category: Network Security provider: Gatewatcher commonfields: id: LastInfoSec version: -1 configuration: - additionalinfo: The API Key to use for connection display: LastInfoSec API token name: token required: true type: 4 - display: Check the TLS certificate name: check_cert type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - name: integrationReliability display: Integration Reliability additionalinfo: Reliability of the source providing the intelligence data required: false type: 15 options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged description: This integration allow to interact with the Gatewatcher LastInfoSec product via API. display: LastInfoSec name: LastInfoSec script: commands: - arguments: - default: true description: |2- Number of minutes to get. Max 1440 minutes. name: Minute required: true - auto: PREDEFINED description: Filter IoC by categories. isArray: true name: Categories predefined: - phishing - malware - trojan - exploit - ransom - ransomware - tool - keylogger - agent - backdoor - auto: PREDEFINED description: Filter IoC by type. isArray: true name: Type predefined: - SHA1 - SHA256 - MD5 - URL - Host - auto: PREDEFINED description: Filter IoC by mode. name: Mode predefined: - detection - hunting - auto: PREDEFINED description: Filter IoC by risk. isArray: true name: Risk predefined: - Malicious - Suspicious - High suspicious - auto: PREDEFINED description: Filter IoC by TLP. isArray: true name: TLP predefined: - green - white description: |- Retrieve the data from Gatewatcher CTI feed by minute. Max 1440 minutes. name: gw-lis-get-by-minute outputs: - contextPath: LIS.GetByMinute.Value description: Value. type: String - arguments: - default: true description: Value to be search. name: Value required: true description: Allows you to search for an IOC (url, hash, host) or a vulnerability in the Gatewatcher CTI database. If the data is known, only the IOC corresponding to the value will be returned. name: gw-lis-get-by-value outputs: - contextPath: LIS.GetByValue.Categories description: Categories. type: String - contextPath: LIS.GetByValue.Risk description: Risk. type: String - contextPath: LIS.GetByValue.TLP description: TLP. type: String - contextPath: LIS.GetByValue.Type description: Type. type: String - contextPath: LIS.GetByValue.UsageMode description: UsageMode. type: String - contextPath: LIS.GetByValue.Value description: Value. type: String - contextPath: LIS.GetByValue.Vulnerabilities description: Vulnerabilities. type: String - name: gw-lis-leaked-email-by-domain description: Allows you to search for leaked emails via a domain in Gatewatcher's CTI database. If the data is found, a list of emails is returned. otherwise, nothing is returned. arguments: - name: Domain description: domain to be searched. required: true - name: After description: "Only return emails that have leaked after this date (date format: 2023-01-15T10:00:00)." required: false outputs: - contextPath: LIS.LeakedEmail.GetByDomain description: leaked emails. type: String - name: gw-lis-is-email-leaked description: Allows you to search if a specific email was leaked in Gatewatcher's CTI database. If the data is found, the email is returned. otherwise, nothing is returned. arguments: - name: Email description: email to be searched. required: true - name: After description: "Only return a value if the email has leaked after this date (date format: 2023-01-15T10:00:00)." required: false outputs: - contextPath: LIS.LeakedEmail.GetByEmail description: leaked email. type: String - name: url description: search IOCs for URLs in Gatewatcher's CTI database. arguments: - name: url description: list of URLs to search for, (comma separated values). required: true isArray: true default: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: URL.Description description: Description of the URL. type: String - contextPath: URL.TrafficLightProtocol description: TLP level. type: String - contextPath: LIS.URL.Categories description: Categories matching this url. type: String - contextPath: LIS.URL.Risk description: Risk associated to this URL. type: String - contextPath: LIS.URL.TLP description: TLP level. type: String - contextPath: LIS.URL.UsageMode description: Usage mode for LIS. type: String - contextPath: LIS.URL.Value description: The URL. type: String - contextPath: LIS.URL.Vulnerabilities description: Vulnerabilities associated to this URL. type: String - name: file description: search IOCs for file hashes in Gatewatcher's CTI database. arguments: - name: file description: list of files to search for, (comma separated values). required: true isArray: true outputs: - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: File.Hashes description: List of hashes for this file. type: String - contextPath: File.Imphash description: Imphash of the file. type: String - contextPath: File.SSDeep description: SSDeep of the file. type: String - contextPath: File.TrafficLightProtocol description: TLP level. type: String - contextPath: File.Type description: Type of file. type: String - contextPath: File.MD5 description: MD5 of the file. type: String - contextPath: File.SHA1 description: SHA1 of the file. type: String - contextPath: File.SHA256 description: SHA256 of the file. type: String - contextPath: File.SHA512 description: SHA512 of the file. type: String - contextPath: LIS.File.Categories description: Categories matching this file. type: String - contextPath: LIS.File.Risk description: Risk associated to this file. type: String - contextPath: LIS.File.TLP description: TLP level. type: String - contextPath: LIS.File.UsageMode description: Usage mode for LIS. type: String - contextPath: LIS.File.Value description: Hash of the file. type: String - contextPath: LIS.File.Vulnerabilities description: Vulnerabilities associated to this file. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - name: domain description: search IOCs for domains in Gatewatcher's CTI database. arguments: - name: domain description: list of domains to search for, (comma separated values). required: true isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Domain.Name description: Domain found. type: String - contextPath: Domain.Description description: description of the domain. type: String - contextPath: Domain.TrafficLightProtocol description: TLP level. type: String - contextPath: LIS.Domain.Categories description: Categories matching this domain. type: String - contextPath: LIS.Domain.Risk description: Risk associated to this domain. type: String - contextPath: LIS.Domain.TLP description: TLP level. type: String - contextPath: LIS.Domain.Type description: Type of domain. type: String - contextPath: LIS.Domain.UsageMode description: Usage mode for LIS. type: String - contextPath: LIS.Domain.Value description: The domain name. type: String - contextPath: LIS.Domain.Vulnerabilities description: Vulnerabilities associated to this domain. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python feed: false isfetch: false longRunning: false longRunningPort: false tests: - No tests (auto formatted) fromversion: 5.5.0