commonfields: id: CyberTotal version: -1 name: CyberTotal display: CyberTotal category: Data Enrichment & Threat Intelligence provider: CyCraft Technology description: CyberTotal is a cloud-based threat intelligence service developed by CyCraft. configuration: - display: CyberTotal URL name: url defaultvalue: https://cybertotal.cycraft.com type: 0 required: true - display: CyberTotal API Token name: token defaultvalue: "" type: 4 required: true additionalinfo: A necessary token is a credential, used for CyberTotal API. - display: Fetch indicators name: feed type: 8 required: false - display: Bad ip threshold name: threshold_ip defaultvalue: "10" type: 0 required: false - display: Bad hash threshold name: threshold_file defaultvalue: "10" type: 0 required: false - display: Bad domain threshold name: threshold_domain defaultvalue: "10" type: 0 required: false - display: Bad url threshold name: threshold_url defaultvalue: "10" type: 0 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy defaultvalue: "false" type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false script: script: '' type: python commands: - name: ip arguments: - name: ip required: true default: true description: List of IPs. isArray: true - name: threshold description: If the IP has reputation above the threshold then the IP defined as malicious. If threshold not set, then threshold from instance configuration is used. defaultValue: "10" outputs: - contextPath: CyberTotal.IP.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.IP.resource description: ' The scan target sent to CyberTotal.' type: string - contextPath: CyberTotal.IP.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.IP.permalink description: The link of this IP’s report in CyberTotal. type: string - contextPath: CyberTotal.IP.severity description: Severity of this IP. The range is from 0 to 10. type: number - contextPath: CyberTotal.IP.confidence description: Confidence of this IP. The range is from 0 to 10. type: number - contextPath: CyberTotal.IP.threat description: Threat of this IP, which is a select from ‘High’, ‘Medium’ and ‘Low’. type: string - contextPath: CyberTotal.IP.detection_engines description: The number of all antivirus vendors scanned. type: number - contextPath: CyberTotal.IP.positive_detections description: The number of antivirus vendors scanned with positive detection. type: number - contextPath: CyberTotal.IP.detection_ratio description: The ratio of positive_detections and detection_engines. type: string - contextPath: CyberTotal.IP.message description: Message about this search. type: string - contextPath: IP.Address description: IP address. type: String - contextPath: IP.DetectionEngines description: The total number of engines that checked the indicator. type: Number - contextPath: IP.PositiveDetections description: The number of engines that positively detected the indicator as malicious. type: Number - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP address as malicious. type: String - contextPath: IP.Malicious.Description description: A description explaining why the IP address was reported as malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Return IP information and reputation. - name: file arguments: - name: file required: true default: true description: list of hash(s). isArray: true - name: threshold description: If the HASH has reputation above the threshold then the HASH defined as malicious. If threshold not set, then threshold from instance configuration is used. defaultValue: "10" outputs: - contextPath: CyberTotal.File.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.File.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.File.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.File.permalink description: The link of this HASH’s report in CyberTotal. type: string - contextPath: CyberTotal.File.severity description: Severity of this HASH. The range is from 0 to 10. type: number - contextPath: CyberTotal.File.confidence description: Confidence of this HASH. The range is from 0 to 10. type: number - contextPath: CyberTotal.File.threat description: Threat of this HASH, which is a select from ‘High’, ‘Medium’ and ‘Low’. type: string - contextPath: CyberTotal.File.detection_engines description: The number of all antivirus vendors scanned. type: number - contextPath: CyberTotal.File.positive_detections description: The number of antivirus vendors scanned with positive detection. type: number - contextPath: CyberTotal.File.detection_ratio description: The ratio of positive_detections and detection_engines. type: string - contextPath: CyberTotal.File.message description: Message about this search. type: string - contextPath: CyberTotal.File.size description: Size of this file. type: string - contextPath: CyberTotal.File.md5 description: This file’s md5 value. type: string - contextPath: CyberTotal.File.sha1 description: This file’s sha1 value. type: string - contextPath: CyberTotal.File.sha256 description: This file’s sha256 value. type: string - contextPath: CyberTotal.File.extension description: This file’s extension type. type: string - contextPath: CyberTotal.File.name description: This file’s name, separated by ‘,’ if more than 2 names. type: string - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.Extension description: "The file extension, for example: 'xls'." type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Return file's information and reputation. - name: domain arguments: - name: domain required: true default: true description: List of domains. isArray: true - name: threshold description: If the domain has reputation above the threshold then the domain defined as malicious. If threshold not set, then threshold from instance configuration is used. defaultValue: "10" outputs: - contextPath: CyberTotal.Domain.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.Domain.