commonfields: id: CTIX version: -1 fromversion: 5.0.0 name: CTIX display: Cyware Threat Intelligence eXchange category: Data Enrichment & Threat Intelligence description: Deprecated. Use Cyware Intel Exchange instead. provider: Cyware Labs sectionorder: - Connect - Collect configuration: - display: Endpoint URL name: base_url type: 0 required: true section: Connect additionalinfo: Enter the endpoint URL of your CTIX Instance. - display: Access Key name: access_id type: 4 required: true section: Connect additionalinfo: Enter the Access Key from the CTIX application. - display: Secret Key name: secret_key type: 4 required: true section: Connect additionalinfo: Enter the Secret Key from the CTIX application. - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Collect - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Collect - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false section: Collect script: script: '' type: python commands: - name: ip arguments: - name: ip required: true default: true description: List of IPs. isArray: true - name: enhanced auto: PREDEFINED predefined: - "true" - "false" description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. outputs: - contextPath: IP.Address description: IP address. type: String - contextPath: IP.ASN description: The autonomous system name for the IP address. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: CTIX.IP.tenant_id description: Tenant ID. type: string - contextPath: CTIX.IP.stix_object_id description: ID of the Threat Data Object in CTIX application. type: string - contextPath: CTIX.IP.tlp_data description: TLP Value of the Threat Data Object. type: string - contextPath: CTIX.IP.first_seen description: Timestamp of when the IP was first seen on the CTIX application. type: string - contextPath: CTIX.IP.last_seen description: Timestamp of when the IP was latest seen on the CTIX application. type: string - contextPath: CTIX.IP.deprecated description: Shows if the Threat Data Object is deprecated on the CTIX application. type: boolean - contextPath: CTIX.IP.intel_grading description: Intel grading. type: string - contextPath: CTIX.IP.criticality description: Criticality of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.IP.indicator_type description: Threat Data Object type. type: string - contextPath: CTIX.IP.package_id description: List of IDs of packages on the CTIX application through which these IPs were received. - contextPath: CTIX.IP.source description: List of sources from which the IP address was received in the CTIX application. - contextPath: CTIX.IP.risk_severity description: Risk Severity of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.IP.labels description: List of Tags applied on the Threat Data Object. - contextPath: CTIX.IP.source_grading description: Source Grading. type: string - contextPath: CTIX.IP.name2 description: Value of the Threat Data Object. type: string - contextPath: CTIX.IP.published_collections description: Published collections. - contextPath: CTIX.IP.published_package_id description: Package ID. - contextPath: CTIX.IP.blocked description: Shows if the Threat Data Object is blocked on the CTIX application. type: boolean - contextPath: CTIX.IP.blocked_time description: Timestamp of when the Threat Data Object was blocked on the CTIX application. type: string - contextPath: CTIX.IP.deprecated_time description: Timestamp of when the Threat Data Object was deprecated on the CTIX application. type: string - contextPath: CTIX.IP.notification_preference description: Notification preference. - contextPath: CTIX.IP.followed_on description: Followed On. - contextPath: CTIX.IP.score description: CTIX Confidence Score of the IP Object out of 100. type: number - contextPath: CTIX.IP.type description: Type of object. type: string - contextPath: CTIX.IP.subscriber_id description: List of Subscriber IDs. - contextPath: CTIX.IP.subscriber description: List of Subscribers. - contextPath: CTIX.IP.subscriber_collection_id description: List of Subscriber Collection IDs. - contextPath: CTIX.IP.subscriber_collection description: List of Subscriber Collection. - contextPath: CTIX.IP.object_type description: Type of object. type: string - contextPath: CTIX.IP.blocked_on description: Name of the Application where the Threat Data Object was blocked on. - contextPath: CTIX.IP.follow_by description: List of Cyware Users who follow the object. - contextPath: CTIX.IP.is_false_positive description: Shows if the Threat Data Object was marked false positive in the CTIX application. type: boolean - contextPath: CTIX.IP.domain_tld description: Top-Level Domain information about the Threat Data Object. type: string - contextPath: CTIX.IP.asn description: ASN number of the Threat Data Object. type: string - contextPath: CTIX.IP.registered_domain description: Registered Domain. type: string - contextPath: CTIX.IP.geo_details description: Geographic details of the