commonfields: id: Digital Shadows version: -1 name: Digital Shadows display: Digital Shadows category: Data Enrichment & Threat Intelligence sectionorder: - Connect - Collect provider: ReliaQuest description: Digital Shadows monitors and manages an organization's digital risk across the widest range of data sources within the open, deep, and dark web. configuration: - display: Server URL name: server defaultvalue: https://portal-digitalshadows.com type: 0 required: true section: Connect - display: API Key name: apikey defaultvalue: "" type: 0 required: true section: Connect - display: Secret name: secret defaultvalue: "" type: 4 required: true section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - display: Fetch Limit name: fetchLimit defaultvalue: "50" type: 0 additionalinfo: Limit on the number of incidents retrieved in a single fetch. Must be an integer between 1 and 200 inclusive. required: false section: Collect - display: Initial Fetch (Minutes) name: initialFetch defaultvalue: "1" type: 0 additionalinfo: The time period in minutes for which to fetch historic incidents. This is used the first time incidents are fetched and if the last run details are reset. Must be an integer greater than or equal to 1. required: false section: Collect script: script: '' type: javascript commands: - name: ds-get-breach-reviews arguments: - name: breach_id required: true default: true description: Unique id of the data breach record to retrieve the status history for. outputs: - contextPath: DigitalShadows.BreachReviews.Note description: The note at this version (max length 500 characters). - contextPath: DigitalShadows.BreachReviews.Version description: Starts counting at 1 and increments for each review of a given data breach credential. Will initially be 0 until a review is performed (when returned as part of a credential). - contextPath: DigitalShadows.BreachReviews.Status description: Review status. - contextPath: DigitalShadows.BreachReviews.UserID description: ID of user that changed the status/set the note. - contextPath: DigitalShadows.BreachReviews.UserRole description: Role of user that changed the status/set the note. - contextPath: DigitalShadows.BreachReviews.UserPermissions description: Permissins of user that changed the status/set the note. - contextPath: DigitalShadows.BreachReviews.UserEmail description: Email address of user that changed the status/set the note. - contextPath: DigitalShadows.BreachReviews.CreatedAt description: The moment in time the review was created. description: Retrieve all review updates for a given data breach record. - name: ds-snapshot-breach-status arguments: - name: note description: The note at this version (max length 500 characters). - name: status required: true auto: PREDEFINED predefined: - OPEN - CLOSED - IGNORED description: Review status. - name: version description: When submitting, this value can be optionally set to the version of the most recently read review. - name: breach_id required: true default: true description: Unique id of the data breach record to submit a status update for. description: Snapshot the review status of a data breach record. - name: ds-find-breach-records arguments: - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - username - password - reviewStatus - published - breachCount description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: filter_distinction auto: PREDEFINED predefined: - NEW_USERNAME - EXISTING_USERNAME - DIFFERENT_PASSWORD - SAME_PASSWORD - DUPLICATED_ROW description: Narrow down to records based on how unique their username and/or password are. - name: filter_domainNames description: Only records that are related to these domain names. isArray: true - name: filter_password description: Records that match this password, use '' for wildcard matching, '\' to find an actual asterisk. - name: filter_published description: Narrow down to records based on when they were published. - name: filter_reviewStatuses description: List of statuses to include. Possible values are OPEN CLOSED IGNORED. isArray: true - name: filter_username description: Records that match this username, use '*' for wildcard matching. outputs: - contextPath: DigitalShadows.BreachRecords.Content description: The row content of this data breach record (a line from a csv file, for example). - contextPath: DigitalShadows.BreachRecords.Id description: Identifier for this data breach record. - contextPath: DigitalShadows.BreachRecords.Password description: The password found in the breach record, if any could be found. - contextPath: DigitalShadows.BreachRecords.DomainNames description: The domain names identified within the breach row. - contextPath: DigitalShadows.BreachRecords.PriorRowTextBreachCount description: The number of breaches the entire text of the breach row has appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.PriorUsernameBreachCount description: The number of breaches this username appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.PriorUsernamePasswordBreachCount description: The number of breaches this username/password combination have appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.Published description: When did this record become available. - contextPath: DigitalShadows.BreachRecords.Review.Created description: The moment in time the review was created. - contextPath: DigitalShadows.BreachRecords.Review.Status description: Review status. - contextPath: DigitalShadows.BreachRecords.Review.User.id description: Unique id of user. - contextPath: DigitalShadows.BreachRecords.Review.User.fullName description: Full name of the user. - contextPath: DigitalShadows.BreachRecords.Review.User.emailAddress description: Email address of the user. - contextPath: DigitalShadows.BreachRecords.Username description: A best effort to identify a username within the content of the breach record. - contextPath: DigitalShadows.BreachRecords.DataBreachId description: The data breach this record belongs to. description: Find data breach records. - name: ds-get-breach-summary arguments: [] description: Summary of all data breaches for the current client. - name: ds-find-breach-usernames arguments: - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - username - password - reviewStatus - published - breachCount description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: filter_domainNames description: Only records that are related to these domain names. - name: filter_published description: Narrow down to records based on when they were published. - name: filter_reviewStatuses description: List of statuses to include. Possible values are OPEN CLOSED IGNORED. - name: filter_username description: Records that match this username, use '*' for wildcard matching. outputs: - contextPath: DigitalShadows.Users.BreachCount description: The number of data breaches this username has appeared on. - contextPath: DigitalShadows.Users.DistinctPasswordCount description: The number of distict passwords encountered for this user. - contextPath: DigitalShadows.Users.Username description: The username that this summary is for. description: Find unique usernames found across all data breaches. - name: ds-get-breach arguments: - name: breach_id required: true default: true description: Id of the data breach to retrieve. outputs: - contextPath: DigitalShadows.Breaches.DomainCount description: Number of unique domains contained in the breach. - contextPath: DigitalShadows.Breaches.DomainName description: The domain the data breach occurred against. - contextPath: DigitalShadows.Breaches.DataClasses description: Data types contained within the breach. - contextPath: DigitalShadows.Breaches.Id description: Unique identifier for a breach. - contextPath: DigitalShadows.Breaches.IncidentId description: The ID of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentScope description: The scope of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentSeverity description: The severity of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentTitle description: The title of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentType description: The type of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.Occurred description: Date the breach occurred. - contextPath: DigitalShadows.Breaches.RecordCount description: Number of records contained in the breach. - contextPath: DigitalShadows.Breaches.SourceUrl description: The url the data breach was found on. - contextPath: DigitalShadows.Breaches.Title description: The title assigned to this data breach. description: Retrieve a data breach by its id. - name: ds-get-breach-records arguments: - name: breach_id required: true default: true description: Unique id of the data breach to retrieve records for. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - username - password - reviewStatus - published - breachCount description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: filter_distinction auto: PREDEFINED predefined: - NEW_USERNAME - EXISTING_USERNAME - DIFFERENT_PASSWORD - SAME_PASSWORD - DUPLICATED_ROW description: Narrow down to records based on how unique their username and/or password are. - name: filter_domainNames description: Only records that are related to these domain names. - name: filter_password description: Records that match this password, use '' for wildcard matching, '\' to find an actual asterisk. - name: filter_published description: Narrow down to records based on when they were published. - name: filter_reviewStatuses description: List of statuses to include. Possible values are OPEN CLOSED IGNORED. - name: filter_username description: Records that match this username, use '*' for wildcard matching. outputs: - contextPath: DigitalShadows.BreachRecords.Id description: Identifier for this data breach record. - contextPath: DigitalShadows.BreachRecords.Password description: The password found in the breach record, if any could be found. - contextPath: DigitalShadows.BreachRecords.PriorRowTextBreachCount description: The number of breaches the entire text of the breach row has appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.PriorUsernameBreachCount description: The number of breaches this username appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.PriorUsernamePasswordBreachCount description: The number of breaches this username/password combination have appeared in prior to the current breach. - contextPath: DigitalShadows.BreachRecords.Published description: When did this record become available. - contextPath: DigitalShadows.BreachRecords.Review.Created description: The most recent review for this record. - contextPath: DigitalShadows.BreachRecords.Review.Status description: The status of the most recent review for this record. - contextPath: DigitalShadows.BreachRecords.Review.User description: The user who created the most recent review for this record. - contextPath: DigitalShadows.BreachRecords.Username description: A best effort to identify a username within the content of the breach record. description: Find data breach records. - name: ds-find-data-breaches arguments: - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - title - domainName - occurred - published description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: filter_alerted auto: PREDEFINED predefined: - "true" - "false" description: Only include data breaches with associated incidents that have been alerted. - name: filter_domainNamesOnRecords description: List of domain names to filter by. Only data breaches that have one or more records attributed to this domain name. - name: filter_minimumTotalRecords description: Only include data breaches that have at least this many total records (inclusive). - name: filter_published description: Narrow down to records based on when they were published. - name: filter_repostedCredentials description: Filter out breaches depending on whether they consist entirely of reposted credentials or not. ORIGINAL or REPOST. - name: filter_severities description: Only include data breaches with associated incidents having one of these severities, if not specified, all are considered. - name: filter_statuses description: List of statuses to filter by. Pssible values:UNREAD, READ, CLOSED. - name: filter_username description: Only show breaches that include this username. outputs: - contextPath: DigitalShadows.Breaches.DomainCount description: Number of unique domains contained in the breach. - contextPath: DigitalShadows.Breaches.DomainName description: The domain the data breach occurred against. - contextPath: DigitalShadows.Breaches.DataClasses description: Data types contained within the breach. - contextPath: DigitalShadows.Breaches.Id description: Unique identifier for a breach. - contextPath: DigitalShadows.Breaches.IncidentId description: The ID of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentScope description: The Scope of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentSeverity description: The severity of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentTitle description: The title of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.IncidentType description: The type of the incident raised for the breach, most specific to the client. - contextPath: DigitalShadows.Breaches.Occurred description: Date the breach occurred. - contextPath: DigitalShadows.Breaches.Modified description: When was this breach last modified. - contextPath: DigitalShadows.Breaches.RecordCount description: Number of records contained in the breach. - contextPath: DigitalShadows.Breaches.SourceUrl description: The url the data breach was found on. - contextPath: DigitalShadows.Breaches.Title description: The title assigned to this data breach. - contextPath: DigitalShadows.Breaches.OrganisationUsernameCount description: The number of distict usernames found that belong to the current organisation. description: Find data breaches. - name: ds-get-incident arguments: - name: incident_id description: Identifier of the incident. required: true default: true - name: fulltext description: Show full text results. auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: DigitalShadows.Incidents.Alerted description: The moment this incident was brought to the attention of the client. - contextPath: DigitalShadows.Incidents.Description description: Plain text description of this incident. - contextPath: DigitalShadows.Incidents.ImpactDescription description: Description of what impact the incident will have. - contextPath: DigitalShadows.Incidents.Id description: Identifier for this incident, unique in combination with the scope. - contextPath: DigitalShadows.Incidents.Internal description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise. - contextPath: DigitalShadows.Incidents.Mitigation description: Information about what can be done to mitigate the effect of the problem. - contextPath: DigitalShadows.Incidents.Occurred description: Best effort to establish when the incident occurre. - contextPath: DigitalShadows.Incidents.Modified description: When was this incident last modified. - contextPath: DigitalShadows.Incidents.Scope description: Identifies whether this incident applies globally (intelligence) or just to your organization. - contextPath: DigitalShadows.Incidents.Type description: The category of incident that has been raised. - contextPath: DigitalShadows.Incidents.Title description: A short but descriptive identifier for the incident. - contextPath: DigitalShadows.Incidents.Review.Created description: The moment in time the review was created. - contextPath: DigitalShadows.Incidents.Review.Status description: Review status. - contextPath: DigitalShadows.Incidents.Review.User description: The user that changed the status/set the note. - contextPath: DigitalShadows.Incidents.SubType description: The sub-category of incident that has been raised, if available. - contextPath: DigitalShadows.Incidents.Severity description: Analyst defined severity based on potential risk to the client. description: Retrieve an incident by its id. - name: ds-get-incident-reviews arguments: - name: incident_id required: true default: true description: Id of the incident to retrieve the review history for. outputs: - contextPath: DigitalShadows.IncidentReviews.Note description: The note at this version (max length 500 characters). - contextPath: DigitalShadows.IncidentReviews.Created description: The moment