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.Domain.permalink description: The link of this domain’s report in CyberTotal. type: string - contextPath: CyberTotal.Domain.severity description: Severity of this domain. The range is from 0 to 10. type: number - contextPath: CyberTotal.Domain.confidence description: Confidence of this domain. The range is from 0 to 10. type: number - contextPath: CyberTotal.Domain.threat description: Threat of this domain, which is a select from ‘High’, ‘Medium’ and ‘Low’. type: string - contextPath: CyberTotal.Domain.detection_engines description: The number of all antivirus vendors scanned. type: number - contextPath: CyberTotal.Domain.positive_detections description: The number of antivirus vendors scanned with positive detection. type: number - contextPath: CyberTotal.Domain.detection_ratio description: The ratio of positive_detections and detection_engines. type: string - contextPath: CyberTotal.Domain.message description: Message about this search. type: string - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: Domain.DetectionEngines description: The total number of engines that checked the indicator. type: Number - contextPath: Domain.PositiveDetections description: The number of engines that positively detected the indicator as malicious. type: Number - contextPath: Domain.Malicious.Vendor description: The vendor reporting the domain as malicious. type: String - contextPath: Domain.Malicious.Description description: A description explaining why the domain was reported as malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Return domain information and reputation. - name: url arguments: - name: url required: true default: true description: List of url(s). isArray: true - name: threshold description: If the URL has reputation above the threshold then the URL defined as malicious. If threshold not set, then threshold from instance configuration is used. defaultValue: "10" outputs: - contextPath: CyberTotal.URL.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.URL.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.URL.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.URL.permalink description: The link of this URL’s report in CyberTotal. type: string - contextPath: CyberTotal.URL.severity description: Severity of this URL. The range is from 0 to 10. type: number - contextPath: CyberTotal.URL.confidence description: Confidence of this URL. The range is from 0 to 10. type: number - contextPath: CyberTotal.URL.threat description: Threat of this URL, which is a select from ‘High’, ‘Medium’ and ‘Low’. type: string - contextPath: CyberTotal.URL.detection_engines description: The number of all antivirus vendors scanned. type: number - contextPath: CyberTotal.URL.positive_detections description: The number of antivirus vendors scanned with positive detection. type: number - contextPath: CyberTotal.URL.detection_ratio description: The ratio of positive_detections and detection_engines. type: string - contextPath: CyberTotal.URL.message description: Message about this search. type: string - contextPath: URL.Data description: The URL. type: String - contextPath: URL.DetectionEngines description: The total number of engines that checked the indicator. type: String - contextPath: URL.PositiveDetections description: The number of engines that positively detected the indicator as malicious. type: String - contextPath: URL.Malicious.Vendor description: The vendor reporting the URL as malicious. type: String - contextPath: URL.Malicious.Description description: A description of the malicious URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Return domain information and reputation. - name: cybertotal-ip-whois arguments: - name: ip required: true default: true description: List of IP(s). isArray: true outputs: - contextPath: CyberTotal.WHOIS-IP.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-IP.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.WHOIS-IP.message description: Message about this search. type: string - contextPath: CyberTotal.WHOIS-IP.permalink description: The link of this whois report in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-IP.createdAt description: 'Create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.updatedAt description: 'Update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.status description: Status of this IP. type: string - contextPath: CyberTotal.WHOIS-IP.domain description: Domain of this IP. type: string - contextPath: CyberTotal.WHOIS-IP.domainMd5 description: MD5 translation of CyberTotal.WHOIS-IP.domain type: string - contextPath: CyberTotal.WHOIS-IP.domainUnicode description: Encode CyberTotal.WHOIS-IP.domain by using unicode. type: string - contextPath: CyberTotal.WHOIS-IP.nameservers description: An array of all DNS nameservers. type: string - contextPath: CyberTotal.WHOIS-IP.registrarName description: The name of registrar. type: string - contextPath: CyberTotal.WHOIS-IP.registrarEmail description: The email address of registrar. type: string - contextPath: CyberTotal.WHOIS-IP.registrarPhone description: The phone number of registrar. type: string - contextPath: CyberTotal.WHOIS-IP.registrarCreatedAt description: 'Registrar create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.registrarUpdatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.registrarExpiresAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.auditCreatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.auditUpdatedAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-IP.registrant.name description: The name of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.organization description: The organization name of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.street description: The street name of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.city description: The location city of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.state description: The location state name of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.zip description: The post zip code of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.country description: The country of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.registrant.address description: The address of registrant. type: string - contextPath: CyberTotal.WHOIS-IP.admin.name description: The name