category: Data Enrichment & Threat Intelligence provider: PolySwarm sectionorder: - Connect commonfields: id: PolySwarmV2 version: -1 configuration: - display: PolySwarm API Key name: api_key required: true type: 4 section: Connect - display: The base URL to connect to name: base_url defaultvalue: https://api.polyswarm.network/v3/ required: true type: 0 section: Connect - display: PolySwarm v2 Community name: PolySwarm_v2 defaultvalue: default required: true type: 0 section: Connect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false section: Connect advanced: true - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false section: Connect advanced: true - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 additionalinfo: the segment of PolySwarm's marketplace to query on. required: false section: Connect advanced: true description: Real-time threat intelligence from a crowd-sourced network of security experts and antivirus companies. display: PolySwarm name: PolySwarmV2 script: commands: - arguments: - default: true description: UUID string (SHA256). name: scan_uuid required: true description: Returns a report using the UUID (SHA256). name: polyswarm-get-report outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID (SHA256). type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - arguments: - description: 'The value of the file hash for which to retrieve the reputation information. The hash type can be: "SHA256", "SHA1", or "MD5".' name: hash - default: true description: 'The type of the file hash for which to retrieve the reputation information. The hash type can be: "SHA256", "SHA1", or "MD5".' isArray: true name: file description: Queries PolySwarm for file reputation information. name: file outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: string - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - arguments: - default: true description: The IP address for which to retrieve the reputation information. isArray: true name: ip required: true description: Queries PolySwarm for IP reputation information. name: ip outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: IP.MalwareFamily description: The malware family associated with the IP. type: String - contextPath: IP.Tags description: Tags that are associated with the IP. type: String - arguments: - default: true description: The URL for which to retrieve the reputation information. name: url required: true description: Queries PolySwarm for URL reputation information. name: url outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: URL.Data description: The URL address. type: String - contextPath: URL.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: URL.MalwareFamily description: The malware family associated with the url. type: String - contextPath: URL.Tags description: Tags that are associated with the url. type: String - arguments: - default: true description: Domain for which to retrieve the reputation information. isArray: true name: domain required: true description: Queries PolySwarm to retrieve domain reputation information. name: domain outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: Domain.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: Domain.MalwareFamily description: The malware family associated with the domain. type: String - contextPath: Domain.Tags description: Tags that are associated with the domain. type: String - arguments: - default: true description: The URL to scan. isArray: true name: url required: true description: Uploads a URL to PolySwarm and retrieves the analysis results. name: url-scan outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - arguments: - description: 'The type of the file hash to rescan. The hash type can be: "SHA256", "SHA1", or "MD5".' name: hash required: true description: Rescans the uploaded artifact by hash. name: file-rescan outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String - arguments: - default: true description: 'The file hash type to download. The hash type can be: "SHA256", "SHA1", or "MD5".' name: hash required: true description: Downloads a file hash from PolySwarm. name: get-file outputs: - contextPath: File.Size description: The file size. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Name description: The sample name. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: The War Room entry ID of the file. type: String - contextPath: File.Info description: Basic information of the file. type: String - contextPath: File.Type description: File type. For example, "PE". type: String - contextPath: File MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The file extension. type: String - contextPath: PolySwarm.FileID description: The file ID. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: File.Tags.TagGroups.TagGroupName description: The tag's group name. type: String - contextPath: File.Tags.Aliases description: Aliases of the tags. type: String - contextPath: File.Tags.PublicTagName description: The public name of the tag. This is usually used as the ID of the tag. type: String - contextPath: File.Tags.TagName description: The simple name of the tag. type: String - arguments: - default: true description: The War Room entry ID of the file. name: entryID required: true description: Uploads a file to PolySwarm and retrieves the analysis results. name: file-scan outputs: - contextPath: PolySwarm.Total description: The total number of scans. type: Number - contextPath: PolySwarm.Permalink description: PolySwarm permalink results. type: String - contextPath: PolySwarm.Positives description: The total number of positives found. type: Number - contextPath: PolySwarm.Scan_UUID description: The PolySwarm scan UUID. type: String - contextPath: PolySwarm.Artifact description: The artifact queried. type: String runonce: false script: '-' subtype: python3 type: python dockerimage: demisto/polyswarm:1.0.0.6911470 fromversion: 5.0.0 tests: - No tests (auto formatted)