category: Data Enrichment & Threat Intelligence provider: Anomali commonfields: id: Anomali ThreatStream v2 version: -1 deprecated: true configuration: - defaultvalue: https://api.threatstream.com display: Server URL (e.g., https://www.test.com) name: url required: true type: 0 - display: Username name: credentials type: 9 displaypassword: API Key required: false - display: Username name: username type: 0 hidden: true required: false - display: API Key name: apikey type: 4 hidden: true required: false - defaultvalue: high display: Threshold of the indicator. name: default_threshold options: - low - medium - high - very-high required: true type: 15 - defaultvalue: 'B - Usually reliable' display: Source Reliability name: integrationReliability required: true type: 15 additionalinfo: Reliability of the source providing the intelligence data. options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged - display: Trust any certificate (not secure) name: insecure type: 8 defaultvalue: 'false' required: false - display: Use system proxy settings name: proxy type: 8 required: false defaultclassifier: 'null' description: Deprecated. Use Anomali ThreatStream v3 integration instead. display: Anomali ThreatStream v2 (Deprecated) name: Anomali ThreatStream v2 script: commands: - arguments: - default: true description: The IP to check. isArray: true name: ip required: true - auto: PREDEFINED description: If severity is greater than or equal to the threshold, then the IP address will be considered malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high". name: threshold predefined: - low - medium - high - very-high - auto: PREDEFINED defaultValue: 'False' description: Whether to include results with an inactive status. Default is "False". name: include_inactive predefined: - 'True' - 'False' description: Checks the reputation of the given IP address. name: ip outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: IP.ASN description: The Autonomous System (AS) number associated with the indicator. type: String - contextPath: IP.Address description: The IP address of the indicator. type: String - contextPath: IP.Geo.Country description: The country associated with the indicator. type: String - contextPath: IP.Geo.Location description: The longitude and latitude of the IP address. type: String - contextPath: ThreatStream.IP.ASN description: The Autonomous System (AS) number associated with the indicator. type: String - contextPath: ThreatStream.IP.Address description: The IP address of the indicator. type: String - contextPath: ThreatStream.IP.Country description: The country associated with the indicator. type: String - contextPath: ThreatStream.IP.Type description: The indicator type. type: String - contextPath: ThreatStream.IP.Modified description: 'The time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.' type: String - contextPath: ThreatStream.IP.Severity description: The indicator severity ("very-high", "high", "medium", or "low"). type: String - contextPath: ThreatStream.IP.Confidence description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence. type: String - contextPath: ThreatStream.IP.Status description: The status assigned to the indicator. type: String - contextPath: ThreatStream.IP.Organization description: The name of the business that owns the IP address associated with the indicator. type: String - contextPath: ThreatStream.IP.Source description: The source of the indicator. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: IP.Malicious.Vendor description: The vendor that reported the indicator as malicious. type: String - contextPath: ThreatStream.IP.Tags description: Tags assigned to the IP. type: Unknown - contextPath: IP.Tags description: (List) Tags of the IP. type: Unknown - arguments: - default: true description: The domain name to check. isArray: true name: domain required: true - auto: PREDEFINED description: If the severity is greater than or equal to the threshold, the IP address is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high". name: threshold predefined: - low - medium - high - very-high - auto: PREDEFINED defaultValue: 'False' description: Whether to include results with an inactive status. Default is "False". name: include_inactive predefined: - 'True' - 'False' description: Checks the reputation of the given domain name. name: domain outputs: - contextPath: Domain.Name description: The domain name. type: String - contextPath: Domain.DNS description: 'The IP addresses resolved by DNS. ' type: String - contextPath: Domain.WHOIS.CreationDate description: |- The date when the domain was created. The date format is: YYYYMMDDThhmmss. Where T denotes the start of the value for time, in UTC time. type: Date - contextPath: Domain.WHOIS.UpdatedDate description: |- The date when the domain was last updated. The date format is: YYYYMMDDThhmmss. Where T denotes the start of the value for time, in UTC time. type: Date - contextPath: Domain.WHOIS.