of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.organization description: The organization name of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.street description: The street name of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.city description: The location city of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.state description: The location state name of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.zip description: The post zip code of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.country description: The country of admin. type: string - contextPath: CyberTotal.WHOIS-IP.admin.address description: The address of admin. type: string - contextPath: CyberTotal.WHOIS-IP.technical.name description: The name of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.organization description: The organization name of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.street description: The street name of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.city description: The location city of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.state description: The location state name of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.zip description: The post zip code of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.country description: The country of technical. type: string - contextPath: CyberTotal.WHOIS-IP.technical.address description: The address of technical. type: string - contextPath: CyberTotal.WHOIS-IP.contactEmails description: An array of all contact email address. type: string - contextPath: CyberTotal.WHOIS-IP.contacts description: An array of all contact details. type: string - contextPath: CyberTotal.WHOIS-IP.contactNames description: An array of all contact names. type: string - contextPath: CyberTotal.WHOIS-IP.contactCountries description: An array of all contact countries. type: string - contextPath: CyberTotal.WHOIS-IP.domainAvailable description: If this domain is available. type: boolean - contextPath: CyberTotal.WHOIS-IP.expired description: If this IP is expired. type: boolean description: Return ip whois information. - name: cybertotal-url-whois arguments: - name: url required: true default: true description: List of URL(s). isArray: true outputs: - contextPath: CyberTotal.WHOIS-URL.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-URL.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.WHOIS-URL.message description: Message about this search. type: string - contextPath: CyberTotal.WHOIS-URL.permalink description: The link of this whois report in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-URL.createdAt description: 'Create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.updatedAt description: 'Update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.status description: Status of this IP. type: string - contextPath: CyberTotal.WHOIS-URL.domain description: Domain of this IP. type: string - contextPath: CyberTotal.WHOIS-URL.domainMd5 description: MD5 translation of CyberTotal.WHOIS-URL.domain type: string - contextPath: CyberTotal.WHOIS-URL.domainUnicode description: Encode CyberTotal.WHOIS-URL.domain by using unicode. type: string - contextPath: CyberTotal.WHOIS-URL.nameservers description: An array of all DNS nameservers. type: string - contextPath: CyberTotal.WHOIS-URL.registrarName description: The name of registrar. type: string - contextPath: CyberTotal.WHOIS-URL.registrarEmail description: The email address of registrar. type: string - contextPath: CyberTotal.WHOIS-URL.registrarPhone description: The phone number of registrar. type: string - contextPath: CyberTotal.WHOIS-URL.registrarCreatedAt description: 'Registrar create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.registrarUpdatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.registrarExpiresAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.auditCreatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.auditUpdatedAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-URL.registrant.name description: The name of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.organization description: The organization name of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.street description: The street name of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.city description: The location city of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.state description: The location state name of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.zip description: The post zip code of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.country description: The country of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.registrant.address description: The address of registrant. type: string - contextPath: CyberTotal.WHOIS-URL.admin.name description: The name of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.organization description: The organization name of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.street description: The street name of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.city description: The location city of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.state description: The location state name of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.zip description: The post zip code of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.country description: The country of admin. type: string - contextPath: CyberTotal.WHOIS-URL.admin.address description: The address of admin. type: string - contextPath: CyberTotal.WHOIS-URL.technical.name description: The name of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.organization description: The organization name of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.street description: The street name of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.city description: The location city of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.state description: The location state name of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.zip description: The post zip code of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.country description: The country of