Threat Data Object. type: unknown - contextPath: CTIX.IP.country description: Geographic details of the Object. type: string - contextPath: CTIX.IP.registrar description: Registrar. type: string - contextPath: CTIX.IP.file_extension description: File Extension. type: string - contextPath: CTIX.IP.whitelisted description: List. - contextPath: CTIX.IP.object_description description: Description of the Threat Data Object. type: string - contextPath: CTIX.IP.custom_score description: Custom Score of the Threat Data Object. type: number - contextPath: CTIX.IP.is_following description: Boolean Value. type: boolean - contextPath: CTIX.IP.under_review description: Shows if Threat Data Object is marked as Under Review on the CTIX application. type: boolean - contextPath: CTIX.IP.under_reviewed_time description: Timestamp when the object was marked under review. type: string - contextPath: CTIX.IP.reviewed description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application. type: boolean - contextPath: CTIX.IP.reviewed_time description: Timestamp when then object was reviewed. type: string - contextPath: CTIX.IP.object_description_defang description: Description of the object. type: string - contextPath: CTIX.IP.source_data description: List of sources from which CTIX received this IP. - contextPath: CTIX.IP.related_fields description: Relationship Data about the Threat Data Object present on the CTIX application. - contextPath: CTIX.IP.enhancement_data description: Additional enhanced data about the Threat Data Object fetched by the CTIX application. description: Return IP Details. - name: domain arguments: - name: domain required: true default: true description: List of Domains. isArray: true - name: enhanced auto: PREDEFINED predefined: - "true" - "false" description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. outputs: - contextPath: Domain.Name description: The domain name. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: CTIX.Domain.tenant_id description: Tenant ID. type: string - contextPath: CTIX.Domain.stix_object_id description: ID of the Threat Data Object in CTIX application. type: string - contextPath: CTIX.Domain.tlp_data description: TLP Value of the Threat Data Object. type: string - contextPath: CTIX.Domain.first_seen description: Timestamp of when the IP was first seen on the CTIX application. type: string - contextPath: CTIX.Domain.last_seen description: Timestamp of when the IP was latest seen on the CTIX application. type: string - contextPath: CTIX.Domain.deprecated description: Shows if the Threat Data Object is deprecated on the CTIX application. type: boolean - contextPath: CTIX.Domain.intel_grading description: Intel grading. type: string - contextPath: CTIX.Domain.criticality description: Criticality of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.Domain.indicator_type description: Threat Data Object type. type: string - contextPath: CTIX.Domain.package_id description: List of IDs of packages on the CTIX application through which these IPs were received. - contextPath: CTIX.Domain.source description: List of sources from which the IP address was received in the CTIX application. - contextPath: CTIX.Domain.risk_severity description: Risk Severity of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.Domain.labels description: List of Tags applied on the Threat Data Object. - contextPath: CTIX.Domain.source_grading description: Source Grading. type: string - contextPath: CTIX.Domain.name2 description: Value of the Threat Data Object. type: string - contextPath: CTIX.Domain.published_collections description: Published collections. - contextPath: CTIX.Domain.published_package_id description: Package ID. - contextPath: CTIX.Domain.blocked description: Shows if the Threat Data Object is blocked on the CTIX application. type: boolean - contextPath: CTIX.Domain.blocked_time description: Timestamp of when the Threat Data Object was blocked on the CTIX application. type: string - contextPath: CTIX.Domain.deprecated_time description: Timestamp of when the Threat Data Object was deprecated on the CTIX application. type: string - contextPath: CTIX.Domain.notification_preference description: Notification preference. - contextPath: CTIX.Domain.followed_on description: Followed On. - contextPath: CTIX.Domain.score description: CTIX Confidence Score of the IP Object out of 100. type: number - contextPath: CTIX.Domain.type description: Type of object. type: string - contextPath: CTIX.Domain.subscriber_id description: List of Subscriber IDs. - contextPath: CTIX.Domain.subscriber description: List of Subscribers. - contextPath: CTIX.Domain.subscriber_collection_id description: List of Subscriber Collection IDs. - contextPath: CTIX.Domain.subscriber_collection description: List of Subscriber Collection. - contextPath: CTIX.Domain.object_type description: Type of object. type: string - contextPath: CTIX.Domain.blocked_on