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Email description: The email address of the registrant. type: String - contextPath: Domain.WHOIS.Registrant.Phone description: The phone number of the registrant. type: String - contextPath: ThreatStream.Domain.ASN description: The Autonomous System (AS) number associated with the indicator. type: String - contextPath: ThreatStream.Domain.Address description: The domain name of the indicator. type: String - contextPath: ThreatStream.Domain.Country description: The country associated with the indicator. type: String - contextPath: ThreatStream.Domain.Type description: The indicator type. type: String - contextPath: ThreatStream.Domain.Modified description: |- The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.Domain.Severity description: The indicator severity ("very-high", "high", "medium", "low"). type: String - contextPath: ThreatStream.Domain.Confidence description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence. type: String - contextPath: ThreatStream.Domain.Status description: The status assigned to the indicator. type: String - contextPath: ThreatStream.Domain.Organization description: The name of the business that owns the IP address associated with the indicator. type: String - contextPath: ThreatStream.Domain.Source description: The source of the indicator. type: String - contextPath: Domain.Malicious.Vendor description: Vendor that reported the indicator as malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: ThreatStream.Domain.Tags description: Tags assigned to the domain. type: Unknown - contextPath: Domain.Tags description: (List) Tags of the domain. type: Unknown - arguments: - default: true description: The hash of file to check. isArray: true name: file required: true - auto: PREDEFINED description: If the severity is greater than or equal to the threshold, the hash of file is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high". name: threshold predefined: - low - medium - high - very-high - auto: PREDEFINED defaultValue: 'False' description: Whether to include results with an inactive status. Default is "False". name: include_inactive predefined: - 'True' - 'False' description: Checks the reputation of the given hash of the file. name: file outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the indicator as malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: ThreatStream.File.Severity description: The indicator severity ("very-high", "high", "medium", "low"). type: String - contextPath: ThreatStream.File.Confidence description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence. type: String - contextPath: ThreatStream.File.Status description: The status assigned to the indicator. type: String - contextPath: ThreatStream.File.Type description: The indicator type. type: String - contextPath: ThreatStream.File.MD5 description: The MD5 hash of the indicator. type: String - contextPath: ThreatStream.File.SHA1 description: The SHA1 hash of the indicator. type: String - contextPath: ThreatStream.File.SHA256 description: The SHA256 hash of the indicator. type: String - contextPath: ThreatStream.File.SHA512 description: The SHA512 hash of the indicator. type: String - contextPath: ThreatStream.File.Modified description: |- The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.File.Source description: The source of the indicator. type: String - contextPath: ThreatStream.File.Tags description: Tags assigned to the file. type: Unknown - contextPath: File.Tags description: (List) Tags of the file. type: Unknown - arguments: - description: The email address to check. name: email required: true - auto: PREDEFINED description: If the severity is greater or equal than the threshold, the IP address is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", "very-high". name: threshold predefined: - low - medium - high - very-high - auto: PREDEFINED defaultValue: 'False' description: Whether to include results with an inactive status. Default is "False". name: include_inactive predefined: - 'True' - 'False' description: Checks the reputation of the given email address. name: threatstream-email-reputation outputs: - contextPath: DBotScore.Indicator description: The tested indicator. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: ThreatStream.EmailReputation.Severity description: The indicator severity ("very-high", "high", "medium", "low"). type: String - contextPath: ThreatStream.EmailReputation.Confidence description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence. type: String - contextPath: ThreatStream.EmailReputation.Status description: The status assigned to the indicator. type: String - contextPath: ThreatStream.EmailReputation.Type description: The indicator type. type: String - contextPath: ThreatStream.EmailReputation.Email description: The email address of the indicator. type: String - contextPath: ThreatStream.EmailReputation.Source description: The source of the indicator. type: String - contextPath: ThreatStream.EmailReputation.Modified description: |- The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.EmailReputation.Tags description: Tags assigned to the email. type: Unknown - arguments: - auto: PREDEFINED defaultValue: ip description: The type of passive DNS search ("ip", "domain"). name: type predefined: - ip - domain required: true - description: Possible values are "IP" or "Domain". name: value required: true - defaultValue: '50' description: The maximum number of results to return. Default is 50. name: limit description: Returns enrichment data for Domain or IP for available observables. name: threatstream-get-passive-dns outputs: - contextPath: ThreatStream.PassiveDNS.Domain description: The domain value. type: String - contextPath: ThreatStream.PassiveDNS.Ip description: The IP value. type: String - contextPath: ThreatStream.PassiveDNS.Rrtype description: The Rrtype value. type: String - contextPath: ThreatStream.PassiveDNS.Source description: The source value. type: String - contextPath: ThreatStream.PassiveDNS.FirstSeen description: |- The first seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.PassiveDNS.LastSeen description: |- The last seen date. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - arguments: - defaultValue: '50' description: The observable certainty level of a reported indicator type. Default is 50. name: confidence - auto: PREDEFINED defaultValue: private description: Whether the indicator data is public or private to the organization. Default is "private". name: classification predefined: - private - public - auto: PREDEFINED defaultValue: exploit description: Type of threat associated with the imported observables. Pre-defined values, such as "adware", "bot", "malware", etc. Default is "exploit". name: threat_type predefined: - adware - anomalous - anonymization - apt - bot - brute - c2 - compromised - crypto - data_leakage - ddos - dyn_dns - exfil - exploit - hack_tool - i2p - informational - malware - p2p - parked - phish - scan - sinkhole - spam - suppress - suspicious - tor - vps - auto: PREDEFINED defaultValue: low description: The potential impact of the indicator type with which the observable is believed to be associated. Can be "high", "medium", or "high", or "very-high". Default is "low". name: severity predefined: - low - medium - high - very-high - auto: PREDEFINED description: The import type of the indicator. Can be "datatext", "file-id", or "url". name: import_type predefined: - datatext - file-id - url required: true - description: 'The source of imported data. Can be one of the following: url, datatext of file-id of uploaded file to the War Room. Supported file types for file-id are: CSV, HTML, IOC, JSON, PDF, TXT.' name: import_value required: true - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported IP-type observable when an explicit itype is not specified for it. name: ip_mapping - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported domain-type observable when an explicit itype is not specified for it. name: domain_mapping - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported URL-type observable when an explicit itype is not specified for it. name: url_mapping - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported email-type observable when an explicit itype is not specified for it. name: email_mapping - description: Indicator type to assign if a specific type is not associated with an observable. This is a global setting that applies to any imported MD5-type observable when an explicit itype is not specified for it. name: md5_mapping description: 'Imports indicators (observables) into ThreatStream. Approval of the imported data is required, using the ThreatStream UI. The data can be imported using one of three methods: plain-text, file, or URL. Only one argument can be used.' name: threatstream-import-indicator-with-approval - arguments: - defaultValue: '50' description: The observable certainty level of a reported indicator type. Default is 50. name: confidence - description: To use your specified confidence entirely and not re-assess the value using machine learning algorithms, set source_confidence_ weight to 100. name: source_confidence_weight - description: The time stamp of when intelligence will expire on ThreatStream, in ISO format. For example, 2020-12-24T00:00:00. name: expiration_ts - description: The severity you want to assign to the observable when it is imported. Can be "low", "medium", "high" , or "very-high". name: severity predefined: - low - medium - high - very-high - description: A comma-separated list of tags. For example, tag1,tag2. name: tags - description: The ID of the trusted circle with which this threat data should be shared. If you want to import the threat data to multiple trusted circles, enter a list of comma-separated IDs. name: trustedcircles - auto: PREDEFINED description: Denotes whether the indicator data is public or private to the organization. name: classification predefined: - private - public required: true - auto: PREDEFINED description: Whether domain observables that are included in the file and do not resolve will be accepted as valid in ThreatStream and imported. name: allow_unresolved predefined: - 'yes' - 'no' - description: The entry ID of an uploaded file to the War Room containing a json with "objects" array and "meta" maps. name: file_id required: true description: Imports indicators (observables) into ThreatStream. Approval is not required for the imported data. You must have the Approve Intel user permission to import without approval using the API. name: threatstream-import-indicator-without-approval - arguments: - auto: PREDEFINED description: The threat model of the returned list. