commonfields: id: Analyst1 version: -1 name: Analyst1 display: Analyst1 category: Data Enrichment & Threat Intelligence provider: Analyst1 sectionorder: - Connect - Collect description: This integration utilizes Analyst1's system to enrich XSOAR indicators with data provided by the Analyst1 REST API, such as actor and malware information, activity and reported dates, evidence and hit counts, and more. configuration: - display: Authentication Method name: auth_method type: 15 required: true defaultvalue: Basic Authentication options: - Basic Authentication - OAuth2 Client Credentials additionalinfo: 'Select how to authenticate with the Analyst1 API. Basic Authentication uses username/password. OAuth2 uses client_id/client_secret from an API Key.' section: Connect - display: Client ID/Username displaypassword: Client Secret/Password name: credentials type: 9 required: true additionalinfo: 'For Basic Auth: enter username and password. For OAuth2: enter client_id and client_secret.' section: Connect - display: Domain of Analyst1 server to use name: server type: 0 required: true additionalinfo: 'Format: server.analyst1.com (do not include http:// or https://)' section: Connect - display: Trust any certificate (not secure) name: insecure defaultvalue: 'false' type: 8 required: false section: Connect - display: Use system proxy settings name: proxy defaultvalue: 'false' type: 8 required: false section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Collect - defaultvalue: Benign name: riskScoreLowest display: 'Risk Score Mapping: Lowest' options: - Unknown - Benign - Suspicious - Malicious type: 15 required: false additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "Lowest". section: Collect - defaultvalue: Unknown name: riskScoreLow display: 'Risk Score Mapping: Low' type: 15 required: false additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "Low". options: - Unknown - Benign - Suspicious - Malicious section: Collect - additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "Moderate". defaultvalue: Suspicious display: 'Risk Score Mapping: Moderate' name: riskScoreModerate options: - Unknown - Benign - Suspicious - Malicious type: 15 required: false section: Collect - additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "High". defaultvalue: Suspicious display: 'Risk Score Mapping: High' name: riskScoreHigh options: - Unknown - Benign - Suspicious - Malicious type: 15 required: false section: Collect - additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "Critical". defaultvalue: Malicious display: 'Risk Score Mapping: Critical' name: riskScoreCritical options: - Unknown - Benign - Suspicious - Malicious type: 15 required: false section: Collect - additionalinfo: XSOAR Verdict to set when Analyst1 Risk Score is "Unknown" or not present. defaultvalue: Unknown display: 'Risk Score Mapping: Unknown' name: riskScoreUnknown options: - Unknown - Benign - Suspicious - Malicious type: 15 required: false section: Collect - display: Apply Analyst1 entity-type tags to indicators name: applyTags defaultvalue: 'false' type: 8 required: false additionalinfo: 'Enable to automatically tag indicators with Analyst1 entity type classifications (e.g., "Analyst1: Indicator", "Analyst1: Asset", "Analyst1: In Private Range"). Tags help identify how Analyst1 classifies each indicator.' section: Collect - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Collect - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false section: Collect script: script: '-' type: python commands: - name: domain arguments: - name: domain required: true description: The domain for which to return information. default: true isArray: true outputs: - contextPath: Domain.Name description: The domain name, for example, "google.com". type: string - contextPath: Analyst1.Domain.ID description: The indicator's unique ID in Analyst1. type: number - contextPath: Analyst1.Domain.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Domain.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Domain.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Domain.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Domain.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Domain.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Domain.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Domain.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Domain.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Domain.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Domain.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Domain.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Domain.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Domain.IpResolution description: The resolved IP address for this domain. type: string - contextPath: Analyst1.Domain.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String description: Queries the Analyst1 REST API and enriches the given domain with Analyst1 Indicator data. - name: email arguments: - name: email required: true description: The email for which to return information. default: true isArray: true outputs: - contextPath: Email.From description: The sender of the email. type: string - contextPath: Analyst1.Email.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.Email.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Email.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Email.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Email.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Email.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Email.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Email.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Email.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Email.