description: Name of the Application where the Threat Data Object was blocked on. - contextPath: CTIX.Domain.follow_by description: List of Cyware Users who follow the object. - contextPath: CTIX.Domain.is_false_positive description: Shows if the Threat Data Object was marked false positive in the CTIX application. type: boolean - contextPath: CTIX.Domain.domain_tld description: Top-Level Domain information about the Threat Data Object. type: string - contextPath: CTIX.Domain.asn description: ASN number of the Threat Data Object. type: string - contextPath: CTIX.Domain.registered_domain description: Registered Domain. type: string - contextPath: CTIX.Domain.geo_details description: Geographic details of the Threat Data Object. type: unknown - contextPath: CTIX.Domain.country description: Geographic details of the Object. type: string - contextPath: CTIX.Domain.registrar description: Registrar. type: string - contextPath: CTIX.Domain.file_extension description: File Extension. type: string - contextPath: CTIX.Domain.whitelisted description: List. - contextPath: CTIX.Domain.object_description description: Description of the Threat Data Object. type: string - contextPath: CTIX.Domain.custom_score description: Custom Score of the Threat Data Object. type: number - contextPath: CTIX.Domain.is_following description: Boolean Value. type: boolean - contextPath: CTIX.Domain.under_review description: Shows if Threat Data Object is marked as Under Review on the CTIX application. type: boolean - contextPath: CTIX.Domain.under_reviewed_time description: Timestamp when the object was marked under review. type: string - contextPath: CTIX.Domain.reviewed description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application. type: boolean - contextPath: CTIX.Domain.reviewed_time description: Timestamp when then object was reviewed. type: string - contextPath: CTIX.Domain.object_description_defang description: Description of the object. type: string - contextPath: CTIX.Domain.source_data description: List of sources from which CTIX received this IP. - contextPath: CTIX.Domain.related_fields description: Relationship Data about the Threat Data Object present on the CTIX application. - contextPath: CTIX.Domain.enhancement_data description: Additional enhanced data about the Threat Data Object fetched by the CTIX application. description: Return Domain Details. - name: url arguments: - name: url required: true default: true description: List of URLs. isArray: true - name: enhanced auto: PREDEFINED predefined: - "true" - "false" description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. outputs: - contextPath: URL.Data description: The URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: CTIX.URL.tenant_id description: Tenant ID. type: string - contextPath: CTIX.URL.stix_object_id description: ID of the Threat Data Object in CTIX application. type: string - contextPath: CTIX.URL.tlp_data description: TLP Value of the Threat Data Object. type: string - contextPath: CTIX.URL.first_seen description: Timestamp of when the IP was first seen on the CTIX application. type: string - contextPath: CTIX.URL.last_seen description: Timestamp of when the IP was latest seen on the CTIX application. type: string - contextPath: CTIX.URL.deprecated description: Shows if the Threat Data Object is deprecated on the CTIX application. type: boolean - contextPath: CTIX.URL.intel_grading description: Intel grading. type: string - contextPath: CTIX.URL.criticality description: Criticality of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.URL.indicator_type description: Threat Data Object type. type: string - contextPath: CTIX.URL.package_id description: List of IDs of packages on the CTIX application through which these IPs were received. - contextPath: CTIX.URL.source description: List of sources from which the IP address was received in the CTIX application. - contextPath: CTIX.URL.risk_severity description: Risk Severity of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.URL.labels description: List of Tags applied on the Threat Data Object. - contextPath: CTIX.URL.source_grading description: Source Grading. type: string - contextPath: CTIX.URL.name2 description: Value of the Threat Data Object. type: string - contextPath: CTIX.URL.published_collections description: Published collections. - contextPath: CTIX.URL.published_package_id description: Package ID. - contextPath: CTIX.URL.blocked description: Shows if the Threat Data Object is blocked on the CTIX application. type: boolean - contextPath: CTIX.URL.blocked_time description: Timestamp of when the Threat Data Object was blocked on the CTIX application. type: string - contextPath: CTIX.URL.deprecated_time description: Timestamp of when the Threat Data Object was deprecated on the CTIX application. type: string - contextPath: CTIX.URL.notification_preference description: Notification preference. - contextPath: CTIX.URL.followed_on description: Followed On. - contextPath: CTIX.URL.score description: CTIX Confidence Score of the IP Object out of 100. type: number - contextPath: CTIX.URL.type description: Type of object. type: string - contextPath: CTIX.URL.subscriber_id description: List of Subscriber IDs. - contextPath: CTIX.URL.subscriber description: List of Subscribers. - contextPath: CTIX.URL.subscriber_collection_id description: List of Subscriber Collection IDs. - contextPath: CTIX.URL.subscriber_collection description: List of Subscriber Collection. - contextPath: CTIX.URL.object_type description: Type of object. type: string - contextPath: CTIX.URL.blocked_on description: Name of the Application where the Threat Data Object was blocked on. - contextPath: CTIX.URL.follow_by description: List of Cyware Users who follow the object. - contextPath: CTIX.URL.is_false_positive description: Shows if the Threat Data Object was marked false positive in the CTIX application. type: boolean - contextPath: CTIX.URL.domain_tld description: Top-Level Domain information about the Threat Data Object. type: string - contextPath: CTIX.URL.asn description: ASN number of the Threat Data Object. type: string - contextPath: CTIX.URL.registered_domain description: Registered Domain. type: string - contextPath: CTIX.URL.geo_details description: Geographic details of the Threat Data Object. type: unknown - contextPath: CTIX.URL.country description: Geographic details of the Object. type: string - contextPath: CTIX.URL.registrar description: Registrar. type: string - contextPath: CTIX.URL.file_extension description: File Extension. type: string - contextPath: CTIX.URL.whitelisted description: List. - contextPath: CTIX.URL.object_description description: Description of the Threat Data Object. type: string - contextPath: CTIX.URL.custom_score description: Custom Score of the Threat Data Object. type: number - contextPath: CTIX.URL.is_following description: Boolean Value. type: boolean - contextPath: CTIX.URL.under_review description: Shows if Threat Data Object is marked as Under Review on the CTIX application. type: boolean - contextPath: CTIX.URL.under_reviewed_time description: Timestamp when the object was marked under review. type: string - contextPath: CTIX.URL.reviewed description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application. type: boolean - contextPath: CTIX.URL.reviewed_time description: Timestamp when then object was reviewed. type: string - contextPath: CTIX.URL.object_description_defang description: Description of the object. type: string - contextPath: CTIX.URL.source_data description: List of sources from which CTIX received this IP. - contextPath: CTIX.URL.related_fields description: Relationship Data about the Threat Data Object present on the CTIX application. - contextPath: CTIX.URL.enhancement_data description: Additional enhanced data about the Threat Data Object fetched by the CTIX application. description: Return URL Details. - name: file arguments: - name: file required: true default: true description: List of Files. isArray: true - name: enhanced auto: PREDEFINED predefined: - "true" - "false" description: Boolean Flag which when enabled returns an enhanced response which includes the extra enhancement data from various sources. outputs: - contextPath: File.Name description: The full file name. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: CTIX.File.tenant_id description: Tenant ID. type: string - contextPath: CTIX.File.stix_object_id description: ID of the Threat Data Object in CTIX application. type: string - contextPath: CTIX.File.tlp_data description: TLP Value of the Threat Data Object. type: string - contextPath: CTIX.File.first_seen description: Timestamp of when the IP was first seen on the CTIX application. type: string - contextPath: CTIX.File.last_seen description: Timestamp of when the IP was latest seen on the CTIX application. type: string - contextPath: CTIX.File.deprecated description: Shows if the Threat Data Object is deprecated on the CTIX application. type: boolean - contextPath: CTIX.File.intel_grading description: Intel grading. type: string - contextPath: CTIX.File.criticality description: Criticality of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.File.indicator_type description: Threat Data Object type. type: string - contextPath: CTIX.File.package_id description: List of IDs of packages on the CTIX application through which these IPs were received. - contextPath: CTIX.File.source description: List of sources from which the IP address was received in the CTIX application. - contextPath: CTIX.File.risk_severity description: Risk Severity of the Threat Data Object on the scale of 0-5. type: number - contextPath: CTIX.File.labels description: List of Tags applied on the Threat Data Object. - contextPath: CTIX.File.source_grading description: Source Grading. type: string - contextPath: CTIX.File.name2 