commonfields: id: ThreatGridv2 version: -1 name: ThreatGridv2 sectionorder: - Connect - Collect display: Cisco Secure Malware Analytics (Threat Grid) v2 category: Forensics & Malware Analysis provider: Cisco Systems description: Query and upload samples to Cisco threat grid. configuration: - display: Server URL (e.g. https://192.168.0.1) name: base_url defaultvalue: https://panacea.threatgrid.com type: 0 required: true section: Connect - displaypassword: API token name: credentials type: 9 required: true hiddenusername: true display: '' section: Connect - display: Source Reliability name: integrationReliability type: 15 required: true additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect script: script: '' type: python subtype: python3 commands: - name: threat-grid-sample-list arguments: - name: sample_id description: The sample ID. - name: user_only description: It 'True' - Only display samples created by the current user, as determined by the value of api_key. auto: PREDEFINED predefined: - 'True' - 'False' - auto: PREDEFINED description: It 'True' - Only display samples created by the current user's organization, as determined by the value of api_key. name: org_only predefined: - 'True' - 'False' - name: sha256 description: A SHA256 of the submitted sample, only matches samples, not their artifacts. - name: md5 description: A MD5 checksum of the submitted sample, only matches samples, not their artifacts. - name: sha1 description: A sha1 of the submitted sample, only matches samples, not their artifacts. - name: artifact description: The artifact to download. Sample ID is required when choosing 'artifact'. auto: PREDEFINED predefined: - video.webm - network-artifacts.zip - report.html - sample.zip - screenshot.png - extracted-artifacts.zip - timeline.json - analysis.json - processes.json - network.pcap - name: page description: 'Page number of paginated results. Minimum value: 1.' - name: page_size description: The number of items per page. - name: limit description: The maximum number of records to retrieve. defaultValue: '50' outputs: - contextPath: ThreatGrid.Sample.id description: The sample id. type: String - contextPath: ThreatGrid.Sample.filename description: The sample filename. type: String - contextPath: ThreatGrid.Sample.state description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail". type: String - contextPath: ThreatGrid.Sample.status description: The sample status, one of a stable set of strings "succ, fail". type: String - contextPath: ThreatGrid.Sample.md5 description: The sample md5. type: String - contextPath: ThreatGrid.Sample.sha1 description: The sample sha1. type: String - contextPath: ThreatGrid.Sample.sha256 description: The sample sha256. type: String - contextPath: ThreatGrid.Sample.os description: The sample os. type: String - contextPath: ThreatGrid.Sample.submitted_at description: The sample submission time. type: String - contextPath: ThreatGrid.Sample.started_at description: The sample analysis starting time. type: String - contextPath: ThreatGrid.Sample.completed_at description: The sample completion time. type: String - contextPath: InfoFile.Name description: The file name. type: String - contextPath: InfoFile.EntryID description: The ID for locating the file in the War Room. type: String - contextPath: InfoFile.Size description: The size of the file (in bytes). type: Number - contextPath: InfoFile.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: InfoFile.Extension description: The file extension. type: String - contextPath: InfoFile.Info description: Basic information about the file. type: String description: Search samples on the Threat Grid platform. Input parameters are ANDed together. Only finished samples can be searched (that is, the ones that are having a status of succ or fail.) - name: threat-grid-sample-upload arguments: - name: file_id description: The file ID. Click on the chain-like icon after you upload a file in Demisto to find the file_id. - description: "The URL to upload. " name: url - defaultValue: '10' description: Indicates how long to wait between command execution (in seconds) when 'polling' argument is true. Minimum value is 10 seconds. Default is 10. name: interval_in_seconds - defaultValue: '60' description: Indicates the time in seconds until the polling sequence timeouts. Default is 60. name: timeout_in_seconds - description: The uploaded sample ID. name: sample_id - name: tags description: A comma-separated list of tags applied to this sample. - name: private description: Whether to mark the sample as private. auto: PREDEFINED predefined: - 'True' - 'False' - name: playbook auto: PREDEFINED predefined: - none - default - alt_tab_programs - open_word_embedded_object - visit_site - close_file - use_best_option description: 'Name of a playbook to apply to this sample run. none: Explicitly disables playbooks, default: Default Playbook, alt_tab_programs: Conduct Active Window Change, open_word_embedded_object: Open Embedded Object in Word Document, use_best_option: allows Malware Analytics to select the best Playbook option based on the submitted sample, visit_site: Visit Website Using Internet Explorer, close_file: Close Active Window. The current list of playbooks endpoints can be obtained by querying /api/v3/configuration/playbooks.' - name: vm auto: PREDEFINED predefined: - win7-x64 - win7-x64-2 - win10 - win10-x64-2-beta - win10-x64-browser - win10-x64-jp - win10-x64-kr - win10-x64-phishing-beta description: 'a string identifying a specific VM to use. Options: win7-x64: Windows 7 64bit, win7-x64-2: Windows 7 64-bit Profile 2, win10-x64-2-beta: Windows 10 LTSC 2019 (beta), win10-x64-browser: Windows 10 Browser, win10-x64-jp: Windows 10 Japanese, win10-x64-kr: Windows 10 Korean, win10-x64-phishing-beta: Windows 10 (Phishing), win10: Windows 10 (Not available on Threat Grid appliances). NOTE: The standard (English) VMs default to UTF-8 encoding. To support Korean and Japanese character sets, such as S-JIS, submit to the appropriate VM.' - name: hide_polling_output description: Whether to hide the polling result (automatically filled by polling). hidden: true defaultValue: true outputs: - contextPath: ThreatGrid.Sample.id description: The sample id. type: String - contextPath: ThreatGrid.Sample.filename description: The sample filename. type: String - contextPath: ThreatGrid.Sample.state description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail". type: String - contextPath: ThreatGrid.Sample.status description: The sample status. type: String - contextPath: ThreatGrid.Sample.md5 description: The sample md5. type: String - contextPath: ThreatGrid.Sample.sha1 description: The sample sha1. type: String - contextPath: ThreatGrid.Sample.sha256 description: The sample sha256. type: String - contextPath: ThreatGrid.Sample.os description: The sample os. type: String - contextPath: ThreatGrid.Sample.submitted_at description: The sample submission time. type: String description: Submits a sample to threat grid for analysis. URL or file, not both. polling: true - name: threat-grid-submissions-search arguments: - name: query description: Query text. If you wish to work with an elasticsearch query please set 'advanced' argument to true. - name: user_only description: Only display submissions created by the current user, as determined by the value of api_key. auto: PREDEFINED predefined: - 'True' - 'False' - auto: PREDEFINED description: Only display submissions created by the current user's organization, as determined by the value of api_key. name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: Restrict matches to a subset of submission fields. The value of 'term' is a comma-delimited list of strings which select groups of fields. name: term predefined: - antivirus - analysis.artifacts.av_signatures.product - analysis.artifacts.av_signatures.signature - behavior - analysis.behaviors.name - analysis.behaviors.title - analysis.artifacts.av_signatures.signature - domain - analysis.domains.domain - analysis.domains.domain.component - mutant - analysis.processes.mutants - analysis.processes.mutants.whole - analysis.processes.mutants.component - path - filename - analysis.paths.path - analysis.paths.path.whole - analysis.processes.paths - process - analysis.processes.process_name - analysis.processes.startup_info.command_line - analysis.processes.startup_info.image_pathname - analysis.processes.startup_info.window_title - registry_key - analysis.registry_keys.key - analysis.registry_keys.key.whole - analysis.registry_keys.key.component - analysis.processes.registry_keys - analysis.processes.registry_keys.whole - analysis.registry_keys.value_names - sample - filename - url - analysis.urls.url - analysis.urls.url.whole. - description: "A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500." name: before - description: "A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500." name: after - auto: PREDEFINED description: Restrict match to submissions in specific state or states. name: state predefined: - wait - prep - run - proc - succ - fail - auto: PREDEFINED description: If not specified, results will be sorted by the search score, which is based on which fields match the query most accurately, and their weight. name: sort_by predefined: - timestamp - submitted_at - analyzed_at - filename - type - state - threat or threat_score - login - auto: PREDEFINED description: desc or asc. name: sort_order predefined: - desc - asc - auto: PREDEFINED description: Provide a 'matches' field in results, indicating which fields were matched. name: highlight predefined: - 'True' - 'False' - description: 'Page number of paginated results. Minimum value: 1.' name: page - description: The number of items per page. name: page_size - defaultValue: '50' description: The maximum number of records to retrieve. name: limit outputs: - contextPath: ThreatGrid.Sample.sample description: The sample ID. type: String - contextPath: ThreatGrid.Sample.filename description: The name of the sample file. type: String - contextPath: ThreatGrid.Sample.state description: The state of the sample, one of a stable set of strings "wait, prep, run, proc, succ, fail". type: String - contextPath: ThreatGrid.Sample.status description: The status of the