commonfields: id: iDefense version: -1 deprecated: true name: iDefense display: iDefense (Deprecated) category: Data Enrichment & Threat Intelligence provider: Accenture description: Deprecated. Use the iDefense v2 integration instead. configuration: - display: URL name: url defaultvalue: https://api.intelgraph.idefense.com/ type: 0 required: true - display: API Token name: api_token defaultvalue: "" type: 4 required: true - display: Trust any certificate (not secure) name: insecure defaultvalue: "" type: 8 required: false - display: Use system proxy settings name: useproxy defaultvalue: "" type: 8 required: false script: script: '' type: javascript commands: - name: ip arguments: - name: ip required: true default: true description: IP to check outputs: - contextPath: IP.Address description: Bad IP Address found - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check IP reputation - name: domain arguments: - name: domain required: true default: true description: Domain to check outputs: - contextPath: Domain.Name description: Bad domain found - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check domain reputation - name: url arguments: - name: url required: true default: true description: The URL to check (must start with "http://"). outputs: - contextPath: URL.Data description: Bad URLs found - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check URL reputation - name: idefense-general arguments: - name: max_result default: true description: Maximum amount of results defaultValue: "300" outputs: - contextPath: IP.Address description: Bad IP Address found - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domain found - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: URL.Data description: Bad URLs found - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Get threats from iDefense database. Returns all records of ip/url/domain - name: uuid arguments: - name: uuid required: true default: true description: Unique User ID outputs: - contextPath: IP.Address description: Bad IP Address found - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domain found - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: URL.Data description: Bad URLs found - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Get specific indicator reputation fromversion: 5.0.0