description: Value of the Threat Data Object. type: string - contextPath: CTIX.File.published_collections description: Published collections. - contextPath: CTIX.File.published_package_id description: Package ID. - contextPath: CTIX.File.blocked description: Shows if the Threat Data Object is blocked on the CTIX application. type: boolean - contextPath: CTIX.File.blocked_time description: Timestamp of when the Threat Data Object was blocked on the CTIX application. type: string - contextPath: CTIX.File.deprecated_time description: Timestamp of when the Threat Data Object was deprecated on the CTIX application. type: string - contextPath: CTIX.File.notification_preference description: Notification preference. - contextPath: CTIX.File.followed_on description: Followed On. - contextPath: CTIX.File.score description: CTIX Confidence Score of the IP Object out of 100. type: number - contextPath: CTIX.File.type description: Type of object. type: string - contextPath: CTIX.File.subscriber_id description: List of Subscriber IDs. - contextPath: CTIX.File.subscriber description: List of Subscribers. - contextPath: CTIX.File.subscriber_collection_id description: List of Subscriber Collection IDs. - contextPath: CTIX.File.subscriber_collection description: List of Subscriber Collection. - contextPath: CTIX.File.object_type description: Type of object. type: string - contextPath: CTIX.File.blocked_on description: Name of the Application where the Threat Data Object was blocked on. - contextPath: CTIX.File.follow_by description: List of Cyware Users who follow the object. - contextPath: CTIX.File.is_false_positive description: Shows if the Threat Data Object was marked false positive in the CTIX application. type: boolean - contextPath: CTIX.File.domain_tld description: Top-Level Domain information about the Threat Data Object. type: string - contextPath: CTIX.File.asn description: ASN number of the Threat Data Object. type: string - contextPath: CTIX.File.registered_domain description: Registered Domain. type: string - contextPath: CTIX.File.geo_details description: Geographic details of the Threat Data Object. type: unknown - contextPath: CTIX.File.country description: Geographic details of the Object. type: string - contextPath: CTIX.File.registrar description: Registrar. type: string - contextPath: CTIX.File.file_extension description: File Extension. type: string - contextPath: CTIX.File.whitelisted description: List. - contextPath: CTIX.File.object_description description: Description of the Threat Data Object. type: string - contextPath: CTIX.File.custom_score description: Custom Score of the Threat Data Object. type: number - contextPath: CTIX.File.is_following description: Boolean Value. type: boolean - contextPath: CTIX.File.under_review description: Shows if Threat Data Object is marked as Under Review on the CTIX application. type: boolean - contextPath: CTIX.File.under_reviewed_time description: Timestamp when the object was marked under review. type: string - contextPath: CTIX.File.reviewed description: Shows if the Threat Data Object is Marked as Reviewed on the CTIX application. type: boolean - contextPath: CTIX.File.reviewed_time description: Timestamp when then object was reviewed. type: string - contextPath: CTIX.File.object_description_defang description: Description of the object. type: string - contextPath: CTIX.File.source_data description: List of sources from which CTIX received this IP. - contextPath: CTIX.File.related_fields description: Relationship Data about the Threat Data Object present on the CTIX application. - contextPath: CTIX.File.enhancement_data description: Additional enhanced data about the Threat Data Object fetched by the CTIX application. description: Return File Details. - name: ctix-create-intel description: Creates Intel in CTIX platform. arguments: - name: title description: Title of ioc. - name: description description: Description of ioc. - name: tlp description: tlp of ioc. - name: confidence description: confidence of ioc. - name: ips description: comma-separated list of IPs. isArray: true - name: urls description: comma-separated list of URLs. isArray: true - name: domains description: comma-separated list of domains. isArray: true - name: files description: comma-separated list of files. isArray: true - name: emails description: comma-separated list of emails. isArray: true - name: malwares description: comma-separated list of malwares. isArray: true - name: threat_actors description: comma-separated list of threat_actors. isArray: true - name: attack_patterns description: comma-separated list of attack_patterns. isArray: true outputs: - contextPath: CTIX.Intel.response description: The response of the api. type: String - contextPath: CTIX.Intel.status description: Status code returned from the api. type: String dockerimage: demisto/python3:3.12.13.8160132 subtype: python3 tests: - No tests deprecated: true