commonfields: id: PassiveTotal version: -1 name: PassiveTotal display: PassiveTotal (Deprecated) category: Data Enrichment & Threat Intelligence provider: Microsoft system: true description: Deprecated. Use the PassiveTotal v2 integration instead. configuration: - display: Server URL name: ServerURL defaultvalue: https://api.passivetotal.org/ type: 0 required: false - display: Username/API Key name: Username type: 0 required: true - display: API Secret name: APIKey type: 4 required: true - display: Use system proxy settings name: proxy type: 8 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Tags to signify this is a malicious domain name: tags defaultvalue: malware,blacklist,phishing,typo-squatting type: 0 required: true script: script: '' type: javascript commands: - name: pt-get-subdomains deprecated: true arguments: - name: query required: true description: The name of the domain to retrieve sub domains for outputs: - contextPath: subdomains description: List of subdomains as strings description: Get subdomains using a wildcard query. - name: pt-account deprecated: true arguments: [] outputs: - contextPath: passivetotal.username description: Username / Key used for PassiveTotal description: Retrieve account details from PassiveTotal - name: pt-monitors deprecated: true arguments: [] description: Get monitors associated with your account - name: pt-passive-dns deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: direction description: 'Pagination direction: next or previous' - name: page description: Page ID to request - name: sources description: Comma seperated list of sources to process with - name: start description: 'Only show data starting from date: YYYY-mm-dd' - name: end description: 'Only show data up to date: YYYY-mm-dd' - name: timeout description: Timeout to use on all source requests outputs: - contextPath: Domain.Name description: The name of the queries domain - contextPath: Domain.DNS.Address description: The resolved address of the domain description: Get passive DNS data - name: pt-passive-unique deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: direction description: 'Pagination direction: next or previous' - name: page description: Page ID to request - name: sources description: Comma seperated list of sources to process with - name: start description: 'Only show data starting from date: YYYY-mm-dd' - name: from description: 'Only show data up to date: YYYY-mm-dd' outputs: - contextPath: Domain.Name description: The name of the queries domain - contextPath: Domain.DNS.Address description: The resolved address of the domain description: Get unique resolutions from passive DNS data - name: pt-dns-keyword deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request description: Search DNS data for keywords - name: pt-enrichment deprecated: true arguments: - name: query required: true default: true description: The data to enrich outputs: - contextPath: IP.Address description: IP address - contextPath: IP.Geo.Country description: Country of IP address - contextPath: IP.Geo.Location description: Location of IP as latitude,longitude - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domains found during enrichment - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Enrich the given query with metadata - name: pt-malware deprecated: true arguments: - name: query required: true default: true description: The data to get malware for - name: samples description: The number of malware samples to return defaultValue: "10" - name: threshold description: Above this number of samples we will consider this to be malicious defaultValue: "10" outputs: - contextPath: IP.Address description: Bad IPs found during enrichment - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domains found during enrichment - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: File.MD5 description: Bad hash MD5 - contextPath: File.SHA1 description: Bad hash SHA1 - contextPath: File.SHA256 description: Bad hash SHA256 - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Get malware data - name: url deprecated: true arguments: - name: url required: true default: true description: The URL to check reputation for isArray: true - name: samples deprecated: true description: The number of malware samples to return defaultValue: "10" - name: threshold deprecated: true description: Above this number of samples we will consider this to be malicious defaultValue: "10" outputs: - contextPath: IP.Address description: IP address - contextPath: IP.Geo.Country description: Country of IP address - contextPath: IP.Geo.Location description: Location of IP as latitude,longitude - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: Domain.Name description: Bad domains found during enrichment - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Check URL reputation data - name: domain deprecated: true arguments: - name: domain required: true default: true description: The domain to get malware for isArray: true outputs: - contextPath: Domain.Name description: Bad domains found during enrichment - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Check domain reputation data - name: ip deprecated: true arguments: - name: ip required: true default: true description: The IP to check reputation for isArray: true outputs: - contextPath: IP.Address description: IP address - contextPath: IP.Geo.Country description: Country of IP address - contextPath: IP.Geo.Location description: Location of IP as latitude,longitude - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Check IP reputation - name: pt-osint deprecated: true arguments: - name: query required: true default: true description: The data to get OSINT for description: Get opensource intelligence data - name: pt-whois deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: compact_record description: Compress the WHOIS record into a deduplicated format - true or false defaultValue: "true" outputs: - contextPath: passivetotal.whois.email description: Contact email for the queried domain description: Get WHOIS data for a domain or IP address - name: pt-whois-keyword deprecated: true arguments: - name: query required: true default: true description: Keyword to search WHOIS database description: Search WHOIS details based on keywords - name: pt-whois-search deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: field required: true description: 'WHOIS field to execute the search on: domain, email, name, organization, address, phone, nameserver' description: Get WHOIS records based on field matching queries - name: pt-get-components deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request description: Get detailed information about a host - name: pt-get-pairs deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: direction required: true description: Relationship direction - parents, children. defaultValue: children description: Get host pairs based on dependent requests observed in web crawls - name: pt-ssl-cert deprecated: true arguments: - name: query required: true default: true description: The SHA1 to retrieve SSL certificate data for description: Get the SSL certificate associated with the SHA-1 - name: pt-ssl-cert-history deprecated: true arguments: - name: query required: true default: true description: The SHA1 or IP to retrieve SSL certificate data for description: Get the SSL certificate history associated with an IP address or SHA-1 - name: pt-ssl-cert-keyword deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request description: Search for SSL certificates based on a keyword - name: pt-ssl-cert-search deprecated: true arguments: - name: query required: true default: true description: Query value to use in your request - name: field required: true description: 'Field to search against: issuerSurname, subjectOrganizationName, issuerCountry, issuerOrganizationUnitName, fingerprint, subjectOrganizationUnitName, serialNumber, subjectEmailAddress, subjectCountry, issuerGivenName, subjectCommonName, issuerCommonName, issuerStateOrProvinceName, issuerProvince, subjectStateOrProvinceName, sha1, sslVersion, subjectStreetAddress, subjectSerialNumber, issuerOrganizationName, subjectSurname, subjectLocalityName, issuerStreetAddress, issuerLocalityName, subjectGivenName, subjectProvince, issuerSerialNumber, issuerEmailAddress' description: Search for SSL certificates based on field values tests: - no test fromversion: 5.0.0 deprecated: true