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Email.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Email.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Email.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Email.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Email.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String description: Queries the Analyst1 REST API and enriches the given email with Analyst1 indicator data. - name: ip arguments: - name: ip required: true description: The IP address for which to return information. default: true isArray: true outputs: - contextPath: IP.Address description: The IP address. type: string - contextPath: Analyst1.Ip.ID description: The indicator's unique ID in Analyst1. type: number - contextPath: Analyst1.Ip.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Ip.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Ip.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Ip.FirstHit description: The first date this this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Ip.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Ip.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Ip.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Ip.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Ip.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Ip.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Ip.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Ip.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Ip.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Ip.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String description: Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data. - name: file arguments: - name: file required: true description: The file for which to return information. default: true isArray: true outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: Analyst1.File.ID description: The indicator's unique ID in Analyst1. type: number - contextPath: Analyst1.File.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.File.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.File.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.File.FirstHit description: The first date this this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.File.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.File.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.File.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.File.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.File.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.File.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.File.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.File.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.File.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.File.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String description: Queries the Analyst1 REST API and enriches the given file with Analyst1 indicator data. - name: analyst1-enrich-string arguments: - name: string required: true description: The string for which to return information. isArray: true outputs: - contextPath: Analyst1.String.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.String.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.String.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.String.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.String.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.String.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.String.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.String.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.String.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.String.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.String.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.String.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.String.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.String.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.String.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string description: Queries the Analyst1 REST API and enriches the given string with Analyst1 indicator data. - name: analyst1-enrich-ipv6 arguments: - name: ip required: true description: The IP address for which to return information. isArray: true outputs: - contextPath: Analyst1.Ipv6.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.Ipv6.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Ipv6.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Ipv6.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Ipv6.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Ipv6.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Ipv6.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Ipv6.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Ipv6.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Ipv6.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Ipv6.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Ipv6.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Ipv6.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Ipv6.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Ipv6.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string description: Queries the Analyst1 REST API and enriches the given IP address with Analyst1 indicator data. - name: analyst1-enrich-mutex arguments: - name: mutex required: true description: The mutex to query information for. isArray: true outputs: - contextPath: Analyst1.Mutex.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.Mutex.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Mutex.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Mutex.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Mutex.