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". name: model predefined: - actor - campaign - incident - signature - ttp - vulnerability - tipreport required: true - defaultValue: '50' description: Limits the list of models size. Specifying limit=0 returns up to a maximum of 1000 models. In case of limit=0 the output won't be set in the context. name: limit description: Returns a list of threat models. name: threatstream-get-model-list outputs: - contextPath: ThreatStream.List.Type description: The type of threat model. type: String - contextPath: ThreatStream.List.Name description: The name of the threat model. type: String - contextPath: ThreatStream.List.ID description: The ID of the threat model. type: String - contextPath: ThreatStream.List.CreatedTime description: 'The date and time of threat model creation. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time.' type: String - arguments: - auto: PREDEFINED description: The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". name: model predefined: - actor - campaign - incident - signature - ttp - vulnerability - tipreport required: true - description: The ID of the threat model. name: id required: true description: Returns an HTML file with a description of the threat model. name: threatstream-get-model-description outputs: - contextPath: File.Name description: The file name of the model description. type: String - contextPath: File.EntryID description: The entry ID of the model description. type: String - arguments: - auto: PREDEFINED description: The threat model. Can be "actor", "campaign", "incident", "signature", "ttp", "vulnerability", or "tipreport". name: model predefined: - actor - campaign - incident - signature - ttp - vulnerability - tipreport required: true - description: The ID of the model. name: id required: true - defaultValue: '20' description: The maximum number of results to return. Default is 20. name: limit description: Returns a list of indicators associated with the specified model and ID of the model. name: threatstream-get-indicators-by-model outputs: - contextPath: ThreatStream.Model.ModelType description: The type of the threat model. type: String - contextPath: ThreatStream.Model.ModelID description: The ID of the threat model. type: String - contextPath: ThreatStream.Model.Indicators.Value description: The value of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ID description: The ID of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.IType description: The iType of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Severity description: The severity of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Confidence description: The confidence of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Country description: The country of the indicator associated with the specified model type: String - contextPath: ThreatStream.Model.Indicators.Organization description: The organization of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ASN description: The ASN of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Status description: The status of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Tags description: The tags of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Modified description: The date and time the indicator was last modified. type: String - contextPath: ThreatStream.Model.Indicators.Source description: The source of the indicator. type: String - contextPath: ThreatStream.Model.Indicators.Type description: The type of the indicator. type: String - arguments: - auto: PREDEFINED defaultValue: private description: Classification of the Sandbox submission. Can be "private" or "public". Default is "private". name: submission_classification predefined: - private - public - auto: PREDEFINED defaultValue: WINDOWS7 description: The platform on which the submitted URL or file will be run. To obtain a list supported platforms run the threatstream-supported-platforms command. Can be "WINDOWS7", or "WINDOWSXP". Default is "WINDOWS7". name: report_platform predefined: - WINDOWS7 - WINDOWSXP - auto: PREDEFINED defaultValue: file description: The detonation type. Can be "file" or "url". Default is "file". name: submission_type predefined: - file - url required: true - description: The submission value. Possible values are a valid URL or a file ID that was uploaded to the War Room to detonate. name: submission_value required: true - auto: PREDEFINED defaultValue: 'false' description: Whether the premium sandbox should be used for detonation. Default is "false". name: premium_sandbox predefined: - 'false' - 'true' - description: A comma separated list of additional details for the indicator. This information is displayed in the Tag column of the ThreatStream UI. name: detail description: Submits a file or URL to the ThreatStream-hosted Sandbox for detonation. name: threatstream-submit-to-sandbox outputs: - contextPath: ThreatStream.Analysis.ReportID description: The report ID that was submitted to the sandbox. type: String - contextPath: ThreatStream.Analysis.Status description: The analysis status. type: String - contextPath: ThreatStream.Analysis.Platform description: The platform of the submission submitted to the sandbox. type: String - arguments: - description: The report ID for which to check the status. name: report_id required: true description: Returns the current status of the report that was submitted to the sandbox. The report ID is returned from the threatstream-submit-to-sandbox command. name: threatstream-get-analysis-status outputs: - contextPath: ThreatStream.Analysis.ReportID description: The report ID of the file or URL that was detonated