category: Data Enrichment & Threat Intelligence
provider: Anomali
commonfields:
  id: Anomali Enterprise
  version: -1
configuration:
- defaultvalue: https://127.0.0.1:8080
  display: Server URL (e.g., https://www.test.com)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: Use Anomali Match to search indicators and enrich domains.
display: Anomali Match
name: Anomali Enterprise
script:
  commands:
  - arguments:
    - description: 'The time the indicators first appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is 1 day ago.'
      name: from
    - description: 'The time the indicators last appeared, in the format: <number> <time unit>, e.g., 1 hour, 30 minutes. Default is now.'
      name: to
    - description: A comma-separated list of indicators to search.
      isArray: true
      name: indicators
      required: true
    description: Initiates a forensic search of the indicators.
    name: anomali-enterprise-retro-forensic-search
    outputs:
    - contextPath: AnomaliEnterprise.ForensicSearch.job_id
      description: The job ID of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.status
      description: The status of the search.
      type: String
  - arguments:
    - description: The forensic search job ID.
      isArray: true
      name: job_id
      required: true
    - defaultValue: '20'
      description: Limit the stream results to return. Default is 20.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Whether to print the stream results to the War Room. Default is "true".
      predefined:
      - 'false'
      - 'true'
      name: verbose
    description: Retrieves the forensic search results.
    name: anomali-enterprise-retro-forensic-search-results
    outputs:
    - contextPath: AnomaliEnterprise.ForensicSearch.job_id
      description: The job ID of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.status
      description: The status of the search.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.scannedEvents
      description: The number of scanned events.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.processedFiles
      description: The number of processed files.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.result_file_name
      description: The matched file name.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.totalMatches
      description: The number of total matches.
      type: Number
    - contextPath: AnomaliEnterprise.ForensicSearch.complete
      description: Whether the search was complete.
      type: Bool
    - contextPath: AnomaliEnterprise.ForensicSearch.category
      description: The search category.
      type: String
    - contextPath: AnomaliEnterprise.ForensicSearch.streamResults
      description: The stream results for the search.
      type: Unknown
  - arguments:
    - description: A comma-separated list of domains to search.
      isArray: true
      name: domains
      required: true
    description: The search domains Domain Generation Algorithm (DGA).
    name: anomali-enterprise-dga-domain-status
    outputs:
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The domain that was checked.
      type: String
    - contextPath: AnomaliEnterprise.DGA.malware_family
      description: The malware family associated with the domain.
      type: String
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The probability of the domain being malicious.
      type: Number
  - arguments:
    - default: true
      description: A comma-separated list of domains to search.
      isArray: true
      name: domain
    description: The search domains Domain Generation Algorithm (DGA). Includes DBotScore and domain information.
    name: domain
    outputs:
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The domain that was checked.
      type: String
    - contextPath: AnomaliEnterprise.DGA.malware_family
      description: The malware family associated with the domain.
      type: String
    - contextPath: AnomaliEnterprise.DGA.domain
      description: The probability of the domain being malicious.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: Domain.Name
      description: The domain name. For example, "google.com".
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor that reported that the domain is malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description of the malicious domain.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- Anomali Match Forensic Search - Test