commonfields: id: Threat Grid version: -1 name: Threat Grid display: Cisco Threat Grid (Deprecated) category: Forensics & Malware Analysis provider: Cisco Systems description: Deprecated. Use Cisco Secure Malware Analytics (Threat Grid) v2 instead. detaileddescription: |- 1. In your threat grid instance, click your user name at the right top corner. 2. Select my account. 3. Under the API Key section in the left you will see your API. --- [View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/threat-grid) configuration: - display: Server URL (e.g. https://192.168.0.1) name: server defaultvalue: https://panacea.threatgrid.com type: 0 required: true - display: API token name: token defaultvalue: "" type: 4 required: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: script: '' type: python subtype: python3 commands: - name: threat-grid-get-samples arguments: - name: limit description: The most results to be returned in the response - name: offset description: The number of records to skip - name: sha256 description: An SHA256 of the submitted sample, only matches samples, not their artifacts. - name: md5 description: An MD5 checksum of the submitted sample, only matches samples, not their artifacts. - name: sha1 description: A sha1 of the submitted sample, only matches samples, not their artifacts - name: id description: a sample ID - name: ids description: a comma-separated list of sample IDs - name: ioc description: an IOC name - name: before description: '"A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500"' - name: after description: '"A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500"' - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: If “true”, will only match against samples you submitted outputs: - contextPath: ThreatGrid.Sample.ID description: The sample id - contextPath: ThreatGrid.Sample.Filename description: The sample filename - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail" - contextPath: ThreatGrid.Sample.Status description: The sample status, one of a stable set of strings "succ, fail" - contextPath: ThreatGrid.Sample.MD5 description: The sample md5 - contextPath: ThreatGrid.Sample.SHA1 description: The sample sha1 - contextPath: ThreatGrid.Sample.SHA256 description: The sample sha256 - contextPath: ThreatGrid.Sample.OS description: The sample os - contextPath: ThreatGrid.Sample.SubmittedAt description: The sample submission time - contextPath: ThreatGrid.Sample.StartedAt description: The sample analysis starting time - contextPath: ThreatGrid.Sample.CompletedAt description: The sample completion time description: Search samples on the Threat Grid platform. Input parameters are ANDed together. Only finished samples can be searched (that is, the ones that are having a status of succ or fail.) deprecated: true - name: threat-grid-get-sample-by-id arguments: - name: id required: true default: true description: The sample ID outputs: - contextPath: ThreatGrid.Sample.ID description: The sample id - contextPath: ThreatGrid.Sample.Filename description: The sample filename - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail" - contextPath: ThreatGrid.Sample.Status description: The sample status, one of a stable set of strings "succ, fail" - contextPath: ThreatGrid.Sample.MD5 description: The sample md5 - contextPath: ThreatGrid.Sample.SHA1 description: The sample sha1 - contextPath: ThreatGrid.Sample.SHA256 description: The sample sha256 - contextPath: ThreatGrid.Sample.OS description: The sample os - contextPath: ThreatGrid.Sample.SubmittedAt description: The sample submission time - contextPath: ThreatGrid.Sample.StartedAt description: The sample analysis starting time - contextPath: ThreatGrid.Sample.CompletedAt description: The sample completion time description: Get threat grid sample by id deprecated: true - name: threat-grid-get-sample-state-by-id arguments: - name: id default: true description: The sample ID - name: ids description: A comma-separated list of sample IDs. outputs: - contextPath: ThreatGrid.Sample.ID description: The sample ID, globally unique, and the canonical identifier of this sample analysis - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings “wait, prep, run, proc, succ, fail” description: Get threat grid sample state by id deprecated: true - name: threat-grid-upload-sample arguments: - name: file-id required: true default: true description: The sample file. Click on the chain like icon after you upload a file in Demisto to find the file-id.  - name: filename required: true description: The original filename of the sample, as a string - name: vm auto: PREDEFINED predefined: - win7-x64 - win7-x64-2 - win7-x64-jp - win7-x64-kr - win10 description: 'a string identifying a specific VM to use. Options: win7-x64: Windows 7 64bit, win7-x64-2: Windows 7 64bit Profile 2, win7-x64-jp: Windows 7 64bit Japanese (Not available on Threat Grid appliances), win7-x64-kr: Windows 7 64bit Korean (Only available on Threat Grid appliances licensed for this VM), win10: Windows 10 (Not available on Threat Grid appliances). NOTE: The standard (English) VMs default to UTF-8 encoding. To support Korean and Japanese character sets, such as S-JIS, submit to the appropriate VM.' - name: private description: if present, and set to any value but “false” the sample will be marked private - name: tags description: A comma-separated list of tags applied to this sample - name: playbook auto: PREDEFINED predefined: - none - default - alt_tab_programs - open_word_embedded_object - press_enter - visit_site - close_file - run_dialog_box_ie - open_attachment_msg - run_dialog_box_dde description: 'Name of a playbook to apply to this sample run. none: Explicitly disables playbooks, default: Default Playbook, alt_tab_programs: Conduct Active Window Change, open_word_embedded_object: Open Embedded Object in Word Document, press_enter: Dialogue OK, visit_site: Visit Website Using Internet Explorer, close_file: Close Active Window, run_dialog_box_ie: Click Run on Internet Explorer Download Dialog Box, open_attachment_msg: Open Outlook Email Attachment, run_dialog_box_dde: Accept Microsoft Office Dialog Boxes to Open Dynamic Data Exchange Content. The current list of playbooks endpoints can be obtained by querying /api/v3/configuration/playbooks.' outputs: - contextPath: ThreatGrid.Sample.ID description: The sample id - contextPath: ThreatGrid.Sample.Filename description: The sample filename - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail" - contextPath: ThreatGrid.Sample.Status description: The sample status - contextPath: ThreatGrid.Sample.MD5 description: The sample md5 - contextPath: ThreatGrid.Sample.SHA1 description: The sample sha1 - contextPath: ThreatGrid.Sample.SHA256 description: The sample sha256 - contextPath: ThreatGrid.Sample.OS description: The sample os - contextPath: ThreatGrid.Sample.OSVer description: The sample ov version - contextPath: ThreatGrid.Sample.SubmittedAt description: The sample submission time description: Submits a sample to threat grid for analysis deprecated: true - name: threat-grid-search-submissions arguments: - name: q description: Query text. If you wish to work with an elasticsearch query please set 'advanced' argument to 'true' - name: user-only description: Only display submissions created by the current user, as determined by the value of api_key - name: org-only description: Only display submissions created by the current user's organization, as determined by the value of api_key. - name: term description: Restrict matches to a subset of submission fields. The value of 'term' is a comma-delimited list of strings which select groups of fields - name: before description: Return submissions created before specified time. Value is a timestring, either ISO-8601, or free-form (see documentation for 'chronic,' at https://github.com/mojombo/chronic) - name: after description: Return submissions created after specified time. Value is a timestring, either ISO-8601, or free-form (see documentation for 'chronic,' at https://github.com/mojombo/chronic). - name: state description: 'Restrict match to submissions in specific state or states. Value is a comma-delimited string containing one or more of the values: wait proc succ fail' - name: advanced description: 'When set to ''true'' interprets ''q'' as a Lucene query syntax, allowing matches by specific field, for instance: q=sha256:1b4468 will return items with sha256 equal to 1b4468. q=analysis.threat_score:64 will return analysis whose threat_score value is equal to 64. For reference see: https://lucene.apache.org/core/2_9_4/queryparsersyntax.html' - name: sort_by description: Sorts by timestamp, submitted_at, analyzed_at, filename, type, state, threat or threat_score, login - name: sort_order description: desc or asc - name: limit description: Restrict the number of records returned. - name: offset description: Return matching submissions starting at the given offset. - name: highlight description: Provide a 'matches' field in results, indicating which fields were matched outputs: - contextPath: ThreatGrid.Sample.ID description: The sample ID - contextPath: ThreatGrid.Sample.Filename description: The name of the sample file - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail" - contextPath: ThreatGrid.Sample.Status description: The status of the sample - contextPath: ThreatGrid.Sample.MD5 description: The MD5 id of the sample - contextPath: ThreatGrid.Sample.SHA1 description: The SHA1 id of the sample - contextPath: ThreatGrid.Sample.SHA256 description: The SHA256 id of the sample - contextPath: ThreatGrid.Sample.SubmittedAt description: Time of submission for the sample - contextPath: ThreatGrid.Sample.ThreatScore description: The threat score of the sample description: Search threat grid submissions deprecated: true - name: threat-grid-get-video-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.Id description: The sample Id type: string - contextPath: Demisto.File description: File containing result description: Get the sample analysis video by id deprecated: true - name: threat-grid-get-analysis-by-id arguments: - name: id required: true default: true description: The sample id - name: limit description: Limits the results to not overpopulate the context. Default value is. 20. If you wish to get results with no limit, set this value to "". defaultValue: "20" outputs: - contextPath: ThreatGrid.Sample.ID description: The ID of the sample for which the report was downloaded. - contextPath: Demisto.File description: File containing unfiltered result. - contextPath: ThreatGrid.Sample.VM.ID description: The VM ID for the sample. - contextPath: ThreatGrid.Sample.VM.Name description: The VM Name for the sample. - contextPath: ThreatGrid.Sample.StartedAt description: Start time of the analysis. - contextPath: ThreatGrid.Sample.Runtime description: Runtime of the analysis. - contextPath: ThreatGrid.Sample.FileName description: File name of the sample. - contextPath: ThreatGrid.Sample.Size description: Size of the sample. - contextPath: ThreatGrid.Sample.MD5 description: The sample MD5 value. - contextPath: ThreatGrid.Sample.SHA1 description: The sample's SHA1 value. - contextPath: ThreatGrid.Sample.SHA256 description: The sample's SHA256 value. - contextPath: ThreatGrid.Sample.MagicType description: Sample magic type. - contextPath: ThreatGrid.Sample.Type description: Sample's file type - contextPath: ThreatGrid.Sample.ThreatScore description: The threat score of the sample. - contextPath: ThreatGrid.Sample.HeuristicScore description: The sample's hueristic score. - contextPath: ThreatGrid.Sample.FilesDeleted description: The files that were created during the anaylsis. - contextPath: ThreatGrid.Sample.FileCreated description: The files that were created during the analysis. - contextPath: ThreatGrid.Sample.FilesModified description: The files that were modified during the analysis. - contextPath: ThreatGrid.Sample.Directory description: The directory of the sample. - contextPath: ThreatGrid.Sample.CMD description: The command line execution of the sample. - contextPath: ThreatGrid.Sample.ProcessName description: The process name of the sample. - contextPath: ThreatGrid.Sample.Destination description: The destination IP of the sample. - contextPath: ThreatGrid.Sample.DestinationPort description: The destination port of the sample. - contextPath: ThreatGrid.Sample.PacketSize description: Packet size in bytes. - contextPath: ThreatGrid.Sample.VT.Hits description: Sample malicious hits in virustotal. - contextPath: ThreatGrid.Sample.VT.Engines description: Number of engines that scanned the Sample on Virustotal. - contextPath: ThreatGrid.Artifact.Yara description: Artifact ID (yara signature name) - contextPath: ThreatGrid.Artifact.Tags description: Artifact tags. - contextPath: ThreatGrid.Artifact.FamilyName description: Artifact family name. - contextPath: ThreatGrid.Artifact.ThreatName description: Artifact threat name. description: The detailed overview of dynamic and static analysis results for the sample deprecated: true - name: threat-grid-get-processes-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.Id description: The ID of the sample for which the PCAP needs to be downloaded. type: string description: Get a JSON object which contains a timeline of all process activities as determined by the dynamic analysis engine. deprecated: true - name: threat-grid-get-pcap-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.Id description: The ID of the sample for which the PCAP needs to be downloaded. type: string - contextPath: Demisto.File description: File containing result description: Get the tcpdump PCAP file for a specific Sample ID, with all the network activity of the sample deprecated: true - name: threat-grid-get-warnings-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.Id description: The sample ID type: string - contextPath: Demisto.File description: File containing result description: Gets a JSON structure describing any warnings that occured during the analysis deprecated: true - name: threat-grid-get-summary-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.ID description: The sample ID. type: string - contextPath: ThreatGrid.Sample.AnalysisSummary.RegistryCount description: The registry count of the sample. type: number - contextPath: ThreatGrid.Sample.AnalysisSummary.FileName description: The Filename of the sample. type: string - contextPath: ThreatGrid.Sample.AnalysisSummary.SHA256 description: The SHA256 hash of the sample. type: string - contextPath: ThreatGrid.Sample.AnalysisSummary.SampleType description: The sample type. type: string - contextPath: ThreatGrid.Sample.AnalysisSummary.FirstSeen description: The timestamp when the sample was first seen. type: date - contextPath: ThreatGrid.Sample.AnalysisSummary.LastSeen description: The timestamp when the sample was last seen. type: date