to sandbox. type: String - contextPath: ThreatStream.Analysis.Status description: The report status of the file or URL that was detonated in the sandbox. type: String - contextPath: ThreatStream.Analysis.Platform description: The platform that was used for detonation. type: String - contextPath: ThreatStream.Analysis.Verdict description: The report verdict of the file or URL that was detonated in the sandbox. The verdict will remain "benign" until detonation is complete. type: String - arguments: - description: The report ID to return. name: report_id required: true description: Returns the report of a file or URL that was submitted to the sandbox. name: threatstream-analysis-report outputs: - contextPath: ThreatStream.Analysis.ReportID description: The ID of the report submitted to the sandbox. type: String - contextPath: ThreatStream.Analysis.Category description: The report category. type: String - contextPath: ThreatStream.Analysis.Started description: The detonation start time. type: String - contextPath: ThreatStream.Analysis.Completed description: The detonation completion time. type: String - contextPath: ThreatStream.Analysis.Duration description: The duration of the detonation (in seconds). type: Number - contextPath: ThreatStream.Analysis.VmName description: The name of the VM. type: String - contextPath: ThreatStream.Analysis.VmID description: The ID of the VM. type: String - contextPath: ThreatStream.Analysis.Network.UdpSource description: The source of UDP. type: String - contextPath: ThreatStream.Analysis.Network.UdpDestination description: The destination of UDP. type: String - contextPath: ThreatStream.Analysis.Network.UdpPort description: The port of the UDP. type: String - contextPath: ThreatStream.Analysis.Network.IcmpSource description: The ICMP source. type: String - contextPath: ThreatStream.Analysis.Network.IcmpDestination description: The destination of ICMP. type: String - contextPath: ThreatStream.Analysis.Network.IcmpPort description: The port of the ICMP. type: String - contextPath: ThreatStream.Analysis.Network.TcpSource description: The source of TCP. type: String - contextPath: ThreatStream.Analysis.Network.TcpDestination description: The destination of TCP. type: String - contextPath: ThreatStream.Analysis.Network.TcpPort description: The port of TCP. type: String - contextPath: ThreatStream.Analysis.Network.HttpSource description: The source of HTTP address. type: String - contextPath: ThreatStream.Analysis.Network.HttpDestinaton description: The destination of the HTTP address. type: String - contextPath: ThreatStream.Analysis.Network.HttpPort description: The port of the HTTP address. type: String - contextPath: ThreatStream.Analysis.Network.HttpsSource description: The source of the HTTPS address. type: String - contextPath: ThreatStream.Analysis.Network.HttpsDestinaton description: The destination of the HTTPS address. type: String - contextPath: ThreatStream.Analysis.Network.HttpsPort description: The port of the HTTPS address. type: String - contextPath: ThreatStream.Analysis.Network.Hosts description: The hosts of network analysis. type: String - contextPath: ThreatStream.Analysis.Verdict description: The verdict of the sandbox detonation. type: String - arguments: - description: The Anomali Observable Search Filter Language query to filter indicator results. If a query is passed as an argument, it overrides all other arguments. name: query - description: The Autonomous System (AS) number associated with the indicator. name: asn - description: |- The observable certainty level of a reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors. name: confidence - description: The country associated with the indicator. name: country - description: |- When the indicator was first seen on the ThreatStream cloud platform. The date must be specified in this format: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35. name: created_ts - description: The unique ID for the indicator. name: id - auto: PREDEFINED description: Whether the classification of the indicator is public. Default is "false". name: is_public predefined: - 'false' - 'true' - description: The severity assigned to the indicator by ThreatStream. name: indicator_severity - description: The registered owner (organization) of the IP address associated with the indicator. name: org - auto: PREDEFINED description: The status assigned to the indicator. Can be "active", "inactive", or "falsepos". name: status predefined: - active - inactive - falsepos - description: The tag assigned to the indicator. name: tags_name - auto: PREDEFINED description: The type of indicator. Can be "domain", "email", "ip", "MD5", "string", or "url". name: type predefined: - domain - email - ip - md5 - string - url - description: 'The value of the indicator. ' name: indicator_value - defaultValue: '20' description: The maximum number of results to return from ThreatStream. Default is 20. name: limit description: Return filtered indicators from ThreatStream. If a query is defined, it overrides all other arguments that were passed to the command. name: threatstream-get-indicators outputs: - contextPath: ThreatStream.Indicators.IType description: The indicator type. type: String - contextPath: ThreatStream.Indicators.Modified description: |- The date and time when the indicator was last