name: RelayShield display: RelayShield category: Data Enrichment & Threat Intelligence provider: RelayShield commonfields: id: RelayShield version: -1 sectionorder: - Connect - Collect configuration: - display: Server URL name: url defaultvalue: https://api.relayshield.net type: 0 required: true section: Connect - display: API Key name: credentials type: 9 displaypassword: API Key required: true section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true - display: Source Reliability name: integrationReliability defaultvalue: B - Usually reliable type: 15 required: false additionalinfo: Reliability of the source providing the intelligence data. options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Collect description: |- RelayShield real-time identity-compromise and agent-security threat intelligence. Implements the generic `domain`/`ip`/`email` reputation commands (auto-invoked by existing enrichment playbooks) plus RelayShield-specific commands for MCP server registry risk, certificate expiry, and supply-chain vendor risk. "No known finding" from any command means nothing was flagged in the sources RelayShield actually queried. It is deliberately never mapped to a "Good" DBotScore, since that would claim more certainty than the data supports. See the README's DBotScore section for the exact mapping. script: commands: - name: domain description: Check a domain for phishing-lookalike/typosquat risk, presence in RelayShield's criminal IOC corpus, and set a DBotScore. arguments: - name: domain default: true required: true isArray: true description: A comma-separated list of domains to check. outputs: - contextPath: RelayShield.Domain.queried description: The domain queried. type: String - contextPath: RelayShield.Domain.verdict description: The RelayShield verdict (CRITICAL/HIGH/MEDIUM/LOW), absent if no known finding. type: String - contextPath: RelayShield.Domain.findings description: The list of findings, if any. type: Unknown - contextPath: Domain.Name description: The domain name. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: The reliability of the source providing the intelligence data. type: String - name: ip description: Check an IP address for reputation, malicious/suspicious votes, and set a DBotScore. arguments: - name: ip default: true required: true isArray: true description: A comma-separated list of IP addresses to check. outputs: - contextPath: RelayShield.IP.queried description: The IP address queried. type: String - contextPath: RelayShield.IP.reputation description: The community reputation score. type: Number - contextPath: RelayShield.IP.malicious_votes description: The malicious vote count. type: Number - contextPath: IP.Address description: The IP address. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: The reliability of the source providing the intelligence data. type: String - name: email description: Check an email address for breach exposure and active stolen-session risk, and set a DBotScore. arguments: - name: email default: true required: true isArray: true description: A comma-separated list of email addresses to check. outputs: - contextPath: RelayShield.Email.queried description: The email address queried. type: String - contextPath: RelayShield.Email.breach_found description: Whether the email address appears in a known breach. type: Boolean - contextPath: RelayShield.Email.breach_sources description: The list of breach sources the email address was found in. type: Unknown - contextPath: RelayShield.Email.session_risk_found description: Whether an active stolen session was found. type: Boolean - contextPath: RelayShield.Email.sessions description: The list of stolen sessions found, if any. type: Unknown - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: The reliability of the source providing the intelligence data. type: String - name: relayshield-mcp-registry-risk description: Assess an MCP server URL or package name for typosquat/supply-chain/registry risk before an agent connects to it. arguments: - name: server_url description: The full URL of the MCP server to check. Provide this or package_name. - name: package_name description: The package name of the MCP server if no server_url is available. outputs: - contextPath: RelayShield.MCPRegistryRisk.queried description: The server URL or package name queried. type: String - contextPath: RelayShield.MCPRegistryRisk.verdict description: The RelayShield verdict, absent if no known finding. type: String - contextPath: RelayShield.MCPRegistryRisk.findings description: The list of findings, if any. type: Unknown - name: relayshield-cert-expiry description: Check a domain's TLS certificate expiry risk. arguments: - name: domain required: true description: The domain to check. outputs: - contextPath: RelayShield.CertExpiry.domain description: The domain checked. type: String - contextPath: RelayShield.CertExpiry.days_remaining description: The days until certificate expiry. type: Number - contextPath: RelayShield.CertExpiry.risk_level description: The risk level (CRITICAL/HIGH/MEDIUM/LOW). type: String compliantpolicies: - User Soft Remediation - name: relayshield-supply-chain description: Check up to 10 vendor domains (or emails) for combined breach/infostealer risk. arguments: - name: vendor_domains isArray: true description: A comma-separated list of up to 10 vendor domains to check. Provide this or vendor_emails. - name: vendor_emails isArray: true description: A comma-separated list of vendor email addresses. The domain portion is extracted automatically. outputs: - contextPath: RelayShield.SupplyChain.domains_checked description: The number of vendor domains checked. type: Number - contextPath: RelayShield.SupplyChain.highest_risk description: The highest risk level found across all vendors checked. type: String - contextPath: RelayShield.SupplyChain.critical_vendors description: The list of vendors flagged as critical risk. type: Unknown dockerimage: demisto/python3:3.12.14.12343672 runonce: false script: '-' subtype: python3 type: python fromversion: 6.8.0 tests: - No tests