description: Returns summary analysis information deprecated: true - name: threat-grid-get-threat-summary-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.ID description: The sample id type: string - contextPath: ThreatGrid.Sample.MaxSeverity description: The sample max severity type: number - contextPath: ThreatGrid.Sample.Score description: The sample score type: number - contextPath: ThreatGrid.Sample.Count description: The sample count type: number - contextPath: ThreatGrid.Sample.MaxConfidence description: The sample max confidence type: number - contextPath: DBotScore.Indicator description: The indicator value type: string - contextPath: DBotScore.Score description: The indicator's score type: number - contextPath: DBotScore.Vendor description: The indicator's vendor type: string - contextPath: DBotScore.Type description: The indicator's type type: string - contextPath: ThreatGrid.Sample.ThreatFeeds description: The sample threat feeds description: Returns a summary of the threats detected during analysis deprecated: true - name: threat-grid-get-html-report-by-id arguments: - name: id required: true default: true description: The sample id outputs: - contextPath: ThreatGrid.Sample.Id description: The ID of the sample for which the report was downloaded. type: string - contextPath: Demisto.File description: File containing result description: Get the report.html file for a specific Sample ID. This is a stand-alone file with a complete report on the sample run. It is designed to be emailed or printed. deprecated: true - name: threat-grid-download-sample-by-id arguments: - name: id required: true default: true description: The ID of the sample to be downloaded. outputs: - contextPath: ThreatGrid.DownloadedSamples.Id description: The ID of the downloaded sample type: string - contextPath: Demisto.File description: File containing result description: Download a sample by using its ID. The downloaded file is an archive of the sample itself, in a zip format as a form of quarantine. deprecated: true - name: threat-grid-get-analysis-iocs arguments: - name: id required: true default: true description: The sample id - name: ioc description: The IOC name you want to fetch details for. - name: limit description: Limit the number of indicators you would like to see. The list is sorted by indicator severity in descending order.  outputs: - contextPath: ThreatGrid.IOCs.Title description: The title of the IOC - contextPath: ThreatGrid.IOCs.Confidence description: The confidence of the IOC - contextPath: ThreatGrid.IOCs.Severity description: The severity of the IOC - contextPath: ThreatGrid.IOCs.IOC description: Threat grid's IOC - contextPath: ThreatGrid.IOCs.IOCCategory description: The IOC category of the IOC - contextPath: DBotScore.Indicator description: The indicator value - contextPath: DBotScore.Vendor description: The indicator vendor - contextPath: DBotScore.Type description: The indicator type - contextPath: DBotScore.Score description: The indicator score - contextPath: ThreatGrid.IOCs.Data.IP description: The IP of the IOC - contextPath: ThreatGrid.IOCs.Data.URL description: The URL of the IOC - contextPath: ThreatGrid.IOCs.Data.Domain description: The domain of the IOC - contextPath: ThreatGrid.IOCs.Data.Path description: The path of the IOC - contextPath: ThreatGrid.IOCs.Data.SHA256 description: The SHA256 value of the IOC - contextPath: ThreatGrid.IOCs.Tags description: The tags of the IOC description: Returns a JSON list of the Indicators of Compromise identified in this sample run deprecated: true - name: threat-grid-download-artifact deprecated: true arguments: - name: aid required: true default: true description: The ID of the artifact (SHA 256) to be downloaded. Only SHA-256 type of ID can be used. outputs: - contextPath: ThreatGrid.Artifact.Id description: The ID of the downloaded artifact type: string description: Download an artifact by using its ID. - name: threat-grid-who-am-i arguments: [] outputs: - contextPath: ThreatGrid.User.Email description: The logged in user Email. - contextPath: ThreatGrid.User.Login description: The logged in user Login ID. - contextPath: ThreatGrid.User.Name description: The logged in user Name. - contextPath: ThreatGrid.User.OrganizationId description: The logged in user Organization ID. - contextPath: ThreatGrid.User.Role description: The logged in user Role description: Get logged in user deprecated: true - name: threat-grid-user-get-rate-limit arguments: - name: login required: true default: true description: User login name outputs: - contextPath: ThreatGrid.User.RateLimit.Minutes description: 'Array of array(s) representing submission(s) per minute(s) or the string"nil" to clear the value. Example: [[5, 1440]] which represents 5 samples per day. This field represent the minutes.' type: number - contextPath: ThreatGrid.User.RateLimit.Samples description: 'Array of array(s) representing submission(s) per minute(s) or the string"nil" to clear the value. Example: [[5, 1440]] which represents 5 samples per day. This field represent the number of samples allowed.' type: number - contextPath: ThreatGrid.User.RateLimit.SubmissionWaitSeconds description: The number of seconds to wait for a submission to get uploaded on the platform. type: number - contextPath: ThreatGrid.User.RateLimit.SubmissionsAvailable description: The number of submissions available for the specified username type: number description: Get rate limit for a specific user name. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by a user. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day. deprecated: true - name: threat-grid-get-specific-feed arguments: - name: feed-name required: true default: true description: The feed name. For a list of possible feed names and how to use them please see - https://panacea.threatgrid.com/doc/main/feeds.html - name: feed-period description: Feed daily date (YYYY-MM-DD). Alternatively, you may also write in free text (e.g. '2 days ago') - name: output-type description: The output type defaultValue: json outputs: - contextPath: Demisto.File description: File containing result description: Gets a specific threat feed deprecated: true - name: threat-grid-detonate-file deprecated: true arguments: - name: file-entry-id required: true default: true description: Entry ID of the uploaded file (e.g. the message in the war room with the uploaded file's details). - name: delay description: Time to wait between status checks (in seconds) defaultValue: "20" - name: timeout description: Total wait time (in seconds) defaultValue: "300" - name: report-file-type auto: PREDEFINED predefined: - html - json description: File type of report to return defaultValue: html outputs: - contextPath: ThreatGrid.Sample.ID description: The sample id type: string - contextPath: ThreatGrid.Sample.MaxSeverity description: The sample max severity type: number - contextPath: ThreatGrid.Sample.Score description: The sample score type: number - contextPath: ThreatGrid.Sample.Count description: The sample count type: number - contextPath: ThreatGrid.Sample.MaxConfidence description: The sample max confidence type: number - contextPath: DBotScore.Indicator description: The indicator value type: string - contextPath: DBotScore.Score description: The indicator's score type: number - contextPath: DBotScore.Vendor description: The indicator's vendor type: string - contextPath: DBotScore.Type description: The indicator's type type: string description: Detonates URL address through Threat Grid - name: threat-grid-url-to-file arguments: - name: urls required: true default: true description: Comma separated list of URLs to convert description: Convert a URL into a file for Threat Grid file detonation. deprecated: true - name: threat-grid-organization-get-rate-limit arguments: - name: adminLogin required: true default: true description: The admin user login name to be used for getting the rate limits. outputs: - contextPath: ThreatGrid.User.RateLimit.Minutes description: 'Array of array(s) representing submission(s) per minute(s) or the string"nil" to clear the value. Example: [[5, 1440]] which represents 5 samples per day. This field represent the minutes.' type: number - contextPath: ThreatGrid.User.RateLimit.Samples description: 'Array of array(s) representing submission(s) per minute(s) or the string"nil" to clear the value. Example: [[5, 1440]] which represents 5 samples per day. This field represent the number of samples allowed.' type: number - contextPath: ThreatGrid.User.RateLimit.SubmissionWaitSeconds description: The number of seconds to wait for a submission to get uploaded on the platform. type: number - contextPath: ThreatGrid.User.RateLimit.SubmissionsAvailable description: The number of submissions available for the entire organization. type: number description: Get rate limits applied to an organization. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by an entire organization and/or per a license basis. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day. deprecated: true - name: threat-grid-search-ips arguments: - name: network_dst description: search by destination IP - name: network_src description: search by source IP - name: artifact description: search by artifact SHA256 - name: domain description: search by domain name - name: url description: search by url - name: asn description: search by IP asn - name: geo_location description: search by IP geo location information - name: cidr description: search by IP/CIDR - name: ioc description: search by IOC name - name: tag description: search by tag name description: Search IPs. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time. deprecated: true - name: threat-grid-get-analysis-annotations arguments: - name: id description: The sample ID. outputs: - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP description: Ip address present in the annotation. - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.Asn description: Autonomous system number of the IP. - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.City description: City of the IP found. - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.Country description: Country of the IP found - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.Org description: Org of the IP found - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.Region description: Region of the IP found. - contextPath: ThreatGrid.AnalysisResults.Sample.Id.Annotations.IP.Timestamp description: Timestamp of the IP found description: Returns data regarding the annotations of the anlysis deprecated: true - name: threat-grid-search-samples arguments: - name: ioc description: search by IOC name - name: checksum description: search by checksum (sha256, md5 or sha1) - name: checksum_sample description: search by checksum of sample - name: path description: search by path name - name: path_sample description: search by sample path name - name: path_artifact description: search by artifact name - name: path_deleted description: search by path names that were deleted - name: url description: search by url - name: registry_key description: search by registry key accessed - name: domain description: search by domain name - name: domain_dns_lookup description: search by domain name used for DNS lookups - name: domain_http_request description: search by domain name used in HTTP request - name: ip description: search by ip address - name: ip_dns_lookup description: search by IP address returned in DNS lookup - name: ip_src description: search by network stream source IP address - name: ip_dst description: search by network stream destination IP address - name: tag description: search by sample tag outputs: - contextPath: ThreatGrid.Sample.ID description: Result ID - contextPath: ThreatGrid.Sample.Details description: Detail of sample description: Search Samples. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time. deprecated: true - name: threat-grid-search-urls arguments: - name: url description: search by URL pattern - name: sibling description: search by URL pattern prefix - name: neighbor description: search by hostname of URL - name: sha256 description: search by SHA56 of URL - name: md5 description: search by md5 of URL - name: sha1 description: search by sha1 of URL - name: protocol description: search by protocol name - name: host description: search by hostname - name: port description: search by post number - name: path description: search by path name - name: query description: search by query - name: reference description: search by fragment identifier - name: ip description: search by IP address of network stream - name: artifact description: search by artifact downloaded - name: tag description: search by url tag description: Search urls. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time. deprecated: true - name: threat-grid-get-samples-state arguments: - name: ids description: Comma separated list of sample ids outputs: - contextPath: ThreatGrid.Sample.ID description: The sample ID, globally unique, and the canonical identifier of this sample analysis - contextPath: ThreatGrid.Sample.State description: The state of the sample, one of a stable set of strings “wait, prep, run, proc, succ, fail” description: Get threat grid samples state deprecated: true - name: threat-grid-feeds-artifacts arguments: - name: sha256 description: Restrict returned records with this sha256 - name: sha1 description: Restrict returned records with this sha1 - name: md5 description: Restrict returned records with this md5 - name: path description: Restrict returned records to this path or path fragment. - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get artifacts threat feed deprecated: true - name: threat-grid-feeds-domain arguments: - name: domain description: Restrict returned records to this domain or hostname - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get domain threat feed deprecated: true - name: threat-grid-feeds-ip arguments: - name: ip description: Restrict returned records to this IP or CIDR block - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get ips threat feed deprecated: true - name: threat-grid-feeds-network-stream arguments: - name: ip description: Restrict returned records to this IP address - name: port description: Restrict returned records to this port number - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get network stream threat feed deprecated: true - name: threat-grid-feeds-path arguments: - name: path description: Restrict returned records to this path or path fragment - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get path threat feed deprecated: true - name: threat-grid-feeds-url arguments: - name: url description: Restrict returned records to this URL or URL fragment - name: before description: A date/time (ISO 8601), restricting results to samples submitted before it - name: after description: A date/time (ISO 8601), restricting results to samples submitted after it - name: confidence description: Restrict to IOCs with this confidence score or higher, defaults to 80 - name: severity description: Restrict to IOCs with this severity score or higher, defaults to 80 - name: ioc description: Restrict returned records to events of this type - name: org-only description: If “true”, will only match against samples submitted by your organization - name: user-only description: ' If “true”, will only match against samples you submitted' - name: sample description: A comma-separated list of sample IDs. Restrict results to these samples. outputs: - contextPath: Demisto.File description: File containing result description: Get url threat feed deprecated: true - name: threat-grid-get-analysis-artifact arguments: - name: id required: true default: true description: the sample id - name: aid required: true description: The artificat id requested description: Returns the sample id artifact with artifact id deprecated: true - name: threat-grid-get-analysis-artifacts arguments: - name: id required: true default: true description: the sample id outputs: - contextPath: ThreatGrid.Sample.Analysis description: Analysis datat of the sample description: Returns the sample id artifacts deprecated: true - name: threat-grid-get-analysis-ioc arguments: - name: id required: true default: true description: the sample id - name: ioc required: true description: the ioc requested outputs: - contextPath: ThreatGrid.IOCs.Title description: The title of the IOC - contextPath: ThreatGrid.IOCs.Confidence description: The confidence of the IOC - contextPath: ThreatGrid.IOCs.Severity description: The severity of the IOC - contextPath: ThreatGrid.IOCs.IOC description: Threat grid's IOC - contextPath: ThreatGrid.IOCs.IOCCategory description: The IOC category of the IOC - contextPath: DBotScore.Indicator description: The indicator value - contextPath: DBotScore.Vendor description: The indicator vendor - contextPath: DBotScore.Type description: The indicator type - contextPath: DBotScore.Score description: The indicator score - contextPath: ThreatGrid.IOCs.Data.IP description: The IP of the IOC - contextPath: ThreatGrid.IOCs.Data.URL description: The URL of the IOC - contextPath: ThreatGrid.IOCs.Data.Domain description: The domain of the IOC - contextPath: ThreatGrid.IOCs.Data.Path description: The path of the IOC - contextPath: ThreatGrid.IOCs.Data.SHA256 description: The SHA256 value of the IOC - contextPath: ThreatGrid.IOCs.Tags description: The tags of the IOC description: Returns data regarding the specified Indicator of Compromise deprecated: true - name: threat-grid-get-analysis-metadata arguments: - name: id required: true default: true description: the sample id description: Returns metadata about the analysis deprecated: true - name: threat-grid-get-analysis-network-stream arguments: - name: id required: true default: true description: the sample id - name: nsid required: true description: The network stream id description: Returns data regarding a specific network stream deprecated: true - name: threat-grid-get-analysis-network-streams arguments: - name: id required: true default: true description: the sample id description: Returns the network stream analysis deprecated: true - name: threat-grid-get-analysis-process arguments: - name: id required: true default: true description: the sample id - name: pid required: true description: the process id requested outputs: - contextPath: Demisto.File description: File containing result description: Returns data regarding the specifiic process id in the analysis deprecated: true - name: threat-grid-get-analysis-processes arguments: - name: id required: true default: true description: the sample id outputs: - contextPath: Demisto.File description: File containing result description: Returns data regarding the analysis processes deprecated: true - name: threat-grid-submit-urls arguments: - name: url required: true description: Url to be sumbitted outputs: - contextPath: ThreatGrid.URLs description: Results of URL Submission - contextPath: ThreatGrid.URLs.submission_id description: ID of submitted URL - contextPath: ThreatGrid.URLs.status description: Status of submitted URL - contextPath: ThreatGrid.URLs.filename description: Filename of submitted URL - contextPath: ThreatGrid.URLs.state description: State of submitted URL - contextPath: ThreatGrid.URLs.analyzing description: True/False if submitted URL is analyzing description: Submit urls for analysis. deprecated: true - name: threat-grid-advanced-search arguments: - name: query required: true description: 'Search query ' outputs: - contextPath: Threatgrid.SearchResult description: Result for the searched query description: Advanced search that allows searching URLS, Submissions, Samples etc... deprecated: true dockerimage: demisto/python3:3.10.9.42476 tests: - No tests (deprecated) fromversion: 5.0.0 deprecated: true