updated on the ThreatStream. Format: YYYYMMDDThhmmss, where T denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.Indicators.Confidence description: The observable certainty level of a reported indicator type. type: String - contextPath: ThreatStream.Indicators.Value description: The indicator value. type: String - contextPath: ThreatStream.Indicators.Status description: The indicator status. type: String - contextPath: ThreatStream.Indicators.Organization description: The registered owner (organization) of the IP address associated with the indicator. type: String - contextPath: ThreatStream.Indicators.Country description: The country associated with the indicator. type: String - contextPath: ThreatStream.Indicators.Tags description: The tag assigned to the indicator. type: String - contextPath: ThreatStream.Indicators.Source description: The source of the indicator. type: String - contextPath: ThreatStream.Indicators.ID description: The ID of the indicator. type: String - contextPath: ThreatStream.Indicators.ASN description: The Autonomous System (AS) number associated with the indicator. type: String - contextPath: ThreatStream.Indicators.Severity description: The severity assigned to the indicator. type: String - arguments: - auto: PREDEFINED defaultValue: intelligence description: The type of threat model entity on which to add the tag. Can be "actor", "campaign", "incident", "intelligence", "signature", "tipreport", "ttp", or "vulnerability". Default is "intelligence" (indicator). name: model predefined: - actor - campaign - incident - intelligence - signature - tipreport - ttp - vulnerability - description: 'A comma separated list of tags applied to the specified threat model entities or observable. ' isArray: true name: tags required: true - description: The ID of the model on which to add the tag. name: model_id required: true description: Adds tags to intelligence for purposes of filtering for related entities. name: threatstream-add-tag-to-model - arguments: - auto: PREDEFINED description: The type of threat model to create. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". name: model predefined: - actor - campaign - incident - ttp - vulnerability - tipreport required: true - description: The name of the threat model to create. name: name required: true - auto: PREDEFINED defaultValue: 'false' description: Whether the scope of threat model is visible. Default is false. name: is_public predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: red description: The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". name: tlp predefined: - red - amber - green - white - description: A comma separated list of tags. name: tags - description: A comma separated list of indicators IDs associated with the threat model on the ThreatStream platform. name: intelligence - description: The description of the threat model. name: description description: Creates a threat model with the specified parameters. name: threatstream-create-model outputs: - contextPath: ThreatStream.Model.ModelType description: The type of the threat model. type: String - contextPath: ThreatStream.Model.ModelID description: The ID of the threat model. type: String - contextPath: ThreatStream.Model.Indicators.Value description: The value of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ID description: The ID of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.IType description: The iType of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Severity description: The severity of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Confidence description: The confidence of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Country description: The country of the indicator associated with the specified model type: String - contextPath: ThreatStream.Model.Indicators.Organization description: The organization of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ASN description: The ASN of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Status description: The status of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Tags description: The tags of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Modified description: The date and time the indicator was last modified. type: String - contextPath: ThreatStream.Model.Indicators.Source description: The source of the indicator. type: String - contextPath: ThreatStream.Model.Indicators.Type description: The type of the indicator. type: String - arguments: - auto: PREDEFINED description: The type of threat model to update. Can be "actor", "campaign", "incident", "ttp", "vulnerability", or "tipreport". name: model predefined: - actor - campaign - incident - ttp - vulnerability - tipreport required: true - description: The ID of the threat model to update. name: model_id required: true - description: The name of the threat model to update. name: name - auto: PREDEFINED defaultValue: 'false' description: Whether the scope of threat model is visible. Default is false. name: is_public predefined: - 'true' - 'false' - auto: PREDEFINED defaultValue: red description: The Traffic Light Protocol designation for the threat model. Can be "red", "amber", "green", or "white". name: tlp predefined: - red - amber - green - white - description: A comma separated list of tags. name: tags - description: A comma separated list of