category: Data Enrichment & Threat Intelligence provider: AT&T Cybersecurity sectionorder: - Connect - Collect commonfields: id: AlienVault OTX v2 version: -1 configuration: - defaultvalue: https://otx.alienvault.com display: Server address name: url required: true type: 0 section: Connect - name: credentials type: 9 displaypassword: API Token hiddenusername: true section: Connect required: false - display: API Token name: api_token type: 4 hidden: true section: Connect required: false - defaultvalue: '2' display: Indicator Threshold. The minimum number of pulses to consider the indicator as malicious. name: default_threshold type: 0 section: Collect advanced: true required: false - defaultvalue: '2' display: Minimum number of validated sources to consider the indicator as benign. additionalinfo: Specifies the minimum number of entries in the API response's "validation" field in order for the indicator to be considered benign. name: min_valid_sources type: 0 section: Collect advanced: true required: false - defaultvalue: '10' display: Maximum number of relationships for indicators name: max_indicator_relationships type: 0 additionalinfo: If not provided, no relationships will be added. This field is relevant only for url, file hash and ip / domain indicators. section: Collect advanced: true required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability required: true type: 15 options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Collect - defaultvalue: 'true' additionalinfo: Create relationships between indicators as part of Enrichment. display: Create relationships name: create_relationships type: 8 section: Collect advanced: true required: false - defaultvalue: 'true' additionalinfo: The AlienVault OTX API raise an error when an item is not found. Disable this parameter in order to return a warning instead. display: Should Error When Not Found name: should_error type: 8 section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false description: Query Indicators of Compromise in AlienVault OTX. display: AlienVault OTX v2 name: AlienVault OTX v2 script: commands: - arguments: - default: true description: The IP address to query. isArray: true name: ip required: true - description: If the number of pulses is bigger than the threshold, the IP address is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Queries an IP address in AlienVault OTX. name: ip outputs: - contextPath: IP.Address description: The address of the IP. type: String - contextPath: IP.ASN description: The autonomous system name for the IP address. For example, "AS8948". type: String - contextPath: IP.Geo.Country description: The country where the IP address is located. type: String - contextPath: IP.Geo.Location description: 'The geolocation where the IP address is located, in the format: latitude:longitude.' type: String - contextPath: AlienVaultOTX.IP.Reputation description: The reputation of the IP address. type: String - contextPath: AlienVaultOTX.IP.IP description: IP address. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: IP.Relationships.EntityA description: The source of the relationship. type: string - contextPath: IP.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: IP.Relationships.Relationship description: The name of the relationship. type: string - contextPath: IP.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: IP.Relationships.EntityBType description: The type of the destination of the relationship. type: string - arguments: - default: true description: The domain to query. isArray: true name: domain required: true - description: If the number of pulses is bigger than the threshold, the domain is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Queries a domain in AlienVault OTX. name: domain outputs: - contextPath: Domain.Name description: The domain name. For example, "google.com". type: String - contextPath: AlienVaultOTX.Domain.Alexa description: Alexa URL for the domain data. type: String - contextPath: AlienVaultOTX.Domain.Whois description: Whois URL for the domain data. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: Domain.Relationships.EntityA description: The source of the relationship. type: string - contextPath: Domain.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: Domain.Relationships.Relationship description: The name of the relationship. type: string - contextPath: Domain.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: Domain.Relationships.EntityBType description: The type of the destination of the relationship. type: string - arguments: - default: true description: The IP address to query. name: ip required: true - description: If the number of pulses is bigger than the threshold, the IP address is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Queries IPv6 in AlienVault OTX. name: alienvault-search-ipv6 outputs: - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.ASN description: The autonomous system name for the IP address. For example, "AS8948". type: String - contextPath: IP.AlienVaultOTX.Reputation description: The IP reputation in AlienVault OTX. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - arguments: - default: true description: The host name to query. name: hostname required: true - description: If the number of pulses is bigger than the threshold, the host name is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Searches for a host name in AlienVault OTX. name: alienvault-search-hostname outputs: - contextPath: Endpoint.Hostname description: The hostname that is mapped to the endpoint. type: String - contextPath: AlienVaultOTX.Endpoint.Hostname description: The hostname that is mapped to the endpoint. type: String - contextPath: AlienVaultOTX.Endpoint.Alexa description: The Alexa URL endpoint. type: String - contextPath: AlienVaultOTX.Endpoint.Whois description: The Whois URL endpoint. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - arguments: - default: true description: The file hash to query. isArray: true name: file required: true - description: If the number of pulses is bigger than the threshold, the file is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Query a file in AlienVault OTX. name: file outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Malicious.PulseIDs description: IDs of pulses which are marked as malicious. type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.SSDeep description: The SSDeep hash of the file (same as displayed in file entries). type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - arguments: - default: true description: The CVE to query. name: cve_id required: true - description: If the number of pulses is bigger than the threshold, the CVE is considered as malicious. If the threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Query Common Vulnerabilities and Exposures (CVE) in AlienVault OTX. name: alienvault-search-cve outputs: - contextPath: CVE.ID description: The ID of the CVE. For example, "CVE-2015-1653". type: String - contextPath: CVE.CVSS description: The CVSS of the CVE. For example, "10.0". type: String - contextPath: CVE.Published description: The timestamp of when the CVE was published. type: String - contextPath: CVE.Modified description: The timestamp of when the CVE was last modified. type: String - contextPath: CVE.Description description: A description of the CVE. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - arguments: - auto: PREDEFINED description: 'The indicator type. Can be: "IPv4", "IPv6", "domain", "hostname", or "url".' name: indicator_type predefined: - IPv4 - IPv6 - domain - hostname - url required: true - description: The indicator for which to search related URLs. name: indicator required: true description: Returns related URLs by indicator. name: alienvault-get-related-urls-by-indicator outputs: - contextPath: AlienVaultOTX.URL.Data description: The path of the related URLs. type: Unknown - arguments: - description: The indicator for which to search for related hashes. name: indicator - auto: PREDEFINED description: 'The indicator type. Can be: "IPv4", "IPv6", "domain", or "hostname".' name: indicator_type predefined: - IPv4 - IPv6 - domain - hostname description: Returns related hashes by indicator. name: alienvault-get-related-hashes-by-indicator outputs: - contextPath: AlienVaultOTX.File.Hash description: The path of the url. type: Unknown - arguments: - auto: PREDEFINED description: 'The indicator type. Can be: "IPv4", "IPv6", "domain", or "hostname".' name: indicator_type predefined: - IPv4 - IPv6 - domain - hostname required: true - description: The indicator for which to search URLs. name: indicator required: true description: Returns passive DNS records by indicator. name: alienvault-get-passive-dns-data-by-indicator outputs: - contextPath: AlienVaultOTX.PassiveDNS.Hostname description: The domain value. type: String - contextPath: AlienVaultOTX.PassiveDNS.IP description: The IP passive DNS. type: String - contextPath: AlienVaultOTX.PassiveDNS.Domain description: The domain value. type: String - contextPath: AlienVaultOTX.PassiveDNS.Type description: The asset type. type: String - contextPath: AlienVaultOTX.PassiveDNS.FirstSeen description: The date first seen. type: Date - contextPath: AlienVaultOTX.PassiveDNS.LastSeen description: The date last seen. type: Date - arguments: - default: true description: The page of the pulse to retrieve. name: page required: true description: Searches for pulses in AlienVault OTX. name: alienvault-search-pulses outputs: - contextPath: AlienVaultOTX.Pulses.ID description: The ID of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Author.ID description: The ID of the Author. type: String - contextPath: AlienVaultOTX.Pulses.Author.Username description: The username of the Author. type: String - contextPath: AlienVaultOTX.Pulses.Count description: The pulse count. type: String - contextPath: AlienVaultOTX.Pulses.Modified description: The date of the pulse modification. type: Date - contextPath: AlienVaultOTX.Pulses.Name description: The name of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Source description: The source of the Pulse. type: String - contextPath: AlienVaultOTX.Pulses.SubscriberCount description: The count of the pulse subscriber. type: String - contextPath: AlienVaultOTX.Pulses.Tags description: The tags of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Description description: The description of the pulse. type: String - arguments: - default: true description: The ID of the pulse. name: pulse_id required: true description: Returns pulse details. name: alienvault-get-pulse-details outputs: - contextPath: AlienVaultOTX.Pulses.Created description: The date the pulse was created. type: Date - contextPath: AlienVaultOTX.Pulses.Author.Username description: The author username of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.ID description: The ID of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Name description: The name of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Tags description: The tags of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.TargetedCountries description: The targeted countries of the pulse. type: String - contextPath: AlienVaultOTX.Pulses.Description description: The description of the pulse. type: String - arguments: - default: true description: The URL to query. isArray: true name: url required: true - description: If the number of pulses is bigger than the threshold, the URL is considered as malicious. If threshold is not specified, the default indicator threshold is used, which is configured in the instance settings. name: threshold description: Queries a URL in AlienVault OTX. name: url outputs: - contextPath: URL.Data description: The URL. type: String - contextPath: AlienVaultOTX.URL.Hostname description: The host name of the URL. type: String - contextPath: AlienVaultOTX.URL.Domain description: The domain of the URL. type: String - contextPath: AlienVaultOTX.URL.Alexa description: The domain data for the Alexa URL. type: String - contextPath: AlienVaultOTX.URL.Url description: Url. type: String - contextPath: AlienVaultOTX.URL.Whois description: The Whois URL for domain data. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: string - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: string - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' type: python subtype: python3 tests: - Alienvault_OTX_v2 - Test fromversion: 5.0.0