unknown
TransformIndicatorToMSDefenderIOC.Indicators.generateAlert True if alert generation is required, False if this indicator should not generate an alert. String

More info

  1. Please read about MSDE Indicator resource type here.
  2. Please read about limitations for creating and updating batch of indicators here.
  3. Please read about the required permissions for creating and updating batch of indicators here.

Source

TransformIndicatorToMSDefenderIOC.py TransformIndicatorToMSDefenderIOC_test.py TransformIndicatorToMSDefenderIOC.yml
Download History Raw 
args:
- description: The indicators query.
  name: query
  required: true
- auto: PREDEFINED
  description: The action that will be taken if the indicator will be discovered in the organization.
  name: action
  predefined:
  - Warn
  - Block
  - Audit
  - Alert
  - AlertAndBlock
  - BlockAndRemediate
  - Allowed
  required: true
- defaultValue: '10000'
  description: The maximum number of indicators to fetch.
  name: limit
- defaultValue: '0'
  description: The results offset page. Only change when the number of the results exceed the limit.
  name: offset
comment: Transform a XSOAR indicator into a Microsoft Defender for Endpoint IOC. The output (at TransformIndicatorToMSDefenderIOC.JsonOutput) is a json representation of the indicators in MSDE format. This json can be the input for the *microsoft-atp-indicator-batch-update* command.
commonfields:
  id: TransformIndicatorToMSDefenderIOC
  version: -1
name: TransformIndicatorToMSDefenderIOC
outputs:
- contextPath: TransformIndicatorToMSDefenderIOC.JsonOutput
  description: Json output of the indicators. Should be the input for the *microsoft-atp-indicator-batch-update*.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.indicatorValue
  description: The value of the Indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.indicatorType
  description: 'Type of the indicator. Possible values are: FileSha1, FileSha256, FileMd5, CertificateThumbprint, IpAddress, DomainName, Url.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.lastUpdateTime
  description: The last time the indicator was updated.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.lastUpdatedBy
  description: Identity of the user/application that last updated the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.action
  description: 'The action that will be taken if the indicator will be discovered in the organization. Possible values are: "Warn", "Block", "Audit", "Alert", "AlertAndBlock", "BlockAndRemediate" and "Allowed".'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.title
  description: Indicator title.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.expirationTime
  description: The expiration time of the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.description
  description: Description of the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.creationTimeDateTimeUtc
  description: The date and time when the indicator was created.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.Severity
  description: 'The severity of the indicator. possible values are: Informational, Low, Medium and High.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.application
  description: The application associated with the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.externalID
  description: Id the customer can submit in the request for custom correlation.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.sourceType
  description: 'User in case the Indicator created by a user. "AadApp" in case it submitted using automated application via the API.'
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.createdBySource
  description: The name of the user or application that submitted the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.createdBy
  description: Unique identity of the user or application that submitted the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.recommendedActions
  description: Recommended actions for the indicator.
  type: String
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupNames
  description: RBAC device group names where the indicator is exposed and active. Empty list in case it exposed to all devices.
  type: Unknown
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.rbacGroupIds
  description: RBAC device group ID's where the indicator is exposed and active. Empty list in case it exposed to all devices.
  type: Unknown
- contextPath: TransformIndicatorToMSDefenderIOC.Indicators.generateAlert
  description: True if alert generation is required, False if this indicator should not generate an alert.
  type: String
script: '-'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: 6.0.0
tests:
- No tests (auto formatted)