category: Data Enrichment & Threat Intelligence
provider: Audax Private Equity
sectionorder:
- Connect
- Collect
commonfields:
  id: TeamCymru
  version: -1
configuration:
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: Proxy URL
  additionalinfo: "Supports socks4/socks5/http connect proxies (e.g., socks5h://host:1080)."
  name: proxy_url
  type: 0
  section: Connect
  advanced: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integration_reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  section: Collect
  required: false
description: Team Cymru provides various service options dedicated to mapping IP numbers to BGP prefixes and ASNs. Each of the services is based on the same BGP feeds from 50+ BGP peers and is updated at 4-hour intervals.
display: 'Team Cymru'
name: TeamCymru
script:
  commands:
  - arguments:
    - default: true
      description: An IPv4 address to query, e.g., 1.1.1.1.
      name: ip
      required: true
      isArray: true
    description: Checks the reputation of an IP address.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Registrar.Abuse.Network
      description: The network of the contact for reporting abuse.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: TeamCymru.IP.Address
      description: The IP address.
      type: String
    - contextPath: TeamCymru.IP.ASN
      description: The IP ASN.
      type: String
    - contextPath: TeamCymru.IP.ASOwner
      description: The IP AS owner.
      type: String
    - contextPath: TeamCymru.IP.Geo.Country
      description: The IP country.
      type: String
    - contextPath: TeamCymru.IP.Registrar.Abuse.Network
      description: The IP range relevant for abuse inquiries provided for the IP.
      type: String
  - arguments:
    - description: The file's War Room entry ID.
      name: entry_id
      required: true
    - defaultValue: ','
      description: |-
        Delimiter by which the content of the file is separated.
        Eg:  " , " , " : ", " ; ".
      name: delimiter
    description: |-
      Checks the reputation of a CSV list of IPv4 addresses within a file. 
      Note: Results for queries exceeding 10,000 IPs may take more than a minute given a moderately sized Internet link.
    name: cymru-bulk-whois
    outputs:
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948".'
      type: String
    - contextPath: IP.ASOwner
      description: The autonomous system owner of the IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Registrar.Abuse.Network
      description: The network of the contact for reporting abuse.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: TeamCymru.IP.Address
      description: The IP address.
      type: String
    - contextPath: TeamCymru.IP.ASN
      description: The IP ASN.
      type: String
    - contextPath: TeamCymru.IP.ASOwner
      description: The IP AS owner.
      type: String
    - contextPath: TeamCymru.IP.Geo.Country
      description: The IP country.
      type: String
    - contextPath: TeamCymru.IP.Registrar.Abuse.Network
      description: The IP range relevant for abuse inquiries provided for the IP.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
fromversion: 6.5.0
tests:
- TeamCymruTest