technical. type: string - contextPath: CyberTotal.WHOIS-URL.technical.address description: The address of technical. type: string - contextPath: CyberTotal.WHOIS-URL.contactEmails description: An array of all contact email address. type: string - contextPath: CyberTotal.WHOIS-URL.contacts description: An array of all contact details. type: string - contextPath: CyberTotal.WHOIS-URL.contactNames description: An array of all contact names. type: string - contextPath: CyberTotal.WHOIS-URL.contactCountries description: An array of all contact countries. type: string - contextPath: CyberTotal.WHOIS-URL.domainAvailable description: If this domain is available. type: boolean - contextPath: CyberTotal.WHOIS-URL.expired description: If this URL is expired. type: boolean description: Return url whois information. - name: cybertotal-domain-whois arguments: - name: domain required: true default: true description: List of domain(s). isArray: true outputs: - contextPath: CyberTotal.WHOIS-Domain.scan_date description: 'Scan date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.task_id description: The unique id of each scan in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-Domain.resource description: The scan target sent to CyberTotal. type: string - contextPath: CyberTotal.WHOIS-Domain.message description: Message about this search. type: string - contextPath: CyberTotal.WHOIS-Domain.permalink description: The link of this whois report in CyberTotal. type: string - contextPath: CyberTotal.WHOIS-Domain.createdAt description: 'Create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.updatedAt description: 'Update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.status description: Status of this Domain. type: string - contextPath: CyberTotal.WHOIS-Domain.domain description: Top level Domain of this domain. type: string - contextPath: CyberTotal.WHOIS-Domain.domainMd5 description: MD5 translation of CyberTotal.WHOIS-Domain.domain type: string - contextPath: CyberTotal.WHOIS-Domain.domainUnicode description: Encode CyberTotal.WHOIS-Domain.domain by using unicode. type: string - contextPath: CyberTotal.WHOIS-Domain.nameservers description: An array of all DNS nameservers. type: string - contextPath: CyberTotal.WHOIS-Domain.registrarName description: The name of registrar. type: string - contextPath: CyberTotal.WHOIS-Domain.registrarEmail description: The email address of registrar. type: string - contextPath: CyberTotal.WHOIS-Domain.registrarPhone description: The phone number of registrar. type: string - contextPath: CyberTotal.WHOIS-Domain.registrarCreatedAt description: 'Registrar create date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.registrarUpdatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.registrarExpiresAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.auditCreatedAt description: 'Registrar update date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.auditUpdatedAt description: 'Registrar expire date format: ISO 8601.' type: date - contextPath: CyberTotal.WHOIS-Domain.registrant.name description: The name of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.organization description: The organization name of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.street description: The street name of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.city description: The location city of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.state description: The location state name of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.zip description: The post zip code of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.country description: The country of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.registrant.address description: The address of registrant. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.name description: The name of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.organization description: The organization name of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.street description: The street name of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.city description: The location city of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.state description: The location state name of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.zip description: The post zip code of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.country description: The country of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.admin.address description: The address of admin. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.name description: The name of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.organization description: The organization name of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.street description: The street name of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.city description: The location city of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.state description: The location state name of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.zip description: The post zip code of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.country description: The country of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.technical.address description: The address of technical. type: string - contextPath: CyberTotal.WHOIS-Domain.contactEmails description: An array of all contact email address. type: string - contextPath: CyberTotal.WHOIS-Domain.contacts description: An array of all contact details. type: string - contextPath: CyberTotal.WHOIS-Domain.contactNames description: An array of all contact names. type: string - contextPath: CyberTotal.WHOIS-Domain.contactCountries description: An array of all contact countries. type: string - contextPath: CyberTotal.WHOIS-Domain.domainAvailable description: If this domain is available. type: boolean - contextPath: CyberTotal.WHOIS-Domain.expired description: If this domain is expired. type: boolean description: Return domain whois information. dockerimage: demisto/python3:3.12.13.10116658 runonce: false subtype: python3 fromversion: 5.0.0 tests: - No tests (auto formatted)