in time the review was created. - contextPath: DigitalShadows.IncidentReviews.Status description: Review status. - contextPath: DigitalShadows.IncidentReviews.User.Id description: The unique id of the user that changed the status/set the note. - contextPath: DigitalShadows.IncidentReviews.User.EmailAddress description: The email address of the user that changed the status/set the note. - contextPath: DigitalShadows.IncidentReviews.User.FullName description: The full name of the user that changed the status/set the note. - contextPath: DigitalShadows.IncidentReviews.User.Role description: The role of the user that changed the status/set the note. - contextPath: DigitalShadows.IncidentReviews.User.Status description: The status of the user that changed the status/set the note. description: Retrieve all review updates for a given incident. - name: ds-snapshot-incident-review arguments: - name: incident_id required: true default: true description: Id of the incident to apply a review update to. - name: note description: The note at this version (max length 500 characters). - name: status auto: PREDEFINED predefined: - UNREAD - READ - CLOSED description: Review status. - name: version description: When submitting, this value can be optionally set to the version of the most recently read review. If the version on the server does not match this value, a 409 conflict will be returned. description: Snapshot the review status of an incident. - name: ds-find-incidents-filtered arguments: - name: subscribed auto: PREDEFINED predefined: - "true" - "false" description: If true, the results will also include any subscribed intelligence incidents. - name: subscribedOnly auto: PREDEFINED predefined: - "true" - "false" description: If true, the only results returned will be subscribed intelligence incidents. Must not be set to true with subscribed set to false. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - sevirity - verified - occurred - published - modified - date description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: filter_alerted auto: PREDEFINED predefined: - "true" - "false" description: Only incidents that have been alerted to the client. - name: filter_dateRange description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_dateRangeField auto: PREDEFINED predefined: - verified - occurred - modified - published description: Determines which date/time field the dateRange will apply to. - name: filter_domainName description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM. - name: filter_domainSelection auto: PREDEFINED predefined: - NONE - CUSTOM - INTERNAL - EXTERNAL description: Determine how domain filtering will be applied. - name: filter_identifier description: Only return the incident that has this identifier. - name: filter_repostedCredentials description: Option specific to data breach based incidents to filter out new and reposted breach credentials. ORIGINAL, REPOST. - name: filter_severities description: Only include incidents with these severities, if not specified, all are considered. VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE. - name: filter_statuses description: UNREAD, READ, CLOSED. - name: filter_types_type description: The category of incident that has been raised. - name: filter_types_subTypes description: The sub-category of incident that has been raised, if available. - name: filter_types_content_severity description: Analyst defined severity based on potential risk to the client. - name: filter_tagOperator auto: PREDEFINED predefined: - OR - AND description: Whether multiple tags should be logically applied as AND/OR with the resultset. - name: filter_withContentRemoved auto: PREDEFINED predefined: - "true" - "false" description: Include incidents for which the content of the incident has been removed form the source. - name: filter_withTakedown auto: PREDEFINED predefined: - "true" - "false" description: Include incidents on which one or more takedown requests have been generated. - name: filter_withoutContentRemoved auto: PREDEFINED predefined: - "true" - "false" description: Include incidents for which the content of the incident has not been removed form the source. - name: filter_withoutTakedown auto: PREDEFINED predefined: - "true" - "false" description: Include incidents on which a takedown request has not been generated. outputs: - contextPath: DigitalShadows.Incidents.Alerted description: The moment this incident was brought to the attention of the client. - contextPath: DigitalShadows.Incidents.Description description: Plain text description of this incident. - contextPath: DigitalShadows.Incidents.Id description: Identifier for this incident, unique in combination with the scope. - contextPath: DigitalShadows.Incidents.Internal description: Will be true if domain belongs to your organization (as defined by the assets), false otherwis. - contextPath: DigitalShadows.Incidents.Mitigation description: Information about what can be done to mitigate the effect of the problem. - contextPath: DigitalShadows.Incidents.Modified description: When was this incident last modified. - contextPath: DigitalShadows.Incidents.Occurred description: Best effort to establish when the incident occurred. - contextPath: DigitalShadows.Incidents.Published description: When was this incident originally published. - contextPath: DigitalShadows.Incidents.RestrictedContent description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted. - contextPath: DigitalShadows.Incidents.Scope description: Identifies whether this incident applies globally (intelligence) or just to your organization. - contextPath: DigitalShadows.Incidents.Severity description: Analyst defined severity based on potential risk to the client. - contextPath: DigitalShadows.Incidents.SubType description: The sub-category of incident that has been raised, if available. - contextPath: DigitalShadows.Incidents.Verified description: The moment when the incident was verified. - contextPath: DigitalShadows.Incidents.Type description: The category of incident that has been raised. - contextPath: DigitalShadows.Incidents.Version description: Each time an update occurs, this version number is incremented. - contextPath: DigitalShadows.Incidents.Review.Created description: The date the review state for this incident was created. - contextPath: DigitalShadows.Incidents.Review.Status description: The status of the review state for this incident. - contextPath: DigitalShadows.Incidents.Review.User.id description: The user that create the review state for this incident. - contextPath: DigitalShadows.Incidents.Review.User.fullName description: The full name of the user that created review state for this incident. description: Find incidents with filtering options. - name: ds-get-incidents-summary arguments: - name: filter_domainName description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM. - name: filter_dateRangeField auto: PREDEFINED predefined: - verified - occurred - modified - published description: Determines which date/time field the dateRange will apply to. - name: filter_identifier description: Only return the incident that has this identifier. - name: filter_dateRange description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: groupByKey auto: PREDEFINED predefined: - severity - domainName - type - subType - reviewStatus description: Determines which incident property will be grouped on. Mutually exclusive with groupByKeys. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - severity - verified - occurred - modified - published - date description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. description: Aggregated summary of incident information used to generate reports/statistics. - name: ds-get-apt-report arguments: - name: report_id required: true default: true description: The unique identifier assigned to a given APT report (UUID based). outputs: - contextPath: DigitalShadows.APTReports.Id description: Internal identifier for uniquely identifying this report. - contextPath: DigitalShadows.APTReports.Name description: Name assigned to this report for ease of identification. - contextPath: DigitalShadows.APTReports.Published description: The date the report became available. - contextPath: DigitalShadows.APTReports.Report.Id description: The ID of the report resource allowing it to be downloaded. - contextPath: DigitalShadows.APTReports.Report.Link description: The link of the report resource allowing it to be downloaded. - contextPath: DigitalShadows.APTReports.Preview.Id description: ID of a preview image of the frontpage of the report, if available. - contextPath: DigitalShadows.APTReports.Preview.Link description: A fully qualified link URI for preview image of the frontpage of the report, if available. description: Retrieve details of the specified APT report. - name: ds-get-intelligence-incident arguments: - name: incident_id required: true default: true description: The id of the intelligence incident to retrieve. outputs: - contextPath: DigitalShadows.IntelligenceIncidents.Description description: Plain text description of this incident. - contextPath: DigitalShadows.IntelligenceIncidents.Id description: Identifier for this incident, unique in combination with the scope. - contextPath: DigitalShadows.IntelligenceIncidents.IndicatorOfCompromiseCount description: Count of IOCs that can be retrieved via /api/incidents/{id}/iocs endpoint. - contextPath: DigitalShadows.IntelligenceIncidents.Internal description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise. - contextPath: DigitalShadows.IntelligenceIncidents.LinkedContentIncidents description: Other incidents that appear to be based on the same content as this incident. Each incident record will normally only contain the id and the scope it applies to. Could also include more details depending on the context it is called in. - contextPath: DigitalShadows.IntelligenceIncidents.Modified description: When was this incident last modified. - contextPath: DigitalShadows.IntelligenceIncidents.Occurred description: Best effort to establish when the incident occurred. - contextPath: DigitalShadows.IntelligenceIncidents.Published description: When was this incident originally published. - contextPath: DigitalShadows.IntelligenceIncidents.RelatedIncidentId description: If an incident specific to your organization exists for this intelligence incident, it will be included here. - contextPath: DigitalShadows.IntelligenceIncidents.RestrictedContent description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted. - contextPath: DigitalShadows.IntelligenceIncidents.Scope description: Identifies whether this incident applies globally (intelligence) or just to your organization. - contextPath: DigitalShadows.IntelligenceIncidents.Severity description: Analyst defined severity based on potential risk to the client. - contextPath: DigitalShadows.IntelligenceIncidents.SubType description: The sub-category of incident that has been raised, if available. - contextPath: DigitalShadows.IntelligenceIncidents.Title description: A short but descriptive identifier for the incident. - contextPath: DigitalShadows.IntelligenceIncidents.Type description: The category of incident that has been raised. - contextPath: DigitalShadows.IntelligenceIncidents.Verified description: The moment when the incident was verified. - contextPath: DigitalShadows.IntelligenceIncidents.Version description: Each time an update occurs, this version number is incremented. description: Retrieve an intelligence incident by its id. - name: ds-get-intelligence-incident-iocs arguments: - name: incident_id required: true default: true description: The intelligence incident identifier. - name: visible description: List of values to control the visibility of elements. If a value is present then the correspinding element should be displayed. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - value - type - updated - source description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: filter_value description: The filter that will narrow the results based on one or more criteria. - name: filter_types description: List of types to filter by. Possible values are IP,MD5,SHA1,SHA256,URL,CVE,EMAIL,HOST,REGISTRY,FILEPATH,FILENAME. outputs: - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Id description: Internal identifier for uniquely identifying this IOC. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.IntelIncident.Id description: If this IOC is associated with an intel incident. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.IntelIncident.Scope description: If this IOC is associated with an intel incident. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Type description: Identifies the type of incidicator that also determines how it is encoded into a string. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Value description: The value of this indicator, encoded according to its type. For example hashes are base16 encoded. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.Source description: A comment provided by the analysts as to where this IOC came from. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.LastUpdated description: When this record last changed. - contextPath: DigitalShadows.IntelligenceIncidentsIOCs.AptReport.Id description: If this IOC is associated with an APT report. description: Retrieve the indicatorsOfCompromise for this intel incident. - name: ds-find-intelligence-incidents arguments: - name: filter_dateRange description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_dateRangeField auto: PREDEFINED predefined: - verified - occurred - modified - published description: Determines which date/time field the dateRange will apply to. - name: filter_domainName description: Only incidents that have this domain, applied if domainSelection is null or CUSTOM. - name: filter_domainSelection auto: PREDEFINED predefined: - NONE - CUSTOM - INTERNAL - EXTERNAL description: Determine how domain filtering will be applied. - name: filter_identifier description: Only return the incident that has this identifier. - name: filter_severities description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE. - name: filter_tagOperator auto: PREDEFINED predefined: - OR - AND description: Whether multiple tags should be logically applied as AND/OR with the resultset. - name: filter_tags_id description: Limit to incidents that have these tags ids only. - name: filter_threatRecordIds description: Restrict intel incidents to those tagged with one or more of these threat records. - name: filter_threatTypes_type description: Restrict intel incidents to those associated with threats of these types:ACTOR,CAMPAIGN,EVENT,TOOL,SPECIFIC_TTP,LOCATION. - name: filter_threatTypes auto: PREDEFINED predefined: - DATA_LEAKAGE - CYBER_THREAT - PHYSICAL_SECURITY - SOCIAL_MEDIA_COMPLIANCE - BRAND_PROTECTION - INFRASTRUCTURE description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. - name: filter_threatSubTypes description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - severity - verified - occurred - modified - published - date description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. outputs: - contextPath: DigitalShadows.IntelligenceIncidents.Description description: Plain text description of this incident. - contextPath: DigitalShadows.IntelligenceIncidents.Id description: Identifier for this incident, unique in combination with the scope. - contextPath: DigitalShadows.IntelligenceIncidents.IndicatorOfCompromiseCount description: Count of IOCs that can be retrieved via /api/incidents/{id}/iocs endpoint. - contextPath: DigitalShadows.IntelligenceIncidents.Internal description: Will be true if domain belongs to your organization (as defined by the assets), false otherwise. - contextPath: DigitalShadows.IntelligenceIncidents.LinkedContentIncidents description: Other incidents that appear to be based on the same content as this incident. Each incident record will normally only contain the id and the scope it applies to. Could also include more details depending on the context it is called in. - contextPath: DigitalShadows.IntelligenceIncidents.Modified description: When was this incident last modified. - contextPath: DigitalShadows.IntelligenceIncidents.Occurred description: Best effort to establish when the incident occurred. - contextPath: DigitalShadows.IntelligenceIncidents.Published