commonfields: id: SlashNext Phishing Incident Response version: -1 name: SlashNext Phishing Incident Response display: SlashNext Phishing Incident Response (Deprecated) category: Data Enrichment & Threat Intelligence provider: Varonis deprecated: true description: "SlashNext Phishing Incident Response integration allows Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services." configuration: - display: SlashNext API Base URL name: apiurl defaultvalue: https://oti.slashnext.cloud/api type: 0 required: true - display: SlashNext API Key name: apikey defaultvalue: "" type: 4 required: true - display: Trust any certificate (not secure) name: unsecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false script: dockerimage: demisto/python3:3.12.8.3296088 type: python subtype: python3 script: '-' commands: - name: ip arguments: - name: ip required: true description: IPv4 address to look up in the SlashNext Threat Intelligence database. default: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Address description: The IP address. type: string - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: string - contextPath: IP.Malicious.Description description: For malicious IP addresses, the reason that the vendor made the decision. type: string - contextPath: SlashNext.IP.Value description: Value of the IoC. type: string - contextPath: SlashNext.IP.Type description: Type of the IoC. type: string - contextPath: SlashNext.IP.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.IP.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.IP.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.IP.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.IP.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.IP.LastSeen description: Time when the IoC was last observed. type: date description: Looks up an IP address indicator in the SlashNext Threat Intelligence database. - name: domain arguments: - name: domain required: true description: The FQDN to look up in the SlashNext Threat Intelligence database. outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: Domain.Name description: Domain name. type: string - contextPath: Domain.Malicious.Vendor description: For malicious domain names, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domain names, the reason that the vendor made the decision. type: string - contextPath: SlashNext.Domain.Value description: Value of the IoC. type: string - contextPath: SlashNext.Domain.Type description: Type of the IoC. type: string - contextPath: SlashNext.Domain.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.Domain.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.Domain.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.Domain.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.Domain.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.Domain.LastSeen description: Time when the IoC was last observed. type: date description: Looks up a Fully Qualified Domain Name (FQDN) indicator in the SlashNext Threat Intelligence database. - name: url arguments: - name: url required: true description: The url to look up in the SlashNext Threat Intelligence database. outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to the same domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Queries the SlashNext Cloud database and retrieves the reputation of a url. - name: slashnext-host-reputation arguments: - name: host required: true description: The host to look up in the SlashNext Threat Intelligence database. Can be either a domain name or an IPv4 address. outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Address description: IP address. type: string - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: string - contextPath: IP.Malicious.Description description: For malicious IP addresses, the reason that the vendor made the decision. type: string - contextPath: SlashNext.IP.Value description: Value of the IoC. type: string - contextPath: SlashNext.IP.Type description: Type of the IoC. type: string - contextPath: SlashNext.IP.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.IP.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.IP.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.IP.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.IP.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.IP.LastSeen description: Time when the IoC was last observed. type: date - contextPath: Domain.Name description: Domain name. type: string - contextPath: Domain.Malicious.Vendor description: For malicious domain names, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domain names, the reason that the vendor made the decision. type: string - contextPath: SlashNext.Domain.Value description: Value of the IoC. type: string - contextPath: SlashNext.Domain.Type description: Type of IoC. type: string - contextPath: SlashNext.Domain.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.Domain.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.Domain.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.Domain.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.Domain.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.Domain.LastSeen description: Time when the IoC was last observed. type: date description: Queries the SlashNext Cloud database and retrieves the reputation of a host. - name: slashnext-host-report arguments: - name: host required: true description: The host to look up in the SlashNext Threat Intelligence database. Can be either a domain name or an IPv4 address. outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: IP.Address description: IP address. type: string - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: string - contextPath: IP.Malicious.Description description: For malicious IP addresses, the reason that the vendor made the decision. type: string - contextPath: SlashNext.IP.Value description: Value of the IoC. type: string - contextPath: SlashNext.IP.Type description: Type of the IoC. type: string - contextPath: SlashNext.IP.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.IP.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.IP.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.IP.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.IP.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.IP.LastSeen description: Time when the IoC was last observed. type: date - contextPath: Domain.Name description: Domain name. type: string - contextPath: Domain.Malicious.Vendor description: For malicious domain names, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domain names, the reason that the vendor made the decision. type: string - contextPath: SlashNext.Domain.Value description: Value of the IoC. type: string - contextPath: SlashNext.Domain.Type description: Type of the IoC. type: string - contextPath: SlashNext.Domain.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.Domain.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.Domain.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.Domain.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.Domain.