indicators IDs associated with the threat model on the ThreatStream platform. name: intelligence - description: The description of the threat model. name: description description: Updates a threat model with specific parameters. If one or more optional parameters are defined, the command overrides previous data stored in ThreatStream. name: threatstream-update-model outputs: - contextPath: ThreatStream.Model.ModelType description: The type of the threat model. type: String - contextPath: ThreatStream.Model.ModelID description: The ID of the threat model. type: String - contextPath: ThreatStream.Model.Indicators.Value description: The value of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ID description: The ID of indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.IType description: The iType of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Severity description: The severity of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Confidence description: The confidence of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Country description: The country of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Organization description: The organization of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.ASN description: The ASN of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Status description: The status of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Tags description: The tags of the indicator associated with the specified model. type: String - contextPath: ThreatStream.Model.Indicators.Modified description: The date and time the indicator was last modified. type: String - contextPath: ThreatStream.Model.Indicators.Source description: The source of the indicator. type: String - contextPath: ThreatStream.Model.Indicators.Type description: The type of the indicator. type: String - arguments: - auto: PREDEFINED defaultValue: default description: The type of sandbox ("default" or "premium"). Default type is "default". name: sandbox_type predefined: - default - premium description: Returns a list of supported platforms for default or premium sandbox. name: threatstream-supported-platforms outputs: - contextPath: ThreatStream.PremiumPlatforms.Name description: The name of the supported platform for premium sandbox. type: String - contextPath: ThreatStream.PremiumPlatforms.Types description: The type of supported submissions for premium sandbox. type: String - contextPath: ThreatStream.PremiumPlatforms.Label description: The display name of the supported platform of premium sandbox. type: String - contextPath: ThreatStream.DefaultPlatforms.Name description: The name of the supported platform for standard sandbox. type: String - contextPath: ThreatStream.DefaultPlatforms.Types description: The type of the supported submissions for standard sandbox. type: String - contextPath: ThreatStream.DefaultPlatforms.Label description: The display name of the supported platform of standard sandbox. type: String - arguments: - default: true description: The URL to check. isArray: true name: url required: true - auto: PREDEFINED description: If the severity is greater than or equal to the threshold, the URL is considered as malicious. This argument will override the default threshold defined as a parameter. Can be "low", "medium", "high", or "very-high". name: threshold predefined: - low - medium - high - very-high - auto: PREDEFINED defaultValue: 'False' description: Whether to include results with an inactive status. Default is "False". name: include_inactive predefined: - 'True' - 'False' description: Checks the reputation of the given URL. name: url outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: URL.Data description: The URL of the indicator. type: String - contextPath: URL.Malicious.Vendor description: Vendor that reported the indicator as malicious. type: String - contextPath: ThreatStream.URL.Modified description: |- The date and time when the indicator was last updated. The date format is: YYYYMMDDThhmmss, where "T" denotes the start of the value for time, in UTC time. type: String - contextPath: ThreatStream.URL.Confidence description: The observable certainty level of a reported indicator type. Confidence score can range from 0-100, in increasing order of confidence. type: String - contextPath: ThreatStream.URL.Status description: The status of the indicator. type: String - contextPath: ThreatStream.URL.Organization description: The name of the business that owns the IP address associated with the indicator. type: String - contextPath: ThreatStream.URL.Address description: The URL of the indicator. type: String - contextPath: ThreatStream.URL.Country description: The country associated with the indicator. type: String - contextPath: ThreatStream.URL.Type description: The indicator type. type: String - contextPath: ThreatStream.URL.Source description: The source of the indicator. type: String - contextPath: ThreatStream.URL.Severity description: The indicator severity ("very-high", "high", "medium", or "low"). type: String - contextPath: ThreatStream.URL.Tags description: Tags assigned to the URL. type: Unknown - contextPath: URL.Tags description: (List) Tags of the URL. type: Unknown dockerimage: demisto/py3-tools:1.0.0.43697 runonce: false script: '-' subtype: python3 type: python tests: - ThreatStream-Test fromversion: 5.0.0