commonfields: id: GoogleThreatIntelligence version: -1 name: GoogleThreatIntelligence display: Google Threat Intelligence fromversion: 6.10.0 category: Data Enrichment & Threat Intelligence provider: Google sectionorder: - Connect - Collect description: Analyzes suspicious hashes, URLs, domains, and IP addresses. configuration: - display: API Key (leave empty. Fill in the API key in the password field.) displaypassword: API Key name: credentials type: 9 required: true hiddenusername: true section: Connect - additionalinfo: Reliability of the source providing the intelligence data defaultvalue: C - Fairly reliable display: Source Reliability name: feedReliability type: 15 options: - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: false section: Collect - display: GTI Malicious Verdict. Check Google Threat Intelligence verdict to consider the file malicious. name: gti_malicious defaultvalue: 'false' type: 8 required: false section: Collect - display: GTI Suspicious Verdict. Check Google Threat Intelligence verdict to consider the file suspicious. name: gti_suspicious defaultvalue: 'false' type: 8 required: false section: Collect - display: File Malicious Threshold. Minimum number of positive results from VT scanners to consider the file malicious. name: fileThreshold defaultvalue: '10' type: 0 required: false section: Collect - display: File Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the file suspicious. name: fileSuspiciousThreshold defaultvalue: '5' type: 0 required: false section: Collect - display: IP Malicious Threshold. Minimum number of positive results from VT scanners to consider the IP malicious. name: ipThreshold defaultvalue: '10' type: 0 required: false section: Collect - display: IP Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the IP suspicious. name: ipSuspiciousThreshold defaultvalue: '5' type: 0 required: false section: Collect - display: Disable reputation lookups for private IP addresses name: disable_private_ip_lookup defaultvalue: 'false' type: 8 required: false additionalinfo: To reduce the number of lookups made to the VT API, this option can be selected to gracefully skip enrichment of any IP addresses allocated for private networks. section: Collect - display: 'URL Malicious Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.' name: urlThreshold defaultvalue: '10' type: 0 required: false section: Collect - display: 'URL Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the URL suspicious.' name: urlSuspiciousThreshold defaultvalue: '5' type: 0 required: false section: Collect - display: Domain Malicious Threshold. Minimum number of positive results from VT scanners to consider the Domain malicious. name: domainThreshold defaultvalue: '10' type: 0 required: false section: Collect - display: Domain Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the Domain suspicious. name: domainSuspiciousThreshold defaultvalue: '5' type: 0 required: false section: Collect - display: Preferred Vendors List. CSV list of vendors who are considered more trustworthy. name: preferredVendors defaultvalue: '' type: 12 required: false section: Collect - display: Preferred Vendor Threshold. The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious. name: preferredVendorsThreshold defaultvalue: '5' type: 0 required: false section: Collect - display: Enable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS. name: crowdsourced_yara_rules_enabled type: 8 defaultvalue: 'true' required: false section: Collect - display: Crowdsourced Yara Rules Threshold name: yaraRulesThreshold type: 0 defaultvalue: '1' required: false section: Collect - display: Sigma and Intrusion Detection Rules Threshold name: SigmaIDSThreshold type: 0 defaultvalue: '5' required: false section: Collect - display: Domain Popularity Ranking Threshold name: domain_popularity_ranking type: 0 defaultvalue: '10000' required: false section: Collect - display: IP Relationships name: ip_relationships type: 16 required: false additionalinfo: Select the list of relationships to retrieve from the API. options: - 'communicating files' - 'downloaded files' - referrer files - 'urls' defaultvalue: 'communicating files,downloaded files,referrer files,urls' section: Collect - additionalinfo: Select the list of relationships to retrieve from the API. display: Domain Relationships name: domain_relationships options: - 'cname records' - 'caa records' - 'communicating files' - 'downloaded files' - immediate parent - 'mx records' - 'ns records' - 'parent' - 'referrer files' - 'siblings' - 'soa records' - subdomains - 'urls' type: 16 defaultvalue: 'cname records,caa records,communicating files,downloaded files,immediate parent,mx records,ns records,parent,referrer files,siblings,soa records,subdomains,urls' required: false section: Collect - additionalinfo: Select the list of relationships to retrieve from the API. display: URL Relationships name: url_relationships options: - 'communicating files' - 'contacted domains' - 'contacted ips' - 'downloaded files' - last serving ip address - network location - 'redirecting urls' - 'redirects to' - 'referrer files' - 'referrer urls' type: 16 defaultvalue: 'communicating files,contacted domains,contacted ips,downloaded files,last serving ip address,network location,redirecting urls,redirects to,referrer files,referrer urls' required: false section: Collect - display: File Relationships name: file_relationships type: 16 required: false additionalinfo: Select the list of relationships to retrieve from the API. options: - 'carbonblack children' - 'carbonblack parents' - 'compressed parents' - contacted domains - contacted ips - contacted urls - dropped files - 'email attachments' - 'email parents' - 'embedded domains' - 'embedded ips' - 'embedded urls' - execution parents - 'itw domains' - 'itw ips' - 'overlay children' - 'overlay parents' - 'pcap children' - 'pcap parents' - pe resource children - pe resource parents - 'similar files' defaultvalue: 'carbonblack children,carbonblack parents,compressed parents,contacted domains,contacted ips,contacted urls,dropped files,email attachments,email parents,embedded domains,embedded ips,embedded urls,execution parents,itw domains,itw ips,overlay children,overlay parents,pcap children,pcap parents,pe resource children,pe resource parents,similar files' section: Collect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect script: script: '' type: python subtype: python3 commands: - name: file arguments: - name: file required: true default: true description: Hash of the file to query. Supports MD5, SHA1, and SHA256. isArray: true - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: File.MD5 description: Bad MD5 hash. - contextPath: File.SHA1 description: Bad SHA1 hash. - contextPath: File.SHA256 description: Bad SHA256 hash. - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. - contextPath: File.Malicious.Detections description: For malicious files, the total number of detections. - contextPath: File.Malicious.TotalEngines description: For malicious files, the total number of engines that checked the file hash. - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_description description: Description of the type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tlsh description: The locality-sensitive hashing. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEType description: MIME type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Names of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.javascript_info.tags description: Tags of the JavaScript. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileType description: The file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.WordCount description: Total number of words in the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.LineCount description: Total number of lines in file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.info description: Number of IDS that marked the file as "info". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.high description: Number of IDS that marked the file as "high". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.medium description: Number of IDS that marked the file as "medium". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.low description: Number of IDS that marked the file as "low". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.critical description: Number of Sigma analysis that marked the file as "critical". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.high description: Number of Sigma analysis that marked the file as "high". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.medium description: Number of Sigma analysis that marked the file as "medium". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.low description: Number of Sigma analysis that marked the file as "low". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEEncoding description: The MIME encoding. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileTypeExtension description: The file type extension. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.Newlines description: Number of newlines signs. type: String - contextPath: GoogleThreatIntelligence.File.attributes.trid.file_type description: The TrID file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.trid.probability description: The TrID probability. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.description description: Description of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.source description: Source of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.author description: Author of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_name description: Rule set name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.rule_name description: Name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_id description: ID of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_modification_date description: The last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.type_tag description: Tag of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.popular_threat_classification.suggested_threat_label description: Suggested thread label. type: String - contextPath: GoogleThreatIntelligence.File.attributes.popular_threat_classification.popular_threat_name description: The popular thread name. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.times_submitted description: Number of times the file was submitted. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_submission_date description: Last submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.downloadable description: Whether the file is downloadable. type: Boolean - contextPath: GoogleThreatIntelligence.File.attributes.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_extension description: Extension of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tags description: File tags. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_date description: Last analysis date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.unique_sources description: Unique sources. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.first_submission_date description: First submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.ssdeep description: SSDeep hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.magic description: Identification of file by the magic number. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.harmless description: The number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.type-unsupported description: The number of engines that found the indicator to be of type unsupported. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.confirmed-timeout description: The number of engines that confirmed the timeout of the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.failure description: The number of failed analysis engines. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.meaningful_name description: Meaningful name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.reputation description: The reputation of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.threat_score.value description: GTI threat score of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.severity.value description: GTI severity of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.verdict.value description: GTI verdict of the file. type: String - contextPath: GoogleThreatIntelligence.File.type description: Type of the indicator (file). type: String - contextPath: GoogleThreatIntelligence.File.id description: Type ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.File.links.self description: Link to the response. type: String description: Checks the file reputation of the specified hash. - name: ip arguments: - name: ip required: true default: true description: IP address to check. isArray: true - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: override_private_lookup description: When set to "true", enrichment of private IP addresses will be conducted even if it has been disabled at the integration level. defaultValue: false predefined: - 'true' - 'false' outputs: - contextPath: IP.Address description: Bad IP address. - contextPath: IP.ASN description: Bad IP ASN. - contextPath: IP.Geo.Country description: Bad IP country. - contextPath: IP.Relationships.EntityA description: The source of the relationship. type: string - contextPath: IP.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: IP.Relationships.Relationship description: The name of the relationship. type: string - contextPath: IP.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: IP.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision. - contextPath: IP.Malicious.Description description: For malicious IPs, the reason that the vendor made the decision. - contextPath: IP.ASOwner description: The autonomous system owner of the IP. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.regional_internet_registry description: Regional internet registry (RIR). type: String - contextPath: GoogleThreatIntelligence.IP.attributes.jarm description: JARM data. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.network description: Network data. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.country description: The country where the IP is located. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.as_owner description: IP owner. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.last_analysis_stats.harmless description: The number of engines that found the domain to be harmless. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.asn description: ASN data. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.whois_date description: Date of the last update of the whois record. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.reputation description: IP reputation. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.last_modification_date description: Last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.continent description: The continent where the IP is located. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.whois description: whois data. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.gti_assessment.threat_score.value description: GTI threat score of the IP address. type: Number - contextPath: GoogleThreatIntelligence.IP.attributes.gti_assessment.severity.value description: GTI severity of the IP address. type: String - contextPath: GoogleThreatIntelligence.IP.attributes.gti_assessment.verdict.value description: GTI verdict of the IP address. type: String - contextPath: GoogleThreatIntelligence.IP.type description: Indicator IP type. type: String - contextPath: GoogleThreatIntelligence.IP.id description: ID of the IP. type: String description: Checks the reputation of an IP address. - name: url arguments: - name: url required: true default: true description: URL to check. isArray: true - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: URL.Data description: Bad URLs found. - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: string - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: string - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.raw_md5 description: The MD5 hash of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.dhash description: Difference hash. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_modification_date description: Last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.times_submitted description: The number of times the url has been submitted. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.threat_names description: Name of the threats found. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_submission_date description: The last submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_length description: The last HTTPS response length. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.date description: The last response header date. type: Date - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.x-sinkhole description: DNS sinkhole from last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-length description: The content length of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-type description: The content type of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.reputation description: Reputation of the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_date description: The date of the last analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.has_content description: Whether the url has content in it. type: Boolean - contextPath: GoogleThreatIntelligence.URL.attributes.first_submission_date description: The first submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_sha256 description: The SHA-256 hash of the content of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_code description: Last response status code. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_final_url description: Last final URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.url description: The URL itself. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.title description: Title of the page. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.harmless description: The number of engines that found the domain to be harmless. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.outgoing_links description: Outgoing links of the URL page. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.threat_score.value description: GTI threat score of the URL. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.severity.value description: GTI severity of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.verdict.value description: GTI verdict of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.type description: Type of the indicator (url). type: String - contextPath: GoogleThreatIntelligence.URL.id description: ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.URL.links.self description: Link to the response. type: String description: Checks the reputation of a URL. - name: domain arguments: - name: domain required: true default: true description: Domain name to check. isArray: true - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: Domain.Name description: Bad domain found. - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. - contextPath: Domain.Relationships.EntityA description: The source of the relationship. type: string - contextPath: Domain.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: Domain.Relationships.Relationship description: The name of the relationship. type: string - contextPath: Domain.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: Domain.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.last_dns_records.type description: The type of the last DNS records. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.last_dns_records.value description: The value of the last DNS records. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.last_dns_records.ttl description: The time To live (ttl) of the last DNS records. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.jarm description: JARM data. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.whois description: whois data. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.last_dns_records_date description: The last DNS records date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_analysis_stats.harmless description: The number of engines that found the domain to be harmless. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.favicon.raw_md5 description: MD5 hash of the domain. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.favicon.dhash description: Difference hash. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.reputation description: Reputation of the indicator. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.registrar description: Registrar information. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.last_update_date description: Last updated date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.last_modification_date description: Last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.creation_date description: Creation date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.gti_assessment.threat_score.value description: GTI threat score of the domain. type: Number - contextPath: GoogleThreatIntelligence.Domain.attributes.gti_assessment.severity.value description: GTI severity of the domain. type: String - contextPath: GoogleThreatIntelligence.Domain.attributes.gti_assessment.verdict.value description: GTI verdict of the domain. type: String - contextPath: GoogleThreatIntelligence.Domain.type description: Type of indicator (domain). type: String - contextPath: GoogleThreatIntelligence.Domain.id description: ID of the domain. type: String - contextPath: GoogleThreatIntelligence.Domain.links.self description: Link to the domain investigation. type: String description: Checks the reputation of a domain. - name: cve arguments: - name: cve required: true description: Provide CVE ID. Supports comma-separated values. isArray: true outputs: - contextPath: CVE.CVSS.Score description: CVSS score indicating the severity of the vulnerability. type: Number - contextPath: CVE.CVSS.Vector description: CVSS vector string representing attack metrics and impact. type: String - contextPath: CVE.Description description: Full textual description of the CVE, including affected components and exploitation details. type: String - contextPath: CVE.ID description: Unique identifier for the CVE (e.g., CVE-2025-14205). type: String - contextPath: CVE.Modified description: Timestamp when the CVE record was last modified (e.g., 1766963614). type: Date - contextPath: CVE.Published description: Timestamp when the CVE was originally published (e.g., 1766963614). type: Date - contextPath: CVE.Relationships.EntityA description: First entity in the relationship (usually the CVE ID). type: String - contextPath: CVE.Relationships.EntityAType description: Type of the first entity (e.g., CVE). type: String - contextPath: CVE.Relationships.EntityB description: Second entity in the relationship (e.g., file, IP, domain). type: String - contextPath: CVE.Relationships.EntityBType description: Type of the second entity (e.g., File, Domain, IP). type: String - contextPath: CVE.Relationships.Relationship description: Nature of the relationship between EntityA and EntityB (e.g., related-to). type: String - contextPath: CVE.Relationships.STIXID description: STIX ID associated with the CVE relationship. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability rating of the threat intelligence source (e.g., A - Completely reliable, B - Usually reliable). type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: GoogleThreatIntelligence.CVE.id description: ID of the CVE. type: String - contextPath: GoogleThreatIntelligence.CVE.type description: Data type returned (usually 'cve'). type: String - contextPath: GoogleThreatIntelligence.CVE.links.self description: API link to the detailed CVE resource. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.urls_count description: Number of URLs associated with the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.is_content_translated description: Indicates if the CVE content has been machine-translated. type: Boolean - contextPath: GoogleThreatIntelligence.CVE.attributes.autogenerated_tags description: Tags automatically generated for this CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.subscribers_count description: Number of GTI users subscribed to updates for this CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.risk_rating description: GTI-assigned risk rating (e.g., Low/Medium/High/Critical). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.title description: Title of the external reference source. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.name description: Name of the external reference source. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.url description: URL of the external reference source. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.source_description description: Description of the reference source. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv2_0.base_score description: CVSS v2 base score from the source. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv2_0.temporal_score description: CVSS v2 temporal score from the source. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv2_0.vector description: CVSS v2 vector string. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x.base_score description: CVSS v3 base score from the source. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x.temporal_score description: CVSS v3 temporal score from the source. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x.vector description: CVSS v3 vector string. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv4_x.score description: CVSS v4 base score from the source. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv4_x.vector description: CVSS v4 vector string. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv4_x.threat.exploit_maturity description: Threat metrics associated with CVSS v4. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x_translated.temporal_score description: Machine-translated CVSS v3 metrics. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x_translated.base_score description: Machine-translated CVSS v3 metrics. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.cvss.cvssv3_x_translated.vector description: Machine-translated CVSS v3 metrics. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.published_date description: Source publication date for the CVE information. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.md5 description: MD5 hash associated with the source content. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.sources.unique_id description: Unique identifier for the source entry. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.name description: Name/title of the CVE entry inside GTI. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.capabilities description: Attacker capabilities related to the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.technologies description: Technologies impacted by the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.files description: Number of malicious files associated with the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.domains description: Number of domains associated with the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.ip_addresses description: Number of IP addresses linked to the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.urls description: Number of URLs related to the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.iocs description: Total indicator count associated with the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.subscribers description: Number of subscribers following the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.counters.attack_techniques description: Count of associated attack techniques (MITRE etc.). type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cve_id description: The CVE identifier (e.g., CVE-2024-12345). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.domains_count description: Number of domains involved in CVE activity. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.version_history.date description: Date when the version entry was updated. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.version_history.version_notes description: Notes about changes in CVE version history. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.alt_names description: Alternate names or aliases for the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.recent_activity_summary description: Recent activity score or summary related to exploitation. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation.exploit_release_date description: Date when exploit code was released. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation.first_exploitation description: Date when the CVE was first exploited. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation.tech_details_release_date description: Date technical details were publicly released. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.mitigations description: Mitigation steps for the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.top_icon_md5 description: MD5 hash of the top-listed malicious sample. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.description description: Full CVE description. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.targeted_regions description: Geographic regions targeted by exploitation. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.detection_names description: Security vendor detection names linked to the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.vendor_fix_references description: Vendor-published fix or patch references. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.malware_roles description: Malware roles (dropper, loader, etc.) related to the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.collection_links description: Related collection or reference links from GTI. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.source_regions_hierarchy description: Hierarchy of affected regions sourced by GTI. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.references_count description: Number of references for the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.creation_date description: Date when the CVE entry was created in GTI. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.risk_factors description: List of risk factors contributing to severity. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.exploit_availability description: Availability status of exploit (e.g., Available/None). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.merged_actors description: Threat actors linked to this vulnerability. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.first_seen_details description: Details on when this CVE was first observed. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.available_mitigation description: Available mitigations for exploitation prevention. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.last_modification_date description: Last updated timestamp for the CVE in GTI. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.mve_id description: MVE (Multi-Vulnerability Event) ID for grouping related issues. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.tags description: Tags associated with the CVE inside GTI. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv2_0.base_score description: CVSS v2 base score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv2_0.temporal_score description: CVSS v2 temporal score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv2_0.vector description: CVSS v2 vector notation. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x.base_score description: CVSS v3 base score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x.temporal_score description: CVSS v3 temporal score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x.vector description: CVSS v3 vector string. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.score description: CVSS v4 score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.provider_urgency description: Provider urgency supplemental metric. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.response_effort description: Response effort supplemental metric. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.recovery description: Recovery supplemental metric. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.safety description: Safety supplemental metric. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.value_density description: Value density supplemental metric. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.supplemental.automatable description: Indicates if exploitation can be automated. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.vector description: CVSS v4 vector string. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv4_x.threat.exploit_maturity description: Exploit maturity level (e.g., High/Functional/Proof of Concept). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x_translated.base_score description: Machine-translated CVSS v3 base score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x_translated.temporal_score description: Machine-translated CVSS v3 temporal score. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.cvss.cvssv3_x_translated.vector description: Machine-translated CVSS v3 vector. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.collection_type description: Type of GTI collection this CVE belongs to. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.targeted_industries description: Industries targeted by exploitation of this CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.cwe.title description: Title of the mapped CWE (root cause). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.cwe.id description: CWE identifier linked to the CVE. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.affected_systems description: Systems or platforms affected by the vulnerability. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.tags_details description: Detailed metadata for GTI tags. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.executive_summary description: High-level summary of the vulnerability impact. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.priority description: GTI-assigned priority score/category. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.alt_names_details description: Additional details about alternate CVE names. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.targeted_regions_hierarchy description: Hierarchy of targeted regions for exploitation. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.epss.percentile description: EPSS percentile (Exploit Prediction Scoring System). type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.epss.score description: EPSS score indicating exploitation likelihood. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.date_of_disclosure description: Date when the vulnerability was publicly disclosed. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.days_to_report description: Time taken from discovery to reporting. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.targeted_industries_tree description: Hierarchical breakdown of targeted industries. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.status description: Current vulnerability status (e.g., Active, Resolved). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.intended_effects description: Intent or malicious outcomes achieved by exploiting the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.private description: Whether the CVE entry is private in GTI. type: Boolean - contextPath: GoogleThreatIntelligence.CVE.attributes.targeted_informations description: Types of information targeted by attackers. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.ip_addresses_count description: Number of IPs related to the vulnerability. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.mati_genids_dict.report_id description: MATI report ID linked to the CVE. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.mati_genids_dict.cve_id description: CVE ID mapped within MATI dataset. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.mati_genids_dict.mve_id description: MVE ID mapped within MATI dataset. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation_state description: Current exploitation state (Known Exploited / No Evidence). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.sources description: Source list for specific enriched fields. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.source_url description: URL of the field’s data source. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.field_type description: Type of field data (e.g., text, reference). type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.source_name description: Name of the field’s data source provider. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.field description: Field name being sourced. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.sources.source_names description: Names of the sources contributing to this field. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.field_sources.source.sources.source_urls description: URLs of the sources contributing to this field. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation_vectors description: Methods or vectors used to exploit the vulnerability. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.threat_scape description: Threat landscape and context around the CVE. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.operating_systems description: Operating systems impacted by the CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.last_seen_details description: Last observed exploitation activity details. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.workarounds description: Workarounds available to mitigate the vulnerability. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.motivations description: Attacker motivations behind exploiting this CVE. type: List - contextPath: GoogleThreatIntelligence.CVE.attributes.predicted_risk_rating description: AI-generated predicted risk rating. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.files_count description: Number of files linked to the CVE. type: Number - contextPath: GoogleThreatIntelligence.CVE.attributes.exploitation_consequence description: Possible consequences of exploitation. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.origin description: Origin/source of the CVE data. type: String - contextPath: GoogleThreatIntelligence.CVE.attributes.aggregations description: Aggregated threat or metadata information. type: List - contextPath: GoogleThreatIntelligence.CVE.context_attributes.shared_with_me description: Indicates if the CVE is shared with the user. type: Boolean - contextPath: GoogleThreatIntelligence.CVE.context_attributes.role description: User role for viewing this CVE in GTI. type: String description: Retrieves CVE information from Google Threat Intelligence. - name: file-scan arguments: - name: entryID required: true default: true description: The file entry ID to submit. isArray: true - name: uploadURL description: Special upload URL for files larger than 32 MB. Can be acquired from the gti-file-scan-upload-url command. outputs: - contextPath: GoogleThreatIntelligence.Submission.type description: The submission type. type: String - contextPath: GoogleThreatIntelligence.Submission.id description: The ID of the submission. type: String - contextPath: GoogleThreatIntelligence.Submission.EntryID description: The entry ID of the file detonated. type: String - contextPath: GoogleThreatIntelligence.Submission.Extension description: File extension. type: String - contextPath: GoogleThreatIntelligence.Submission.Info description: File info. type: String - contextPath: GoogleThreatIntelligence.Submission.MD5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Name description: Name of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA256 description: SHA-256 of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA512 description: SHA-512 of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SSDeep description: SSDeep of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Size description: Size of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Type description: The type of the submission (analysis). type: String description: Submits a file for scanning. Use the gti-analysis-get command to get the scan results. - name: file-rescan arguments: - name: file required: true default: true description: Hash of the file to rescan. Supports MD5, SHA1, and SHA256. outputs: - contextPath: GoogleThreatIntelligence.Submission.Type description: The type of the submission (analysis). type: String - contextPath: GoogleThreatIntelligence.Submission.id description: The ID of the submission. type: String - contextPath: GoogleThreatIntelligence.Submission.hash description: The indicator sent to rescan. type: String description: Rescans an already submitted file. This avoids having to upload the file again. Use the gti-analysis-get command to get the scan results. - name: url-scan arguments: - name: url required: true default: true description: The URL to scan. outputs: - contextPath: GoogleThreatIntelligence.Submission.Type description: The type of the submission (analysis). type: String - contextPath: GoogleThreatIntelligence.Submission.id description: The ID of the submission. type: String - contextPath: GoogleThreatIntelligence.Submission.hash description: The indicator sent to rescan. type: String description: Scans a specified URL. Use the gti-analysis-get command to get the scan results. - name: gti-comments-add arguments: - name: resource required: true description: The file hash (MD5, SHA1, orSHA256), Domain, URL or IP on which you're commenting on. If not supplied, will try to determine if it's a hash or a url. - name: resource_type description: The type of the resource on which you're commenting. auto: PREDEFINED predefined: - ip - url - domain - hash - name: comment required: true description: 'The actual review that you can tag by using the "#" twitter-like syntax, for example, #disinfection #zbot, and reference users using the "@" syntax, for example, @GoogleThreatIntelligenceTeam.' outputs: - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.date description: The date of the comment in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.text description: The text of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.positive description: Number of positive votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.abuse description: Number of abuse votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.negative description: Number of negative votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.html description: The HTML content. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.type description: The type of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.id description: ID of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.links.self description: Link to the request. type: String description: Adds comments to files and URLs. - name: gti-file-scan-upload-url outputs: - contextPath: GoogleThreatIntelligence.FileUploadURL description: The special upload URL for large files. description: Get a special URL for files larger than 32 MB. - name: gti-comments-delete arguments: - name: id required: true default: true description: Comment ID. description: Delete a comment. - name: gti-comments-get arguments: - name: resource required: true description: The file hash (MD5, SHA1, or SHA256), Domain, URL or IP on which you're commenting on. If not supplied, will try to determine if it's a hash or a url. - name: resource_type description: The type of the resource on which you're commenting. If not supplied, will determine if it's a url or a file. auto: PREDEFINED predefined: - ip - url - domain - file - hash - name: limit description: Maximum comments to fetch. defaultValue: 10 - name: before description: Fetch only comments before the given time. outputs: - contextPath: GoogleThreatIntelligence.Comments.id description: ID that contains the comment (the given hash, domain, url, or ip). type: String - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.date description: The date of the comment in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.text description: The text of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.positive description: Number of positive votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.abuse description: Number of abuse votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.negative description: Number of negative votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.html description: The HTML content. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.type description: The type of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.id description: ID of the commented. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.links.self description: Link to the request. type: String description: Retrieves comments for a given resource. - name: gti-assessment-get arguments: - name: resource required: true description: The file hash (MD5, SHA1, or SHA256), Domain, URL or IP. - name: resource_type description: The type of the resource. If not supplied, will determine it's a file. auto: PREDEFINED predefined: - ip - url - domain - file - hash outputs: - contextPath: GoogleThreatIntelligence.Assessment.id description: ID that contains the assessment (the given hash, domain, url, or ip). type: String - contextPath: GoogleThreatIntelligence.Assessment.attributes.gti_assessment.threat_score.value description: The threat score of the assessment. type: Number - contextPath: GoogleThreatIntelligence.Assessment.attributes.gti_assessment.severity.value description: The severity of the assessment. type: String - contextPath: GoogleThreatIntelligence.Assessment.attributes.gti_assessment.verdict.value description: The verdict of the assessment. type: String description: Retrieves GTI assessment for a given resource. - name: gti-comments-get-by-id arguments: - name: id required: true default: true description: The comment's ID. Can be retrieved using the gti-comments-get command. outputs: - contextPath: GoogleThreatIntelligence.Comments.comments.id description: ID of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.date description: The date of the comment in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.text description: The text of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.positive description: Number of positive votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.abuse description: Number of abuse votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.votes.negative description: Number of negative votes. type: Number - contextPath: GoogleThreatIntelligence.Comments.comments.attributes.html description: The HTML content. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.type description: The type of the comment. type: String - contextPath: GoogleThreatIntelligence.Comments.comments.links.self description: Link to the request. type: String description: Retrieves a comment by comment ID. - name: gti-search description: Search for an indicator in Google Threat Intelligence. arguments: - name: query required: true default: true description: 'This endpoint searches any of the following: A file hash, URL, domain, IP address, tag comments.' - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: limit description: Maximum number of results to fetch. defaultValue: 10 outputs: - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_analysis_stats.harmless description: Number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_analysis_stats.malicious description: Number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_analysis_stats.suspicious description: Number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_analysis_stats.undetected description: Number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_analysis_stats.timeout description: Number of engines that timed out. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.reputation description: The indicator's reputation. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.last_modification_date description: The last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.SearchResults.type description: The type of the indicator (ip, domain, url, file). type: String - contextPath: GoogleThreatIntelligence.SearchResults.id description: ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.SearchResults.links.self description: Link to the response. type: String - name: gti-file-sandbox-report arguments: - name: file required: true default: true description: Hash of the file to query. Supports MD5, SHA1, and SHA256. - name: limit description: Maximum number of results to fetch. defaultValue: 10 outputs: - contextPath: SandboxReport.attributes.analysis_date description: The date of the analysis in epoch format. type: Number - contextPath: SandboxReport.attributes.behash description: Behash of the attribute. type: String - contextPath: SandboxReport.attributes.command_executions description: Which command were executed. type: String - contextPath: SandboxReport.attributes.dns_lookups.hostname description: Host names found in the lookup. type: String - contextPath: SandboxReport.attributes.dns_lookups.resolved_ips description: The IPs that were resolved. type: String - contextPath: SandboxReport.attributes.files_attribute_changed description: The file attributes that were changed. type: String - contextPath: SandboxReport.attributes.has_html_report description: Whether there is an HTML report. type: Boolean - contextPath: SandboxReport.attributes.has_pcap description: Whether the IP has a PCAP file. type: Boolean - contextPath: SandboxReport.attributes.http_conversations.request_method description: The request method of the HTTP conversation. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Cache-Control description: The cache-control method of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Connection description: The connection of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Content-Length description: THe Content-Length of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Content-Type description: The Content-Type of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Pragma description: The pragma of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Server description: The server of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_headers.Status-Line description: The Status-Line of the response header. type: String - contextPath: SandboxReport.attributes.http_conversations.response_status_code description: The response status code. type: Number - contextPath: SandboxReport.attributes.http_conversations.url description: The conversation URL. type: String - contextPath: SandboxReport.attributes.last_modification_date description: Last modified data in epoch format. type: Number - contextPath: SandboxReport.attributes.modules_loaded description: Loaded modules. type: String - contextPath: SandboxReport.attributes.mutexes_created description: The mutexes that were created. type: String - contextPath: SandboxReport.attributes.mutexes_opened description: The mutexes that were opened. type: String - contextPath: SandboxReport.attributes.processes_created description: The processes that were created. type: String - contextPath: SandboxReport.attributes.processes_tree.name description: The name of the process tree. type: String - contextPath: SandboxReport.attributes.processes_tree.process_id description: The ID of the process. type: String - contextPath: SandboxReport.attributes.registry_keys_deleted description: Deleted registry keys. type: String - contextPath: SandboxReport.attributes.registry_keys_set.key description: Key of the registry key. type: String - contextPath: SandboxReport.attributes.registry_keys_set.value description: Value of the registry key. type: String - contextPath: SandboxReport.attributes.sandbox_name description: The name of the sandbox. type: String - contextPath: SandboxReport.attributes.services_started description: The services that were started. type: String - contextPath: SandboxReport.attributes.verdicts description: The verdicts. type: String - contextPath: SandboxReport.id description: The IP analyzed. type: String - contextPath: SandboxReport.links.self description: Link to the response. type: String - contextPath: SandboxReport.attributes.files_dropped.path description: Path of the file dropped. type: String - contextPath: SandboxReport.attributes.files_dropped.sha256 description: SHA-256 hash of the dropped files. type: String - contextPath: SandboxReport.attributes.files_opened description: The files that were opened. type: String - contextPath: SandboxReport.attributes.files_written description: The files that were written. type: String - contextPath: SandboxReport.attributes.ip_traffic.destination_ip description: Destination IP in the traffic. type: String - contextPath: SandboxReport.attributes.ip_traffic.destination_port description: Destination port in the traffic. type: Number - contextPath: SandboxReport.attributes.ip_traffic.transport_layer_protocol description: Transport layer protocol in the traffic. type: String - contextPath: SandboxReport.attributes.registry_keys_opened description: The registry keys that were opened. type: String - contextPath: SandboxReport.attributes.tags description: The tags of the DNS data. type: String - contextPath: SandboxReport.attributes.files_copied.destination description: Destination of the files copied. type: String - contextPath: SandboxReport.attributes.files_copied.source description: Source of the files copied. type: String - contextPath: SandboxReport.attributes.permissions_requested description: The permissions that where requested. type: String - contextPath: SandboxReport.attributes.processes_injected description: The processes that were injected. type: String - contextPath: SandboxReport.attributes.processes_terminated description: The processes that were terminated. type: String - contextPath: SandboxReport.attributes.processes_tree.children.name description: The name of the children of the process. type: String - contextPath: SandboxReport.attributes.processes_tree.children.process_id description: The ID of the children of the process. type: String - contextPath: SandboxReport.attributes.services_opened description: The services that were opened. type: String - contextPath: SandboxReport.attributes.text_highlighted description: The text that was highlighted. type: String - contextPath: SandboxReport.attributes.calls_highlighted description: The calls that were highlighted. type: String - contextPath: SandboxReport.attributes.processes_tree.children.time_offset description: The time offset of the children in the process. type: Number - contextPath: SandboxReport.links.self description: The link to the response. type: String - contextPath: SandboxReport.meta.count description: The number of objects that were found in the attributes. type: Number description: Retrieves a behavioral relationship of the given file hash. - name: gti-passive-dns-data description: Returns passive DNS records by indicator. arguments: - name: id default: true description: IP or domain for which to get its DNS data. - name: ip description: IP for which to get its DNS data. - name: domain description: Domain for which to get its DNS data. - name: limit description: Maximum number of results to fetch. defaultValue: 10 outputs: - contextPath: GoogleThreatIntelligence.PassiveDNS.attributes.date description: Date of the DNS analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.PassiveDNS.attributes.host_name description: The DNS host name. type: String - contextPath: GoogleThreatIntelligence.PassiveDNS.attributes.ip_address description: The DNS IP address. type: String - contextPath: GoogleThreatIntelligence.PassiveDNS.attributes.resolver description: The name of the resolver. type: String - contextPath: GoogleThreatIntelligence.PassiveDNS.id description: The ID of the resolution. type: String - contextPath: GoogleThreatIntelligence.PassiveDNS.links.self description: The link to the resolution. type: String - contextPath: GoogleThreatIntelligence.PassiveDNS.type description: The type of the resolution. type: String - name: gti-analysis-get description: Scan and get the analysis of a file submitted to GoogleThreatIntelligence. arguments: - name: id required: true default: true description: ID of the analysis (from file-scan, file-rescan, or url-scan). - name: extended_data description: Whether to return extended data (last_analysis_results). defaultValue: false outputs: - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.harmless description: Number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.malicious description: Number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.suspicious description: Number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.timeout description: he number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.undetected description: Number of engines the found the indicator to be undetected. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha256 description: SHA-256 hash of the file (if it is a file). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha1 description: SHA-1 hash of the file (if it is a file). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.md5 description: MD5 hash of the file (if it is a file). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.name description: Name of the file (if it is a file). - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.size description: Size of the file (if it is a file). type: Number - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.id description: ID of the url (if it is a URL). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.url description: The URL (if it is a URL). type: String - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-file-sigma-analysis description: Result of the last Sigma analysis in markdown format. arguments: - name: file default: true required: true description: File hash (md5, sha1, sha256). - name: only_stats description: Print only Sigma analysis summary stats. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.last_modification_date description: Date of the last update in epoch format. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.analysis_date description: Date of the last update in epoch format. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.match_context description: Matched strings from the log file. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_author description: Rule authors separated by commas. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_description description: Brief summary about what the rule detects. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_id description: Rule ID in GoogleThreatIntelligence's database. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_level description: Rule severity. Can be "low", "medium", "high" or "critical". type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_source description: Ruleset where the rule belongs. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.rule_matches.rule_title description: Rule title. type: String - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.severity_stats.critical description: Number of matched rules having a "critical" severity. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.severity_stats.high description: Number of matched rules having a "high" severity. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.severity_stats.low description: Number of matched rules having a "low" severity. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.severity_stats.medium description: Number of matched rules having a "medium" severity. type: Number - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.attributes.stats.source_severity_stats description: Same as severity_stats but grouping stats by ruleset. Keys are ruleset names as string and values are stats in a dictionary. type: unknown - contextPath: GoogleThreatIntelligence.SigmaAnalysis.data.id description: ID of the analysis. type: String - name: gti-privatescanning-file description: Checks the file reputation of the specified private hash. arguments: - name: file required: true default: true description: Hash of the file to query. Supports MD5, SHA1, and SHA256. isArray: true outputs: - contextPath: GoogleThreatIntelligence.File.attributes.type_description description: Description of the type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tlsh description: The locality-sensitive hashing. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEType description: MIME type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Names of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.javascript_info.tags description: Tags of the JavaScript. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileType description: The file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.WordCount description: Total number of words in the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.LineCount description: Total number of lines in file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEEncoding description: The MIME encoding. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileTypeExtension description: The file type extension. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.Newlines description: Number of newlines signs. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.info description: Number of IDS that marked the file as "info". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.high description: Number of IDS that marked the file as "high". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.medium description: Number of IDS that marked the file as "medium". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.low description: Number of IDS that marked the file as "low". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.trid.file_type description: The TrID file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.trid.probability description: The TrID probability. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.description description: Description of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.source description: Source of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.author description: Author of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_name description: Rule set name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.rule_name description: Name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_id description: ID of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_tag description: Tag of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_extension description: Extension of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tags description: File tags. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_date description: Last analysis date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.ssdeep description: SSDeep hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.magic description: Identification of file by the magic number. type: String - contextPath: GoogleThreatIntelligence.File.attributes.meaningful_name description: Meaningful name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.threat_severity.threat_severity_level description: Threat severity level of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.threat_severity.threat_severity_data.popular_threat_category description: Popular threat category of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.threat_verdict description: Threat verdict of the file. type: String - contextPath: GoogleThreatIntelligence.File.type description: Type of the file. type: String - contextPath: GoogleThreatIntelligence.File.id description: ID of the file. type: String - contextPath: GoogleThreatIntelligence.File.links.self description: Link to the response. type: String - name: gti-privatescanning-file-scan description: Submits a file for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results. arguments: - name: entryID required: true default: true description: The file entry ID to submit. isArray: true outputs: - contextPath: GoogleThreatIntelligence.Submission.type description: The type of the submission (analysis). type: String - contextPath: GoogleThreatIntelligence.Submission.id description: The ID of the submission. type: String - contextPath: GoogleThreatIntelligence.Submission.EntryID description: The entry ID of the file detonated. type: String - contextPath: GoogleThreatIntelligence.Submission.Extension description: File extension. type: String - contextPath: GoogleThreatIntelligence.Submission.Info description: File info. type: String - contextPath: GoogleThreatIntelligence.Submission.MD5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Name description: Name of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA1 description: SHA-1 of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA256 description: SHA-256 of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SHA512 description: SHA-512 of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.SSDeep description: SSDeep of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Size description: Size of the file. type: String - contextPath: GoogleThreatIntelligence.Submission.Type description: Type of the file. type: String - name: gti-privatescanning-url description: Checks the reputation of a private URL. arguments: - name: url required: true default: true description: Private URL to check. isArray: true outputs: - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.raw_md5 description: The MD5 hash of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.dhash description: Difference hash. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_length description: The last HTTPS response length. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.date description: The last response header date. type: Date - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.x-sinkhole description: DNS sinkhole from last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-length description: The content length of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-type description: The content type of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_sha256 description: The SHA-256 hash of the content of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_code description: Last response status code. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_final_url description: Last final URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.url description: The URL itself. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.title description: Title of the page. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.harmless description: The number of engines that found the domain to be harmless. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.outgoing_links description: Outgoing links of the URL page. type: String - contextPath: GoogleThreatIntelligence.URL.type description: Type of the indicator (private_url). type: String - contextPath: GoogleThreatIntelligence.URL.id description: ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.URL.links.self description: Link to the response. type: String - name: gti-privatescanning-url-scan description: Submits an URL for private scanning. Use the gti-privatescanning-analysis-get command to get the scan results. arguments: - name: url required: true default: true description: The private URL to scan. outputs: - contextPath: GoogleThreatIntelligence.Submission.Type description: The type of the submission (private_analysis). type: String - contextPath: GoogleThreatIntelligence.Submission.id description: The ID of the submission. type: String - name: gti-privatescanning-analysis-get description: Get analysis of a private file or URL submitted to GoogleThreatIntelligence. arguments: - name: id required: true default: true description: ID of the analysis. outputs: - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.sha256 description: SHA-256 hash of the private file. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.threat_severity_level description: Threat severity level of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.popular_threat_category description: Popular threat category of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.threat_verdict description: Threat verdict of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.url description: URL submitted. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.title description: Title of the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.last_http_response_content_sha256 description: Last HTTP response content SHA-256 hash of the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.positives description: Ratio of malicious detections to the total number of engines that scanned the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (private_analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.id description: ID of the URL. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.url description: URL submitted. type: String - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-file-scan-and-analysis-get description: Scan and get the analysis of a file submitted to GoogleThreatIntelligence. polling: true arguments: - name: entryID required: true default: true description: The file entry ID to submit. - name: uploadURL description: Special upload URL for files larger than 32 MB. Can be acquired from the gti-file-scan-upload-url command. - name: id description: This is an internal argument used for the polling process, not to be used by the user. - name: file description: This is an internal argument used for the polling process, not to be used by the user. - name: extended_data description: Whether to return extended data. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: interval_in_seconds description: Interval in seconds between each poll. defaultValue: '60' outputs: - contextPath: File.MD5 description: Bad MD5 hash. - contextPath: File.SHA1 description: Bad SHA1 hash. - contextPath: File.SHA256 description: Bad SHA256 hash. - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. - contextPath: File.Malicious.Detections description: For malicious files, the total number of detections. - contextPath: File.Malicious.TotalEngines description: For malicious files, the total number of engines that checked the file hash. - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_description description: Description of the type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tlsh description: The locality-sensitive hashing. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEType description: MIME type of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Names of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.javascript_info.tags description: Tags of the JavaScript. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileType description: The file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.WordCount description: Total number of words in the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.LineCount description: Total number of lines in file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.info description: Number of IDS that marked the file as "info". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.high description: Number of IDS that marked the file as "high". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.medium description: Number of IDS that marked the file as "medium". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_ids_stats.low description: Number of IDS that marked the file as "low". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.critical description: Number of Sigma analysis that marked the file as "critical". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.high description: Number of Sigma analysis that marked the file as "high". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.medium description: Number of Sigma analysis that marked the file as "medium". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.sigma_analysis_stats.low description: Number of Sigma analysis that marked the file as "low". type: Number - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.MIMEEncoding description: The MIME encoding. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.FileTypeExtension description: The file type extension. type: String - contextPath: GoogleThreatIntelligence.File.attributes.exiftool.Newlines description: Number of newlines signs. type: String - contextPath: GoogleThreatIntelligence.File.attributes.trid.file_type description: The TrID file type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.trid.probability description: The TrID probability. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.description description: Description of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.source description: Source of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.author description: Author of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_name description: Rule set name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.rule_name description: Name of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.crowdsourced_yara_results.ruleset_id description: ID of the YARA rule. type: String - contextPath: GoogleThreatIntelligence.File.attributes.names description: Name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_modification_date description: The last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.type_tag description: Tag of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.popular_threat_classification.suggested_threat_label description: Suggested thread label. type: String - contextPath: GoogleThreatIntelligence.File.attributes.popular_threat_classification.popular_threat_name description: The popular thread name. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.times_submitted description: Number of times the file was submitted. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_submission_date description: Last submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.downloadable description: Whether the file is downloadable. type: Boolean - contextPath: GoogleThreatIntelligence.File.attributes.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.type_extension description: Extension of the type. type: String - contextPath: GoogleThreatIntelligence.File.attributes.tags description: File tags. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_date description: Last analysis date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.unique_sources description: Unique sources. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.first_submission_date description: First submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.ssdeep description: SSDeep hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.magic description: Identification of file by the magic number. type: String - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.harmless description: The number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.type-unsupported description: The number of engines that found the indicator to be of type unsupported. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.confirmed-timeout description: The number of engines that confirmed the timeout of the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.failure description: The number of failed analysis engines. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.meaningful_name description: Meaningful name of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.reputation description: The reputation of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.threat_score.value description: GTI threat score of the file. type: Number - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.severity.value description: GTI severity of the file. type: String - contextPath: GoogleThreatIntelligence.File.attributes.gti_assessment.verdict.value description: GTI verdict of the file. type: String - contextPath: GoogleThreatIntelligence.File.type description: Type of the indicator (file). type: String - contextPath: GoogleThreatIntelligence.File.id description: Type ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.File.links.self description: Link to the response. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.harmless description: Number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.malicious description: Number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.suspicious description: Number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.timeout description: he number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.undetected description: Number of engines the found the indicator to be undetected. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.name description: Name of the file. - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-private-file-scan-and-analysis-get description: Scan and get the analysis of a private file submitted to GoogleThreatIntelligence. polling: true arguments: - name: entryID required: true default: true description: The file entry ID to submit. - name: id description: This is an internal argument used for the polling process, not to be used by the user. - name: extended_data description: Whether to return extended data. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: interval_in_seconds description: Interval in seconds between each poll. defaultValue: '60' outputs: - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.sha256 description: SHA-256 hash of the private file. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.threat_severity_level description: Threat severity level of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.popular_threat_category description: Popular threat category of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.threat_verdict description: Threat verdict of the private file (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (private_analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha256 description: SHA-256 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.sha1 description: SHA-1 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.md5 description: MD5 hash of the file. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.file_info.size description: Size of the file. type: Number - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-url-scan-and-analysis-get description: Scan and get the analysis of a URL submitted to GoogleThreatIntelligence. polling: true arguments: - name: url required: true default: true description: The URL to scan. - name: id description: This is an internal argument used for the polling process, not to be used by the user. - name: extended_data description: Whether to return extended data. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: interval_in_seconds description: Interval in seconds between each poll. defaultValue: '60' outputs: - contextPath: URL.Data description: Bad URLs found. - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: string - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: string - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.raw_md5 description: The MD5 hash of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.favicon.dhash description: Difference hash. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_modification_date description: Last modification date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.times_submitted description: The number of times the url has been submitted. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.total_votes.harmless description: Total number of harmless votes. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.total_votes.malicious description: Total number of malicious votes. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.threat_names description: Name of the threats found. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_submission_date description: The last submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_length description: The last HTTPS response length. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.date description: The last response header date. type: Date - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.x-sinkhole description: DNS sinkhole from last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-length description: The content length of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_headers.content-type description: The content type of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.reputation description: Reputation of the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_date description: The date of the last analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.has_content description: Whether the url has content in it. type: Boolean - contextPath: GoogleThreatIntelligence.URL.attributes.first_submission_date description: The first submission date in epoch format. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_content_sha256 description: The SHA-256 hash of the content of the last response. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_http_response_code description: Last response status code. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_final_url description: Last final URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.url description: The URL itself. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.title description: Title of the page. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.harmless description: The number of engines that found the domain to be harmless. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.malicious description: The number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.suspicious description: The number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.undetected description: The number of engines that could not detect the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.last_analysis_stats.timeout description: The number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.outgoing_links description: Outgoing links of the URL page. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.threat_score.value description: GTI threat score of the URL. type: Number - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.severity.value description: GTI severity of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.attributes.gti_assessment.verdict.value description: GTI verdict of the URL. type: String - contextPath: GoogleThreatIntelligence.URL.type description: Type of the indicator (url). type: String - contextPath: GoogleThreatIntelligence.URL.id description: ID of the indicator. type: String - contextPath: GoogleThreatIntelligence.URL.links.self description: Link to the response. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.harmless description: Number of engines that found the indicator to be harmless. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.malicious description: Number of engines that found the indicator to be malicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.suspicious description: Number of engines that found the indicator to be suspicious. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.timeout description: he number of engines that timed out for the indicator. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.stats.undetected description: Number of engines the found the indicator to be undetected. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.id description: ID of the URL. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.url description: The URL. type: String - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-private-url-scan-and-analysis-get description: Scan and get the analysis of a private URL submitted to GoogleThreatIntelligence. polling: true arguments: - name: url required: true default: true description: The URL to scan. - name: id description: This is an internal argument used for the polling process, not to be used by the user. - name: extended_data description: Whether to return extended data. defaultValue: false auto: PREDEFINED predefined: - 'true' - 'false' - name: interval_in_seconds description: Interval in seconds between each poll. defaultValue: '60' outputs: - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.date description: Date of the analysis in epoch format. type: Number - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.status description: Status of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.url description: URL submitted. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.title description: Title of the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.last_http_response_content_sha256 description: Last HTTP response content SHA-256 hash of the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.attributes.positives description: Ratio of malicious detections to the total number of engines that scanned the private URL (if analysis is completed). type: String - contextPath: GoogleThreatIntelligence.Analysis.data.id description: ID of the analysis. type: String - contextPath: GoogleThreatIntelligence.Analysis.data.type description: Type of object (private_analysis). type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.id description: ID of the URL. type: String - contextPath: GoogleThreatIntelligence.Analysis.meta.url_info.url description: URL submitted. type: String - contextPath: GoogleThreatIntelligence.Analysis.id description: The analysis ID. type: String - name: gti-curated-campaigns-get description: Retrieves GTI curated campaigns for a given resource. arguments: - name: resource required: true description: The file hash (MD5, SHA1, or SHA256), Domain, URL or IP. - name: resource_type description: The type of the resource. If not supplied, will determine it's a file. auto: PREDEFINED predefined: - ip - url - domain - file - hash outputs: - contextPath: GoogleThreatIntelligence.Collection.id description: ID that contains the assessment (the given hash, domain, url, or ip). type: String - contextPath: GoogleThreatIntelligence.Collection.collections.id description: ID of the curated campaign. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.name description: Name of the curated campaign. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.description description: Description of the curated campaign. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.last_modification_date description: Last modification date of the curated campaign. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_regions description: Targeted regions of the curated campaign. type: list - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_industries description: Targeted industries of the curated campaign. type: list - name: gti-curated-malware-families-get description: Retrieves GTI curated malware families for a given resource. arguments: - name: resource required: true description: The file hash (MD5, SHA1, or SHA256), Domain, URL or IP. - name: resource_type description: The type of the resource. If not supplied, will determine it's a file. auto: PREDEFINED predefined: - ip - url - domain - file - hash outputs: - contextPath: GoogleThreatIntelligence.Collection.id description: ID that contains the assessment (the given hash, domain, url, or ip). type: String - contextPath: GoogleThreatIntelligence.Collection.collections.id description: ID of the curated malware families. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.name description: Name of the curated malware families. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.description description: Description of the curated malware families. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.last_modification_date description: Last modification date of the curated malware families. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_regions description: Targeted regions of the curated malware families. type: list - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_industries description: Targeted industries of the curated malware families. type: list - name: gti-curated-threat-actors-get description: Retrieves GTI curated threat actors for a given resource. arguments: - name: resource required: true description: The file hash (MD5, SHA1, or SHA256), Domain, URL or IP. - name: resource_type description: The type of the resource. If not supplied, will determine it's a file. auto: PREDEFINED predefined: - ip - url - domain - file - hash outputs: - contextPath: GoogleThreatIntelligence.Collection.id description: ID that contains the assessment (the given hash, domain, url, or ip). type: String - contextPath: GoogleThreatIntelligence.Collection.collections.id description: ID of the curated threat actors. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.name description: Name of the curated threat actors. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.description description: Description of the curated threat actors. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.last_modification_date description: Last modification date of the curated threat actors. type: String - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_regions description: Targeted regions of the curated threat actors. type: list - contextPath: GoogleThreatIntelligence.Collection.collections.attributes.targeted_industries description: Targeted industries of the curated threat actors. type: list dockerimage: demisto/python3:3.12.13.10116658 tests: - GoogleThreatIntelligence-test