description: When was this incident originally published. - contextPath: DigitalShadows.IntelligenceIncidents.RelatedIncidentId description: If an incident specific to your organization exists for this intelligence incident, it will be included here. - contextPath: DigitalShadows.IntelligenceIncidents.RestrictedContent description: Identifies this incident as potentially containing questionable content. If this is true images will be restricted. - contextPath: DigitalShadows.IntelligenceIncidents.Scope description: Identifies whether this incident applies globally (intelligence) or just to your organization. - contextPath: DigitalShadows.IntelligenceIncidents.Severity description: Analyst defined severity based on potential risk to the client. - contextPath: DigitalShadows.IntelligenceIncidents.SubType description: The sub-category of incident that has been raised, if available. - contextPath: DigitalShadows.IntelligenceIncidents.Title description: A short but descriptive identifier for the incident. - contextPath: DigitalShadows.IntelligenceIncidents.Type description: The category of incident that has been raised. - contextPath: DigitalShadows.IntelligenceIncidents.Verified description: The moment when the incident was verified. - contextPath: DigitalShadows.IntelligenceIncidents.Version description: Each time an update occurs, this version number is incremented. description: Find intelligence incidents. - name: ds-find-intelligence-incidents-regional arguments: - name: threat_id description: Threat ID. - name: countryTag_created description: When was this tag created. - name: countryTag_description description: Description text for this tag. - name: countryTag_id description: Unique integer identifier for this tag. - name: countryTag_name description: The name of this tag. Is unique in combination with the type. - name: countryTag_parent_id description: Parent id of the tag. - name: countryTag_threat_id description: Unique integer identifier (among threats). - name: countryTag_threat_type auto: PREDEFINED predefined: - ACTOR - CAMPAIGN - EVENT - TOOL - SPECIFIC_TTP - LOCATION description: The type of profile being represented. - name: countryTag_type auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: The type of this tag. The name of tags with the same type must be unique. - name: filter_dateRange description: Determines the interval the incidents must have occurred within to be included. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_periodRelativeTo description: Optional timestamp that will be used as the end date for a period based dateRange. If not specified, then the end of the current day (based on the requesting user's timezone) will be used. - name: filter_tagType auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: What types of tags should be considered. Should be one of SOURCE_GEOGRAPHY or TARGET_GEOGRAPHY (the default). - name: regionTag_created description: When was this tag created. - name: regionTag_description description: Description text for this tag. - name: regionTag_id description: Unique integer identifier for this tag. - name: regionTag_name description: The name of this tag. Is unique in combination with the type. - name: regionTag_parent_id description: Parent id of the tag. - name: regionTag_threat_id description: Unique integer identifier (among threats). - name: regionTag_threat_type auto: PREDEFINED predefined: - ACTOR - CAMPAIGN - EVENT - TOOL - SPECIFIC_TTP - LOCATION description: The type of profile being represented. - name: regionTag_type auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: The type of this tag. The name of tags with the same type must be unique. outputs: - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Id description: The ID of the country these incidents are attributed to. - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Name description: The country name these incidents are attributed to. - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ParentId description: The parent ID of the country these incidents are attributed to. - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.ThreatId description: The threat id of the country tag these incidents are attributed to. - contextPath: DigitalShadows.IntelligenceIncidentsRegional.CountryTag.Type description: The country tag type these incidents are attributed to. - contextPath: DigitalShadows.IntelligenceIncidentsRegional.IncidentIds description: The list of intelligence incidents. description: Incidents grouped by the target country over a given time range. - name: ds-get-intelligence-threat arguments: - name: threat_id required: true default: true description: The id of the intelligence threat to retrieve. - name: opt auto: PREDEFINED predefined: - LATEST_INCIDENT description: Options to include additional relevant data with the request. outputs: - contextPath: DigitalShadows.IntelligenceThreats.ActivityLevel description: Level of activity, based on last active. - contextPath: DigitalShadows.IntelligenceThreats.DetailLevel description: Determines how detailed the record is. - contextPath: DigitalShadows.IntelligenceThreats.EndDate description: The end date of the period this was/is active. - contextPath: DigitalShadows.IntelligenceThreats.Id description: Unique integer identifier (among threats). - contextPath: DigitalShadows.IntelligenceThreats.ImageId description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property). - contextPath: DigitalShadows.IntelligenceThreats.ImageThumbnailId description: The unique identifier for a thumbnail of the image, if available. The image can be retrieved by requesting /api/thumbnails/{id} (replacing {id} with the value of this property). - contextPath: DigitalShadows.IntelligenceThreats.IndicatorOfCompromiseCount description: Count of IOCs. - contextPath: DigitalShadows.IntelligenceThreats.LastActive description: The date of last activity (last incident). - contextPath: DigitalShadows.IntelligenceThreats.Recurring description: Will this become active again in future? - contextPath: DigitalShadows.IntelligenceThreats.StartDate description: The start date of the period this was/is active. - contextPath: DigitalShadows.IntelligenceThreats.Type description: The type of profile being represented. - contextPath: DigitalShadows.IntelligenceThreats.Tags.ActorTypeTags description: Tags for the type of actor. - contextPath: DigitalShadows.IntelligenceThreats.AnnouncementIncidentIDs description: List of public declarations made (incidents). - contextPath: DigitalShadows.IntelligenceThreats.AptReportIDs description: APT reports associated with this threat. Each entry can be resolved via the /api/apt-report/{id} endpoint. - contextPath: DigitalShadows.IntelligenceThreats.Tags.AssociatedActorTags description: Actors related to this threat (if any). - contextPath: DigitalShadows.IntelligenceThreats.Tags.AssociatedCampaignTags description: Campaigns related to this threat (if any). - contextPath: DigitalShadows.IntelligenceThreats.AssociatedEventIDs description: Events associated with this threat (if any). - contextPath: DigitalShadows.IntelligenceThreats.AttackEvidenceIncidentIDs description: List of damage caused incidents. - contextPath: DigitalShadows.IntelligenceThreats.Tags.ImpactEffectTags description: What impact did it have. - contextPath: DigitalShadows.IntelligenceThreats.Tags.IntendedEffectTags description: What the threat intended to happen. - contextPath: DigitalShadows.IntelligenceThreats.LatestIncidentID description: The latest incident attributed to this threat. - contextPath: DigitalShadows.IntelligenceThreats.Tags.MotivationTags description: Tags that define what motivates the threat. - contextPath: DigitalShadows.IntelligenceThreats.Tags.OverviewTags description: Tags that will appear in the overview. Only one per primary type. - contextPath: DigitalShadows.IntelligenceThreats.Tags.PrimaryLanguageTags description: Tags that identify the primary languages used. - contextPath: DigitalShadows.IntelligenceThreats.ThreatLevel description: Information about the level of threat, for example low or high. description: Retrieve a specific item of intelligence by its id. - name: ds-get-intelligence-threat-iocs arguments: - name: threat_id required: true default: true description: The intelligence threat identifier. - name: filter_types description: List of types to filter by. Possible values are IP,MD5,SHA1,SHA256,URL,CVE,EMAIL,HOST,REGISTRY,FILEPATH,FILENAME. - name: filter_value description: Value to filter by. - name: visible description: List of values to control the visibility of elements. If a value is present then the correspinding element should be displayed. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - value - type - updated - source description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. outputs: - contextPath: DigitalShadows.IntelligenceThreatIOCs.AptReportId description: If this IOC is associated with an APT report. - contextPath: DigitalShadows.IntelligenceThreatIOCs.Id description: Internal identifier for uniquely identifying this IOC. - contextPath: DigitalShadows.IntelligenceThreatIOCs.IntelIncidentId description: If this IOC is associated with an intel incident. - contextPath: DigitalShadows.IntelligenceThreatIOCs.LastUpdated description: When this record last changed. - contextPath: DigitalShadows.IntelligenceThreatIOCs.Source description: A comment provided by the analysts as to where this IOC came from. - contextPath: DigitalShadows.IntelligenceThreatIOCs.Type description: Identifies the type of incidicator that also determines how it is encoded into a string. - contextPath: DigitalShadows.IntelligenceThreatIOCs.Value description: The value of this indicator, encoded according to its type. For example hashes are base16 encoded. description: Retrieve the indicatorsOfCompromise for a threat record. - name: ds-get-intelligence-threat-activity arguments: - name: customPrimaryTags_id description: Instead of most active, specify the ids of threat primary tags to retrieve activity for. - name: includeIncidents auto: PREDEFINED predefined: - "true" - "false" description: Should basic incident information be included with the activity for each tag. - name: maximumIncidentsPerTag description: Upper limit on the number of incidents to include for each threat. - name: mostActiveForTypes description: Fetch the top presetPerTypeCount most active threats for each type. Possible values:ACTOR,CAMPAIGN,EVENT,TOOL,SPECIFIC_TTP,LOCATION. - name: mostActiveLimit description: How many threats to retrieve activity for per threat type. Only applies when mostActiveForTypes is not null. If not specified, 10 is assumed. - name: segmentCount description: Number of time segments to aggregrate the incidents into. - name: filter_dateRange required: true description: Return activity that occurred in this date range. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. description: Threat activity based on the number of intelligence incidents over a given period of time. - name: ds-find-intelligence-threats arguments: - name: filter_dateRange description: Only return results that were last active within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_dateRangeField auto: PREDEFINED predefined: - lastActive - modified description: Determines which date/time field the dateRange will apply to. - name: filter_identifiers description: List of identifiers. Only return threat profiles with these identifiers. - name: filter_relevantTo auto: PREDEFINED predefined: - ANY - ORGANIZATION - INDUSTRY_SECTOR description: Narrow to threats that have a specific relevance to my organization. - name: filter_tagOperator auto: PREDEFINED predefined: - "true" - "false" description: Whether multiple tags should be logically applied as AND/OR with the resultset. - name: filter_tags description: Limit to threats related to these tags only. - name: filter_threatLevels description: Only include threats with one of these threat levels. outputs: - contextPath: DigitalShadows.IntelligenceThreatsRegional.ActivityLevel description: Level of activity, based on last active. - contextPath: DigitalShadows.IntelligenceThreatsRegional.Id description: Unique integer identifier (among threats). - contextPath: DigitalShadows.IntelligenceThreatsRegional.ImageId description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property). - contextPath: DigitalShadows.IntelligenceThreatsRegional.LastActive description: The date of last activity (last incident). - contextPath: DigitalShadows.IntelligenceThreatsRegional.Type description: The type of profile being represented. - contextPath: DigitalShadows.IntelligenceThreatsRegional.ThreatLevelType description: Information about the level of threat, for example low or high. - contextPath: DigitalShadows.IntelligenceThreatsRegional.Event description: For an EVENT or CAMPAIGN threat this will contain a summary of when it occurred and possibly when it will re-occur. description: Find intelligence threat records. - name: ds-find-intelligence-threats-regional arguments: - name: countryTag_created description: When was this tag created. - name: countryTag_description description: Description text for this tag. - name: countryTag_id description: Unique integer identifier for this tag. - name: countryTag_name description: The name of this tag. Is unique in combination with the type. - name: countryTag_parent_id description: Parent id of the tag. - name: countryTag_threat_id description: Unique integer identifier (among threats). - name: countryTag_threat_type auto: PREDEFINED predefined: - ACTOR - CAMPAIGN - EVENT - TOOL - SPECIFIC_TTP - LOCATION description: The type of profile being represented. - name: countryTag_type auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: The type of this tag. The name of tags with the same type must be unique. - name: filter_dateRange description: Determines the interval the incidents must have occurred within to be included. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_periodRelativeTo description: Optional timestamp that will be used as the end date for a period based dateRange. If not specified, then the end of the current day (based on the requesting user's timezone) will be used. - name: filter_tagType auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: What types of tags should be considered. Should be one of SOURCE_GEOGRAPHY or TARGET_GEOGRAPHY (the default). - name: regionTag_created description: When was this tag created. - name: regionTag_description description: Description text for this tag. - name: regionTag_id description: Unique integer identifier for this tag. - name: regionTag_name description: The name of this tag. Is unique in combination with the type. - name: regionTag_parent_id description: Parent id of the tag. - name: regionTag_threat_id description: Unique integer identifier (among threats). - name: regionTag_threat_type auto: PREDEFINED predefined: - ACTOR - CAMPAIGN - EVENT - TOOL - SPECIFIC_TTP - LOCATION description: The type of profile being represented. - name: regionTag_type auto: PREDEFINED predefined: - ACTOR - ACTOR_TYPE - BRAND_PROTECTION - CLIENT_ROUTING - CYBER_THREAT - DATA_BREACH - DATA_COLLECTION_TYPE - DATA_LEAKAGE - EVENT - EVENT_TYPE - GENERAL - IMPACT_EFFECTS - INTENDED_EFFECTS - KILL_CHAIN - LANGUAGE - CRIMINAL_LOCATION - MOTIVATION - OPERATION - CAMPAIGN - PHYSICAL_SECURITY - INFRASTRUCTURE - PROCEDURES - SEED_DATA_LABEL - SOCIAL_MEDIA_COMPLIANCE - SOURCE_GEOGRAPHY - SPECIFIED_TARGETS - TARGET_GEOGRAPHY - TARGET_SECTORS - TECHNIQUES - TOOLS - CATEGORY_TTP - GENERAL_TTP - SPECIFIC_TTP - CVE_NUMBER - APP_STORE description: The type of this tag. The name of tags with the same type must be unique. - name: threat_id description: Id of the threat. outputs: - contextPath: DigitalShadows.IntelligenceThreatsRegional.ActivityLevel description: Level of activity, based on last active. - contextPath: DigitalShadows.IntelligenceThreatsRegional.Id description: Unique integer identifier (among threats). - contextPath: DigitalShadows.IntelligenceThreatsRegional.ImageId description: The unique identifier for an image of the threat, if available. The actual image can be retrieved by requesting /api/resources/{id} (replacing {id} with the value of this property). - contextPath: DigitalShadows.IntelligenceThreatsRegional.LastActive description: The date of last activity (last incident). - contextPath: DigitalShadows.IntelligenceThreatsRegional.Type description: The type of profile being represented. - contextPath: DigitalShadows.IntelligenceThreatsRegional.ThreatLevelType description: Information about the level of threat, for example low or high. - contextPath: DigitalShadows.IntelligenceThreatsRegional.Event description: For an EVENT or CAMPAIGN threat this will contain a summary of when it occurred and possibly when it will re-occur. - contextPath: DigitalShadows.IntelligenceThreatsRegional.OverviewTags description: Tags that will appear in the overview. Only one per primary type. description: Threat profiles associated with incidents over a given time range. - name: ds-get-port-reviews arguments: - name: port required: true default: true description: Port inspection id. - name: incidentId description: ID of incident to query. outputs: - contextPath: DigitalShadows.IpPortReviews.Created description: The moment in time the review was created. - contextPath: DigitalShadows.IpPortReviews.Status description: Review status. - contextPath: DigitalShadows.IpPortReviews.Version description: Starts counting at 1 and increments for each review of a given port. Will initially be 0 until a review is performed (when returned as part of a port). - contextPath: DigitalShadows.IpPortReviews.Incident.Id description: Id of the incident the port inspection is associated with. - contextPath: DigitalShadows.IpPortReviews.Incident.Scope description: Scope of the incident the port inspection is associated with. - contextPath: DigitalShadows.IpPortReviews.User.Id description: ID of the user that changed the status/set the note. - contextPath: DigitalShadows.IpPortReviews.User.FullName description: Full name of the user that changed the status/set the note. description: Retrieve all review updates for a given port inspection. - name: ds-snapshot-port-review arguments: - name: port required: true default: true description: Port inspection id. - name: version description: When submitting, this value can be optionally set to the version of the most recently read review. - name: status auto: PREDEFINED predefined: - OPEN - CLOSED description: Review status. - name: incident_id description: Identifier for this incident, unique in combination with the scope. - name: incident_scope auto: PREDEFINED predefined: - GLOBAL - ORGANIZATION description: Identifies whether this incident applies globally (intelligence) or just to your organization. description: Snapshot the review status of a port inspection. - name: ds-find-ports arguments: - name: filter_alerted auto: PREDEFINED predefined: - "true" - "false" description: Only include SSL/certificates with associated incidents that have been alerted. - name: filter_detectedClosed description: Only return IP ports that were detected closed. auto: PREDEFINED predefined: - "true" - "false" - name: filter_detectedOpen description: Only return IP ports that were detected open within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_domainName description: Name of domain to filter by. - name: filter_incidentTypes auto: PREDEFINED predefined: - DATA_LEAKAGE - CYBER_THREAT - PHYSICAL_SECURITY - SOCIAL_MEDIA_COMPLIANCE - BRAND_PROTECTION - INFRASTRUCTURE description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. - name: filter_incidentSubTypes description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT. - name: filter_ipAddress description: IP address to filter by. - name: filter_ipRange_lowerAddress description: Lower address for ip range. - name: filter_ipRange_maskBits description: Int value for mask bits. - name: filter_ipRange_upperAddress description: Upper address for ip range. - name: filter_markedClosed auto: PREDEFINED predefined: - "true" - "false" description: Is incident closed. - name: filter_published description: Only return IP ports that were published within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_severities description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - published - detected - domain - grade - expiryDate - severity description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. outputs: - contextPath: DigitalShadows.IpPorts.DiscoveredOpen description: When was the port found to be open. - contextPath: DigitalShadows.IpPorts.Id description: Identifier for the port inspection. - contextPath: DigitalShadows.IpPorts.IpAddress description: The IP address this port was found on. - contextPath: DigitalShadows.IpPorts.PortNumber description: The IP port number scanned (1-65535). - contextPath: DigitalShadows.IpPorts.Transport description: IP transport protocol used. - contextPath: DigitalShadows.IpPorts.Incident.Id description: Id the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.Scope description: Scope of the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.Severity description: Severity of the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.SubType description: Subtype of the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.Type description: Type of the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.Title description: Title of the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Incident.Published description: Published time the most recent incident to include this port. - contextPath: DigitalShadows.IpPorts.Review.Status description: Status of when the port was last reviewed. - contextPath: DigitalShadows.IpPorts.Review.UserId description: User Id of the port last review. - contextPath: DigitalShadows.IpPorts.Review.UserName description: Name of user who created last review. - contextPath: DigitalShadows.IpPorts.Review.Version description: Version of last port review. description: Find ports. - name: ds-find-secure-sockets arguments: - name: filter_alerted auto: PREDEFINED predefined: - "true" - "false" description: Only include SSL/certificates with associated incidents that have been alerted. - name: filter_detected description: Only include detected sockets. - name: filter_determinedResolved description: Only include determined resolved sockets. - name: filter_domain description: Filter by domain. - name: filter_expiry description: Filter by expiry date. - name: filter_grades description: List of grades (A,B,C,D,E,F,T). - name: filter_incidentTypes auto: PREDEFINED predefined: - DATA_LEAKAGE - CYBER_THREAT - PHYSICAL_SECURITY - SOCIAL_MEDIA_COMPLIANCE - BRAND_PROTECTION - INFRASTRUCTURE description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. - name: filter_incidentSubTypes description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT. - name: filter_ipAddress description: IP address to filter by. - name: filter_issues description: List of string values from POODLE, POODLE_TLS, FREAK, DROWN, LOGJAM, RC4_AVAILABLE, SELF_SIGNED, MD5_OR_SHA1_SIGNED, REVOKED, EXPIRING_LOW, EXPIRING_MEDIUM, EXPIRING_HIGH, EXPIRED, HOSTNAME_MISMATCH, TLS_1_2_NOT_FOUND. - name: filter_markedClosed auto: PREDEFINED predefined: - "true" - "false" description: Is incident closed. - name: filter_published description: Filter by publish time. - name: filter_revoked description: Only include revoked sockets. auto: PREDEFINED predefined: - "true" - "false" - name: filter_severities description: Only include SSL/certificate infrastructure incidents with these severities. String values from VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE. - name: filter_statuses description: Only include SSL/certificates with associated incidents having these statuses, (or with any status if none are supplied). UNREAD, READ, CLOSED. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - published - detected - domain - grade - expiryDate - severity description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. outputs: - contextPath: DigitalShadows.SecureSockets.Id description: Unique identifier for this inspection. - contextPath: DigitalShadows.SecureSockets.ReverseDomainName description: The reverse DNS name of the host. - contextPath: DigitalShadows.SecureSockets.CertificateCommonName description: The server certificate common name. - contextPath: DigitalShadows.SecureSockets.Discovered description: When were the certificate issue(s) found. - contextPath: DigitalShadows.SecureSockets.DomainName description: The domain name the secure socket was discovered on for the default port 443/TCP. - contextPath: DigitalShadows.SecureSockets.Grade description: The rating calculated for the secure socket at the time of the scan. - contextPath: DigitalShadows.SecureSockets.IpAddress description: The actual IP address the probe connected to. - contextPath: DigitalShadows.SecureSockets.PortNumber description: The port number the socket was found listening on. - contextPath: DigitalShadows.SecureSockets.Transport description: IP transport protocol used, most likely TCP. - contextPath: DigitalShadows.SecureSockets.Issues description: The set of issues detected for the secure socket. - contextPath: DigitalShadows.SecureSockets.Review.Status description: Status of most recent review of this inspection. - contextPath: DigitalShadows.SecureSockets.Review.UserId description: ID of user who created the most recent review of this inspection. - contextPath: DigitalShadows.SecureSockets.Review.UserName description: Name of user who created the most recent review of this inspection. - contextPath: DigitalShadows.SecureSockets.Review.Version description: Version of most recent review of this inspection. - contextPath: DigitalShadows.SecureSockets.Incident.Id description: Incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.Scope description: Scope of incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.Severity description: Severity of incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.SubType description: SubType of incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.Type description: Type of incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.Title description: Title of incident corresponding for this secure socket issues occurence. - contextPath: DigitalShadows.SecureSockets.Incident.Published description: Published time of incident corresponding for this secure socket issues occurence. description: Find secure sockets. - name: ds-find-vulnerabilities arguments: - name: filter_alerted description: Only include SSL/certificates with associated incidents that have been alerted. - name: filter_cveIdentifiers description: Filter by CVE identifiers. - name: filter_detected description: Only return vulnerabilities that were detected within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_detectedClosed auto: PREDEFINED predefined: - "true" - "false" description: True or false. - name: filter_domainName description: Name of domain to filter by. - name: filter_incidentTypes auto: PREDEFINED predefined: - DATA_LEAKAGE - CYBER_THREAT - PHYSICAL_SECURITY - SOCIAL_MEDIA_COMPLIANCE - BRAND_PROTECTION - INFRASTRUCTURE description: The type to match to. Will match to any incident with this type unless subTypes is not empty, in which case only incident matches based on the sub-type will be considered. - name: filter_incidentSubTypes description: List of pecific sub type(s) to match to. String values from BRAND_MISUSE, COMPANY_THREAT, CORPORATE_INFORMATION, CREDENTIAL_COMPROMISE, CUSTOMER_DETAILS, CVE, DEFAMATION, DOMAIN_CERTIFICATE_ISSUE, EMPLOYEE_THREAT, EXPOSED_PORT, INTELLECTUAL_PROPERTY, INTERNALLY_MARKED_DOCUMENT, LEGACY_MARKED_DOCUMENT, MOBILE_APPLICATION, NEGATIVE_PUBLICITY, PERSONAL_INFORMATION, PHISHING_ATTEMPT, PROTECTIVELY_MARKED_DOCUMENT, SPOOF_PROFILE, TECHNICAL_INFORMATION,TECHNICAL_LEAKAGE, UNMARKED_DOCUMENT. - name: filter_ipAddress description: IP address to filter by. - name: filter_markedClosed auto: PREDEFINED predefined: - "true" - "false" description: Filter by incidents that are marked as CLOSED. - name: filter_published description: Only return vulnerabilities that were published within this date range (inclusive). Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_severities description: List of sevirity values to filter by. Can be VERY_HIGH, HIGH, MEDIUM, LOW, VERY_LOW, NONE. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - ipAddress - detected - published - severity description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. outputs: - contextPath: DigitalShadows.Vulnerabilities.CveId description: The CVE id. - contextPath: DigitalShadows.Vulnerabilities.Id description: Identifier for this detected vulnerability. - contextPath: DigitalShadows.Vulnerabilities.Discovered description: When was the vulnerability found. - contextPath: DigitalShadows.Vulnerabilities.IpAddress description: The IP address this port was found on. - contextPath: DigitalShadows.Vulnerabilities.Review.Status description: Status of most recent review of this vulnerability. - contextPath: DigitalShadows.Vulnerabilities.Review.UserId description: ID of user who created the most recent review of this vulnerability. - contextPath: DigitalShadows.Vulnerabilities.Review.UserName description: Name of user who created the most recent review of this vulnerability. - contextPath: DigitalShadows.Vulnerabilities.Review.Version description: Version of most recent review of this vulnerability. - contextPath: DigitalShadows.Vulnerabilities.Incident.Id description: ID of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.Scope description: Scope of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.Severity description: Severity of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.SubType description: SubType of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.Type description: Type of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.Title description: Title of incident corresponding for this vulnerability occurence. - contextPath: DigitalShadows.Vulnerabilities.Incident.Published description: Published of incident corresponding for this vulnerability occurence. description: Find vulnerabilities. - name: ds-search arguments: - name: filter_datePeriod description: Only return results that occurred during the given period prior to the current time. For absolute dates, use from and until. - name: filter_dateRange description: Only return results that were verified/occurred/modified within this date range (inclusive). The field this applies to is controlled by dateRangeField. Supports ISO Periods (eg P1D), intervals (eg 2015-01-01T00:00:00Z/2015-01-31T00:00:00Z) and any one of the constants {TODAY, YESTERDAY, WEEK, LAST_WEEK, MONTH, LAST_MONTH, YEAR, LAST_YEAR}. - name: filter_from description: Only return results that were last active after this date/time (inclusive). - name: filter_tags description: Only return results that have the following tags associated with them. - name: filter_types auto: PREDEFINED predefined: - ACTORS - CAMPAIGNS - INCIDENTS - EVENT - SPECIFIC_TTP - LOCATION - DATA_BREACH - CLOSED_SOURCES description: Restrict the result types to only those listed here. At least one value is required. - name: filter_until description: Only return results that were last active before this date/time (inclusive). - name: query description: The query text to search for. - name: sort_direction auto: PREDEFINED predefined: - ASCENDING - DESCENDING description: The direction of sorting. If not specified, ASCENDING is assumed. - name: sort_property auto: PREDEFINED predefined: - relevance - sortDate description: The name of the property being sorted on. This normally corresponds to the property name of the result type, but could be a 'virtual property'. - name: pagination_offset description: Include results at this offset within the full resultset, where the first result is at position 0. - name: pagination_size description: Maximum number of results to return per page, can be initially null to be replaced by default later. - name: pagination_containingId description: Select the page containing the record with this id, if supported. Mutually exclusive with offset. description: Perform a textual search against the available record types. - name: ds-get-tags arguments: - name: ids description: One or more tag identifiers. - name: detailed auto: PREDEFINED predefined: - "true" - "false" description: Determines whether the tag descriptions will be included. description: Batch retrieve specic tags by their ids. isfetch: true fromversion: 5.0.0 defaultmapperin: Digital Shadows Incident Mapper defaultclassifier: Digital Shadows Incident Classifier tests: - No tests (auto formatted)