category: Data Enrichment & Threat Intelligence provider: Synapse Financial Technologies commonfields: id: Synapse version: -1 configuration: - display: Server URL (e.g. https://synapse.vertex.link) name: url required: true type: 0 - defaultvalue: '4443' display: REST API Port (default is 4443). name: port required: true type: 0 - display: Username and password to user to authenticate to Synapse. name: credentials required: true type: 9 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - additionalinfo: 'Optionally set display timezone for timestamps. Default is UTC. Ex: "US/Eastern"' display: Timezone (optional) name: timezone type: 0 required: false - additionalinfo: Tag that denotes indicator is malicious (i.e. "threat.mal" or "mal.foo.bar"). Depends on custom tag heirarchy. Use highest heirarchical tag that is considered malicious. display: Malicious Tag name: bad_tag type: 0 required: false - additionalinfo: Tag that denotes indicator is benign (i.e. "omit.benign" or "legit.beign"). Depends on custom tag heirarchy. Use highest heirarchical tag that is considered benign. display: Benign Tag name: good_tag type: 0 required: false - display: Use Synapse Optic name: use_optic type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false description: Synapse intelligence analysis platform. display: Synapse name: Synapse script: commands: - arguments: - default: true description: List of IPs. isArray: true name: ip required: true description: Returns IP information and reputation. name: ip outputs: - contextPath: Synapse.IP.ip description: The IP address of the indicator. type: String - contextPath: Synapse.IP.tags description: The tags applied to the IP address. type: String - contextPath: DBotScore.Indicator description: The value assigned by DBot for the indicator. type: String - contextPath: DBotScore.Type description: The type assigned by DBot for the indicator. type: String - contextPath: DBotScore.Score description: The score assigned by DBot for the indicator. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Score description: The actual score. type: String - contextPath: IP.Address description: The IP address of the indicator. type: string - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: string - contextPath: IP.Malicious.Description description: For malicious IP addresses, the full description. type: string - arguments: - default: true description: List of URLs. isArray: true name: url required: true description: Returns URL information and reputation. name: url outputs: - contextPath: Synapse.URL.url description: The data of the URL indicator. type: String - contextPath: Synapse.URL.tags description: The tags applied to the url. type: String - contextPath: DBotScore.Indicator description: The value assigned by DBot for the indicator. type: String - contextPath: DBotScore.Type description: The type assigned by DBot for the indicator. type: String - contextPath: DBotScore.Score description: The score assigned by DBot for the indicator. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Score description: The actual score. type: String - contextPath: URL.Data description: The data of the URL indicator. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the full description. type: string - arguments: - default: true description: List of Domains. isArray: true name: domain required: true description: Returns Domain information and reputation. name: domain outputs: - contextPath: Synapse.Domain.domain description: The fully qualified domain name. type: String - contextPath: Synapse.Domain.tags description: The tags applied to the domain. type: String - contextPath: DBotScore.Indicator description: The value assigned by DBot for the indicator. type: String - contextPath: DBotScore.Type description: The type assigned by DBot for the indicator. type: String - contextPath: DBotScore.Score description: The score assigned by DBot for the indicator. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Score description: The actual score. type: String - contextPath: Domain.Name description: The name of the domain. type: string - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domains, the full description. type: string - arguments: - default: true description: List of File Hashes (accepts MD5, SHA1, SHA256, SHA512). isArray: true name: file required: true description: Returns File information and reputation. name: file outputs: - contextPath: Synapse.File.hash description: The queried file hash. type: String - contextPath: Synapse.File.MD5 description: The MD5 hash of the file. type: String - contextPath: Synapse.File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: Synapse.File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: Synapse.File.SHA512 description: The SHA256 hash of the file. type: String - contextPath: Synapse.File.query description: The formatted query in storm syntax. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the full description. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - arguments: - default: true description: Synapse storm query (i.e. "inet:ipv4=1.2.3.4"). name: query required: true - defaultValue: '100' description: Limit the number of results returned. Default is 100. name: limit description: Execute a Synapse Storm query. name: synapse-storm-query outputs: - contextPath: Synapse.Nodes.created description: Timestamp when the node was first created in the Synapse Cortex. type: String - contextPath: Synapse.Nodes.form description: The type of node (i.e. "inet:ipv4" for an IP address). type: String - contextPath: Synapse.Nodes.tags description: The tags associated with the resulting node. type: String - contextPath: Synapse.Nodes.valu description: The node primary value (i.e. "1.2.3.4" for an IP). type: String - description: Lists current users in Synapse Cortex. name: synapse-list-users outputs: - contextPath: Synapse.Users.Admin description: True/False whether the Synapse user is an admin. type: Boolean - contextPath: Synapse.Users.Email description: The email address of the Synapse user. type: String - contextPath: Synapse.Users.Iden description: The unique identifier of the Synapse user. type: String - contextPath: Synapse.Users.Name description: The user's Synapse username. type: String - contextPath: Synapse.Users.Roles description: The roles applied to the Synapse user. type: String - contextPath: Synapse.Users.Rules description: The rules applied to the Synapse user. type: String - description: Lists current roles in Synapse Cortex. name: synapse-list-roles outputs: - contextPath: Synapse.Roles.Iden description: The unique identifier of the Synapse Role. type: String - contextPath: Synapse.Roles.Name description: The name of the Synapse Role. type: String - contextPath: Synapse.Roles.Rules description: The rules applied to the Synapse Role. type: String - arguments: - description: New username to be created. name: username required: true - description: Optionally set the new user's password. name: password description: Create a new Synapse user. name: synapse-create-user outputs: - contextPath: Synapse.Users.Admin description: True/False whether the Synapse user is an admin. type: Boolean - contextPath: Synapse.Users.Email description: The email address of the Synapse user. type: String - contextPath: Synapse.Users.Iden description: The unique identifier of the Synapse user. type: String - contextPath: Synapse.Users.Name description: The user's Synapse username. type: String - contextPath: Synapse.Users.Roles description: The roles applied to the Synapse user. type: String - contextPath: Synapse.Users.Rules description: The rules applied to the Synapse user. type: String - arguments: - description: New role to create in Synapse. name: role required: true description: Create a new Synapse role. name: synapse-create-role outputs: - contextPath: Synapse.Roles.Iden description: The unique identifier of the Synapse Role. type: String - contextPath: Synapse.Roles.Name description: The name of the Synapse Role. type: String - contextPath: Synapse.Roles.Rules description: The rules applied to the Synapse Role. type: String - arguments: - description: User's "iden" property - not the username. name: user required: true - description: Role's "iden" property - not the name of the role. name: role required: true description: Grants a user access to role based perrmissions. name: synapse-grant-user-role outputs: - contextPath: Synapse.Users.Admin description: True/False whether the Synapse user is an admin. type: Boolean - contextPath: Synapse.Users.Email description: The email address of the Synapse user. type: String - contextPath: Synapse.Users.Iden description: The unique identifier of the Synapse user. type: String - contextPath: Synapse.Users.Name description: The user's Synapse username. type: String - contextPath: Synapse.Users.Roles description: The roles applied to the Synapse user. type: String - contextPath: Synapse.Users.Rules description: The rules applied to the Synapse user. type: String - arguments: - description: Type/Form query (i.e. "inet:ipv4" or "inet"fqdn"). name: query required: true description: Query the Synapse data model and return details for given type or form (i.e. "inet:ipv4" for an IPv4 IP address). name: synapse-query-model outputs: - contextPath: Synapse.Model.Doc description: The docstring associated with the particular Synapse model element. type: String - contextPath: Synapse.Model.Example description: An example of the given Synapse element. type: String - contextPath: Synapse.Model.Form description: A form is the definition of an object in the Synapse data model (node). type: String - contextPath: Synapse.Model.Properties description: The unique properties associated with the given Synapse object. type: String - contextPath: Synapse.Model.Type description: A Type is the definition of a data element within the data model. type: String - contextPath: Synapse.Model.Valu description: The given value of the Synapse object type. type: String dockerimage: demisto/py3-tools:1.0.0.117220 runonce: false script: '-' subtype: python3 type: python fromversion: 5.0.0 tests: - No tests (auto formatted)