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Mutex.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Mutex.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Mutex.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Mutex.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Mutex.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Mutex.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Mutex.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Mutex.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Mutex.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Mutex.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string description: Queries the Analyst1 REST API and enriches the given mutex with Analyst1 indicator data. - name: analyst1-enrich-http-request arguments: - name: http-request required: true description: The HTTP request for which to return information. isArray: true outputs: - contextPath: Analyst1.Httprequest.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.Httprequest.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Httprequest.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Httprequest.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Httprequest.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Httprequest.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Httprequest.HitCount description: The total number of times this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Httprequest.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Httprequest.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Httprequest.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Httprequest.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Httprequest.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Httprequest.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Httprequest.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Httprequest.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string description: Queries the Analyst1 REST API and enriches the given HTTP request with Analyst1 indicator data. - name: url arguments: - name: url required: true description: The URL for which to return information. default: true isArray: true outputs: - contextPath: URL.Data description: The URL. type: String - contextPath: Analyst1.Url.ID description: The unique identifier of the given Indicator in Analyst1. type: number - contextPath: Analyst1.Url.EvidenceCount description: The number of evidence reports of the given indicator in Analyst1. type: number - contextPath: Analyst1.Url.Active description: Whether the given indicator is noted as active in Analyst1. type: boolean - contextPath: Analyst1.Url.ConfidenceLevel description: The confidence level of the data in Analyst1. type: string - contextPath: Analyst1.Url.FirstHit description: The first date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Url.LastHit description: The most recent date this indicator was seen in a source scanned by Analyst1. type: date - contextPath: Analyst1.Url.HitCount description: The total number of this indicator was seen in a source scanned by Analyst1. type: number - contextPath: Analyst1.Url.ReportedDates description: The dates this indicator was reported on in Analyst1. type: date - contextPath: Analyst1.Url.ActivityDates description: The dates this indicator had reported activity in Analyst1. type: date - contextPath: Analyst1.Url.Malwares.ID description: Each matched malware unique identifier in Analyst1. type: number - contextPath: Analyst1.Url.Malwares.Name description: Each matched malware name in Analyst1. type: string - contextPath: Analyst1.Url.Actors.ID description: Each matched actor unique identifier in Analyst1. type: number - contextPath: Analyst1.Url.Actors.Name description: Each matched actor name in Analyst1. type: string - contextPath: Analyst1.Url.Analyst1Link description: The URL of the matched indicator in Analyst1. type: string - contextPath: Analyst1.Url.RiskScore description: The Analyst1 risk score for this indicator (Lowest, Low, Moderate, High, Critical, Unknown). type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Numbe - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String description: Queries the Analyst1 REST API and enriches the given URL with Analyst1 indicator data. - name: analyst1-get-sensor-taskings arguments: - name: sensor_id required: true description: Sensor ID number for this Analyst1 instance. - name: timeout default: true description: Overrides the XSOAR default of 10s for timeout. Default Analsyt1 app is 200s for this command. Caller may further override as required. defaultValue: '200' outputs: - contextPath: Analyst1.SensorTaskings description: Root JSON for processing all taskings data. - contextPath: Analyst1.SensorTaskings.id description: Sensor ID for this Taskings response. - contextPath: Analyst1.SensorTaskings.version description: Current version of the Sensor. - contextPath: Analyst1.SensorTaskings.Indicators description: Current array of Indicators tasked. - contextPath: Analyst1.SensorTaskings.Rules description: Current array of Signatures tasked. description: 'Queries the Analyst1 REST API for the current sensor taskings given a valid Sensor ID. This can be used to start subscription to an Sensor ID. The result gives the version (which can later be used to invoke ''diff'') and all current taskings. Note: This operation may trigger XSOAR to "oversize" the task built on this automation. If so, you may need to turn off quiet mode explicitly. The analyst1-get-sensor-config can alternatively be used to get a simple text file of current indicators or signatures.' - name: analyst1-get-sensors arguments: - name: page description: page of Sensors to iterate. defaultValue: '1' type: unknown - name: pageSize default: true description: size of each page of Sensors to iterate. Maximum 50. defaultValue: '50' description: Queries the Analyst1 REST API to retrieve a list of registered sensors. - name: analyst1-batch-check arguments: - name: values required: true isArray: true description: Comma delimited set of possible Indicator or other Observable values. Submit as a basic string input with commas separating each value. For more complex or higher volume batches, use analyst1-batch-check-post. outputs: - contextPath: Analyst1.BatchResults.ID description: Matched ID values. May not all be Indicators. Could reflect Indicator, Asset, Ignore List, or System records. - contextPath: Analyst1.BatchResults.matchedValue description: The matched terms from Indicators, Assets, Ignore List, or System CIDR entries. - contextPath: Analyst1.BatchResults description: Full Batch Check JSON. description: Queries the Analyst1 REST API for indicator enrichment data based on a CSV input of multiple indicator values. - name: analyst1-get-sensor-config arguments: - name: sensor_id required: true description: Sensor ID number for this Analyst1 instance. outputs: - contextPath: Analyst1.SensorTaskings.ConfigFile.config_text description: full text of the current configuration file for the Sensor. - contextPath: Analyst1.SensorTaskings.ConfigFile.warRoomEntry.FileID description: FileID from invoking fileResult() in the Common Server Functions. An alternative to the returned config_text in case file processing is preferred. - contextPath: Analyst1.SensorTaskings.ConfigFile.warRoomEntry.File description: File Name as saved on the War Room file with fileResult(). description: Queries the Analyst1 REST API for the current sensor config given a valid Sensor ID. This config file is meant to be directly provided to a device (IDS, IPS, Firewall, SNORT...) for configuration replacements. - name: analyst1-get-sensor-diff arguments: - name: sensor_id required: true description: ID# of the Sensor record in Analyst1. - name: version required: true description: Non zero version of the known Sensor. - name: timeout default: true description: Overrides the XSOAR default of 10s for timeout. Default Analsyt1 app is 200s for this command. Caller may further override as required. defaultValue: '200' outputs: - contextPath: Analyst1.SensorTaskings.ID description: Sensor ID. - contextPath: Analyst1.SensorTaskings.latestVersion description: Current version of the Sensor. Meant to be saved and used on subsequent invocations to 'diff' to only get the latest changes. - contextPath: Analyst1.SensorTaskings.version description: Version which was provided as an input to make this result set. - contextPath: Analyst1.SensorTaskings.IndicatorsAdded description: Array of Indicators added between version and latestVersion. Type can be used to limit hash values for action. - contextPath: Analyst1.SensorTaskings.IndicatorsRemoved description: Array of Indicators removed between version and latestVersion. Type can be used to limit hash values for action. - contextPath: Analyst1.SensorTaskings.RulesAdded description: Array of Rules added between version and latestVersion. - contextPath: Analyst1.SensorTaskings.RulesRemoved description: Array of Rules removed between version and latestVersion. description: Gets the 'difference' from the last known Analyst1 Sensor version against the current. Returns all differences on the Sensor since the 'version' provided and includes the current version in the reply. Current version should be preserved to be used on next scheduled invocation. - name: analyst1-indicator-by-id arguments: - name: indicator_id required: true description: Internal Analyst1 Indicator ID. outputs: - contextPath: Analyst1.Indicator description: Full Analyst1 native JSON for the Indicator. Will include all attributes, associated sources, enrichment results, and all settings as seen in the Analyst1 UI. description: Gets the full JSON for an Analyst1 Indicator given the internal Analyst1 Indicator ID. Use this when full Indicator context is required for additional processing. This always includes all sources, enrichments, and every piece of information available in the Analyst1 platform, including integrated system's original enrichment JSON or results. - name: analyst1-batch-check-post arguments: - name: values description: Comma or newline delimited text for many Indicator or other observable inputs. Either values_array or values must be provided. - name: values_array description: Array of text, each being an Indicator or other observable value to search. Either values_array or values must be provided. outputs: - contextPath: Analyst1 description: Full Batch Check JSON. - contextPath: Analyst1.ID description: Matched ID values. May not all be Indicators. Could reflect Indicator, Asset, Ignore List, or System records. - contextPath: Analyst1.matchedValue description: The matched terms from Indicators, Assets, Ignore List, or System CIDR entries. description: Similar to analyst1-batch-check, however the inputs can be more complex. The 'values' input accepts comma or newline delimited text. This allows for more complex Indicators or larger Indicator sets to be searched. The 'values_array' allows for preformed array inputs or array-like inputs to be submitted. Output is the same. - name: analyst1-evidence-submit arguments: - name: sourceId required: true description: Analyst1 ID# of the Source to associate the Evidence. It is a best practice to create a 'Reference' source in Analyst1 to which XSOAR may submit. - name: fileContent description: Content of the Evidence to create within Analyst1. Should be used when content is TXT or JSON. Use fileEntryId for attachments in XSOAR context. One of fileContent or fileEntryId