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.Domain.LastSeen description: Time when the IoC was last observed. type: date description: Queries the SlashNext Cloud database and retrieves a detailed report for a host and associated URL. - name: slashnext-host-urls arguments: - name: host required: true description: The host to look up in the SlashNext Threat Intelligence database, for which to return a list of associated URLs. Can be either a domain name or an IPv4 address. - name: limit description: The maximum number of URL records to fetch. Default is "10". defaultValue: "10" outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.ScanID description: Scan ID to be used to get the IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to the same domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.ScanID description: Scan ID to be used to get the landing IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Queries the SlashNext Cloud database and retrieves a list of all URLs associated with the specified host. - name: slashnext-url-reputation arguments: - name: url required: true description: The url to look up in the SlashNext Threat Intelligence database. outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to the same domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Queries the SlashNext Cloud database and retrieves the reputation of a url. - name: slashnext-url-scan arguments: - name: url required: true description: The URL to scan. - name: extended_info description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false". defaultValue: "false" outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.ScanID description: Scan ID to be used to get the IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to the same domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.ScanID description: Scan ID to be used to get the landing IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Performs a real-time URL scan with SlashNext cloud-based SEER Engine. If the specified URL already exists in the cloud database, scan results will be returned immediately. If not, this command will submit a URL scan request and return with the message "check back later" and include a unique Scan ID. You can check the results of this scan using the "slashnext-scan-report" command anytime after 60 seconds using the returned Scan ID. - name: slashnext-url-scan-sync arguments: - name: url required: true description: The URL to scan. - name: timeout description: A timeout value in seconds. If the system is unable to complete a scan within the specified timeout, a timeout error will be returned. You can run the command again with a different timeout. If no timeout value is specified, a default timeout value is 60 seconds. defaultValue: "60" - name: extended_info description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false". defaultValue: "false" outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.ScanID description: Scan ID to be used to get the IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to the same domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.ScanID description: Scan ID to be used to get the landing IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Performs a real-time URL scan with SlashNext cloud-based SEER Engine in a blocking mode. If the specified URL already exists in the cloud database, scan result will be returned immediately. If not, this command will submit a URL scan request and wait for the scan to finish. The scan may take up to 60 seconds to finish. - name: slashnext-scan-report arguments: - name: scanid required: true description: Scan ID of the scan for which to get the report. Can be retrieved from the "slashnext-url-scan" command or "slashnext-url-scan-sync" command. - name: extended_info description: Whether to download forensics data, such as screenshot, HTML, and rendered text. If "true", forensics data will be returned. If "false" (or empty) forensics data will not be returned. Default is "false". defaultValue: "false" outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: Indicator type. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: URL.Data description: URL reported. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: string - contextPath: SlashNext.URL.Value description: Value of the IoC. type: string - contextPath: SlashNext.URL.Type description: Type of IoC. type: string - contextPath: SlashNext.URL.ScanID description: Scan ID to be used to get the IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Verdict description: SlashNext Phishing Incident Response verdict on the IoC. type: string - contextPath: SlashNext.URL.ThreatStatus description: Threat status of the IoC. type: string - contextPath: SlashNext.URL.ThreatName description: Name of the threat posed by the IoC. type: string - contextPath: SlashNext.URL.ThreatType description: Type of threat posed by the IoC. type: string - contextPath: SlashNext.URL.FirstSeen description: Time when the IoC was first observed. type: date - contextPath: SlashNext.URL.LastSeen description: Time when the IoC was last observed. type: date - contextPath: SlashNext.URL.Final.Value description: Final IoC value (in case original IoC is a redirector to same the domain). type: string - contextPath: SlashNext.URL.Final.Type description: Type of the final IoC. type: string - contextPath: SlashNext.URL.Final.Verdict description: SlashNext Phishing Incident Response verdict on the final IoC. type: string - contextPath: SlashNext.URL.Landing.Value description: Landing IoC value (in case original IoC is a redirector to a different domain). type: string - contextPath: SlashNext.URL.Landing.Type description: Type of landing IoC. type: string - contextPath: SlashNext.URL.Landing.ScanID description: Scan ID to be used to get the landing IoC forensics data for further investigation. type: string - contextPath: SlashNext.URL.Landing.Verdict description: SlashNext Phishing Incident Response verdict on the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatStatus description: Threat status of the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatName description: Name of the threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.ThreatType description: Type of threat posed by the landing IoC. type: string - contextPath: SlashNext.URL.Landing.FirstSeen description: Time when the landing IoC was first observed. type: date - contextPath: SlashNext.URL.Landing.LastSeen description: Time when the landing IoC was last observed. type: date description: Retrieves the results of a URL scan against a previous scan request. If the scan is finished, results will be returned immediately; otherwise the message "check back later" will be returned. - name: slashnext-download-screenshot arguments: - name: scanid required: true description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command. - name: resolution description: Resolution of the web page screenshot. Can be "high" or "medium". Default is "high". defaultValue: "high" description: Downloads a screenshot of a web page against a previous URL scan request. - name: slashnext-download-html arguments: - name: scanid required: true description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command. description: Downloads a web page HTML against a previous URL scan request. - name: slashnext-download-text arguments: - name: scanid required: true description: Scan ID. Can be retrieved from the "slashnext-url-scan" command or the "slashnext-url-scan-sync" command. description: Downloads the text of a web page against a previous URL scan request. - name: slashnext-api-quota arguments: [] outputs: - contextPath: SlashNext.Quota.LicensedQuota description: Licensed Quota. type: string - contextPath: SlashNext.Quota.RemainingQuota description: Remaining Quota. type: string - contextPath: SlashNext.Quota.ExpirationDate description: Quota Expiration Date. type: date - contextPath: SlashNext.Quota.IsExpired description: Quota Expiration Status. type: boolean description: Queries the SlashNext cloud database and retrieves the details of API quota. fromversion: 5.0.0 tests: - No tests (auto formatted)