must be included. - name: tlp description: Traffic Light Protocol (TLP) value for the Evidence. If the Evidence is TLP marked that will override this input as the a1bot finds the TLP markings. defaultValue: GREEN - name: fileClassification default: true description: Government classification of the Evidence. Ignore if not operating in a Military/Government capacity. defaultValue: U - name: fileName required: true description: Name of the 'file' as it was received as an attachment/download, or as it should be represented in Analyst1. Will become the default 'title' of the created Evidence record. File extension will be used in MIME type discovery which does influence extraction by a1bot. - name: fileEntryId description: Entry ID in XSOAR context. How the File was acquired matters. For instance, if using the http command, setting saveAsFile=yes is very important or the original, real format will be lost in a {"Body":"encoded file"} wrapping. One of fileContent or fileEntryId must be included. outputs: - contextPath: Analyst1.EvidenceSubmit.uuid description: The unique GUID tracking this specific Evidence's submission. Can be used to monitor to finish extraction. If empty, check 'message'. - contextPath: Analyst1.EvidenceSubmit.message description: An explanation of the error which occurred that prevented acceptance of the Evidence submission. description: Submits an 'Evidence' to Analyst1. Submission can be any text or attachment (PDF, JSON,DOCX...). The a1Bot will extract all relevant context. The 'Evidence' can from an external source (email attachment, secure download) or constructed text/JSON within XSOAR to communicate intelligence results back to Analyst1. - name: analyst1-evidence-status arguments: - name: uuid required: true description: Identifier from an Evidence Submission to track status. outputs: - contextPath: Analyst1.EvidenceStatus.id description: Evidence ID created by the submission. If 'blank' and message is 'blank', indicates the upload is still procesing. - contextPath: Analyst1.EvidenceStatus.message description: If populated, will communicate errors which occurred with the status check or the upload processing. - contextPath: Analyst1.EvidenceStatus.processingComplete description: True or false to indicate if processing of the Evidence upload is done. Determined by evaluating the id or message are present and populated. If an id is returned but blank, this is false, indicating the upload is still in progress. description: Check on the status of the analyst1-evidence-submit action by using its output UUID. - name: analyst1-evidence-search description: Search for evidence in Analyst1 using filters and search terms. arguments: - name: search_term description: Free text search term (e.g., "black basta", "malware campaign"). required: false - name: page description: Results page number (1-indexed). required: false defaultValue: '1' - name: page_size description: Number of results per page (1-100). required: false defaultValue: '50' - name: evidence_type description: Filter by evidence type. required: false auto: PREDEFINED predefined: - pcap - image - pdf - txt - web - incident_04 - stix - caseType - spreadsheet - doc - ppt - xml - other - name: tlp description: Filter by TLP color. required: false isArray: true auto: PREDEFINED predefined: - UNDETERMINED - CLEAR - GREEN - AMBER - AMBER+STRICT - RED - name: actor_id description: Filter by actor ID. required: false - name: source_id description: Filter by source ID. required: false isArray: true - name: analyzed_state description: Filter by analyzed state. required: false auto: PREDEFINED predefined: - r - b - g - name: analyzed_date_from description: Filter by analyzed date from (ISO-8601 format, e.g., 2024-01-01). required: false - name: analyzed_date_to description: Filter by analyzed date to (ISO-8601 format, e.g., 2024-12-31). required: false - name: sort_by description: Field to sort results by. required: false defaultValue: id auto: PREDEFINED predefined: - id - analyzed - indicatorsStatus - title - tlp - type - exploitStage - attackPattern - activityDate - reportedDate - assignedTo - name: desc_sort description: Sort results in descending order. required: false defaultValue: 'true' auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: Analyst1.Evidence.id description: Evidence unique ID. type: Number - contextPath: Analyst1.Evidence.title description: Evidence title. type: String - contextPath: Analyst1.Evidence.type description: Evidence type (e.g., pdf, pcap, web). type: String - contextPath: Analyst1.Evidence.tlp description: Traffic Light Protocol (TLP) designation. type: String - contextPath: Analyst1.Evidence.analyzed description: Whether the evidence has been analyzed. type: Boolean - contextPath: Analyst1.Evidence.indicatorsStatus description: Status of indicators extracted from evidence. type: String - contextPath: Analyst1.Evidence.activityDate description: Activity date associated with evidence. type: Date - contextPath: Analyst1.Evidence.reportedDate description: Date evidence was reported. type: Date - contextPath: Analyst1.Evidence.assignedTo description: User assigned to the evidence. type: String - name: analyst1-evidence-file-fetch description: Download an evidence file from Analyst1 by its ID. arguments: - name: evidence_id description: The Evidence ID to download. required: true outputs: - contextPath: File.Name description: The name of the downloaded file. type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.EntryID description: The XSOAR entry ID of the downloaded file. type: String dockerimage: demisto/python3:3.12.13.10116658 subtype: python3 runonce: false fromversion: 5.0.0 tests: - Analyst1 Integration Demonstration - Test - Analyst1 Integration Test