sample. type: String - contextPath: ThreatGrid.Sample.md5 description: The MD5 id of the sample. type: String - contextPath: ThreatGrid.Sample.sha1 description: The SHA1 id of the sample. type: String - contextPath: ThreatGrid.Sample.sha256 description: The SHA256 id of the sample. type: String - contextPath: ThreatGrid.Sample.submitted_at description: Time of submission for the sample. type: Date - contextPath: ThreatGrid.Sample.threat_score description: The threat score of the sample. type: Number description: Search threat grid submissions. - name: threat-grid-sample-summary-get arguments: - name: sample_id required: true description: The sample id. outputs: - contextPath: ThreatGrid.SampleAnalysisSummary.sample description: The sample ID. type: String - contextPath: ThreatGrid.SampleAnalysisSummary.registry_count description: The registry count of the sample. type: Number - contextPath: ThreatGrid.SampleAnalysisSummary.filename description: The Filename of the sample. type: String - contextPath: ThreatGrid.SampleAnalysisSummary.sha256 description: The SHA256 hash of the sample. type: String - contextPath: ThreatGrid.SampleAnalysisSummary.magic_type description: The sample type. type: String - contextPath: ThreatGrid.SampleAnalysisSummary.first_seen description: The timestamp when the sample was first seen. type: Date - contextPath: ThreatGrid.SampleAnalysisSummary.last_seen description: The timestamp when the sample was last seen. type: Date description: Returns summary analysis information. - name: threat-grid-who-am-i outputs: - contextPath: ThreatGrid.User.email description: Current user mail. type: string - contextPath: ThreatGrid.User.login description: Current user login name. type: string description: Get logged in user. arguments: [] - name: threat-grid-rate-limit-get arguments: - name: login required: true default: true description: User login name. - auto: PREDEFINED description: User or Organization. name: entity_type predefined: - user - organization required: true outputs: - contextPath: ThreatGrid.RateLimit.submission-rate-limit description: 'Array of array(s) representing submission(s) per minute(s) or the string"nil" to clear the value. Example: [[5, 1440]] which represents 5 samples per day. This field represent the number of samples allowed.' type: number - contextPath: ThreatGrid.RateLimit.submission-wait-seconds description: The number of seconds to wait for a submission to get uploaded on the platform. type: number - contextPath: ThreatGrid.RateLimit.submissions-available description: The number of submissions available for the specified username. type: number description: Get rate limit for a specific user name. ThreatGrid employs a simple rate limiting method for sample submissions by specifying the number of samples which can be submitted within some variable time period by a user. Multiple rate limits can be employed to form overlapping submission limits. For example, 20 submissions per hour AND 400 per day. - name: threat-grid-feed-specific-get arguments: - name: feed_name required: true description: The feed name. auto: PREDEFINED predefined: - autorun-registry - banking-dns - dga-dns - dll-hijacking-dns - doc-net-com-dns - downloaded-pe-dns - dynamic-dns - irc-dns - modified-hosts-dns - parked-dns - public-ip-check-dns - ransomware-dns - rat-dns - scheduled-tasks - sinkholed-ip-dns - stolen-cert-dns - name: output_type description: The output type. defaultValue: "json" auto: PREDEFINED predefined: - json - csv - stix - snort - txt - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after outputs: - contextPath: ThreatGrid.Feed.sample description: Feed sample. type: String - contextPath: ThreatGrid.Feed.description description: Feed description. type: String description: Gets a specific threat feed. - name: threat-grid-ip-search arguments: - name: ip required: true description: The IP to search for. outputs: - contextPath: ThreatGrid.search.ip description: IP item. type: string - contextPath: ThreatGrid.search.asn description: IP asn. type: string - contextPath: ThreatGrid.search.location description: IP location details. type: string description: Search IPs. Please provide a single argument (only one) to use this command, as the API supports 1 filter at a time. - name: threat-grid-analysis-annotations-get arguments: - name: sample_id required: true description: The sample ID. outputs: - contextPath: ThreatGrid.SampleAnnotations.network description: IP address & timestamp in the annotation. type: String description: Returns data regarding the annotations of the analysis. - name: threat-grid-url-search arguments: - name: url required: true description: The URL to search for (please provide the URL in the format http://example.com:80/. note that ThreatGrid only support '.com' domains). outputs: - contextPath: ThreatGrid.search.url description: URL item. type: String description: Search urls. Please provide the URL in the format http://example.com:80/ (note that ThreatGrid only support '.com' domains). - name: threat-grid-feeds-artifact arguments: - name: sha256 description: Restrict returned records with this sha256. - description: Restrict returned records with this sha1. name: sha1 - description: Restrict returned records with this md5. name: md5 - description: Restrict returned records to this path or path fragment. name: path - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. isArray: true name: sample_id - description: The maximum number of records to retrieve. defaultValue: '50' name: limit - description: The number of items per page. name: page_size - description: Page number of paginated results. name: page outputs: - contextPath: ThreatGrid.Artifact.confidence description: Artifact confidence. type: Number - contextPath: ThreatGrid.Artifact.severity description: "Artifact severity." type: Number - contextPath: ThreatGrid.Artifact.ioc description: Artifact IOC. type: String - contextPath: ThreatGrid.Artifact.artifact_sha256 description: "Artifact sha256." type: String - contextPath: ThreatGrid.Artifact.artifact_md5 description: Artifact md5. type: String - contextPath: ThreatGrid.Artifact.sample_id description: Artifact sample ID. type: String description: Get artifacts threat feed. - name: threat-grid-feeds-domain arguments: - name: domain description: Restrict returned records to this domain or hostname. - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. isArray: true name: sample_id - description: Page number of paginated results. name: page - description: The number of items per page. name: page_size - description: The maximum number of records to retrieve. name: limit defaultValue: '50' outputs: - contextPath: ThreatGrid.Domain.confidence description: "Domain confidence." type: Number - contextPath: ThreatGrid.Domain.severity description: "Domain severity." type: Number - contextPath: ThreatGrid.Domain.ioc description: "Domain IOC." type: String - contextPath: ThreatGrid.Domain.sample_sha256 description: Domain sha256. type: String - contextPath: ThreatGrid.Domain.sample_id description: "Domain sample ID." type: String - contextPath: ThreatGrid.Domain.domain description: "The Domain." type: String description: Get domain threat feed. - name: threat-grid-feeds-ip arguments: - name: ip description: Restrict returned records to this IP or CIDR block. - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. isArray: true name: sample_id - description: Page number of paginated results. name: page - description: The number of items per page. name: page_size - description: The maximum number of records to retrieve. name: limit defaultValue: '50' outputs: - contextPath: ThreatGrid.Ip.confidence description: IP confidence. type: Number - contextPath: ThreatGrid.Ip.severity description: "IP severity." type: Number - contextPath: ThreatGrid.Ip.ioc description: IP IOC. type: String - contextPath: ThreatGrid.Ip.sample_sha256 description: IP sha256. type: String - contextPath: ThreatGrid.Ip.sample_id description: IP sample ID. type: String - contextPath: ThreatGrid.Ip.ip description: "The IP." type: String - contextPath: ThreatGrid.Ip.port description: The IP port. type: Number description: Get ips threat feed. - name: threat-grid-feeds-network-stream arguments: - name: ip description: Restrict returned records to this IP address. - description: Restrict returned records to this port number. name: port - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. isArray: true name: sample_id - description: Page number of paginated results. name: page - description: The number of items per page. name: page_size - description: The maximum number of records to retrieve. name: limit defaultValue: '50' outputs: - contextPath: ThreatGrid.NetworkStreams.confidence description: "Network Streams confidence." type: Number - contextPath: ThreatGrid.NetworkStreams.severity description: "Network Streams severity." type: Number - contextPath: ThreatGrid.NetworkStreams.ioc description: "Network Streams IOC." type: String - contextPath: ThreatGrid.NetworkStreams.sample_sha256 description: "Network Streams sha256." type: String - contextPath: ThreatGrid.NetworkStreams.sample_id description: "Network Streams sample ID." type: String - contextPath: ThreatGrid.NetworkStreams.src description: "The Network Streams source." type: String - contextPath: ThreatGrid.NetworkStreams.src_port description: "The Network Streams source port." type: Number - contextPath: ThreatGrid.NetworkStreams.dst description: "The Network Streams destination." type: String - contextPath: ThreatGrid.NetworkStreams.dst_port description: "The Network Streams destination port." type: Number description: Get network stream threat feed. - name: threat-grid-feeds-path arguments: - name: path description: Restrict returned records to this path or path fragment. - name: before description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: after description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. isArray: true name: sample_id - description: Page number of paginated results. name: page - description: The number of items per page. name: page_size - description: The maximum number of records to retrieve. name: limit defaultValue: '50' outputs: - contextPath: ThreatGrid.Path.confidence description: "Path confidence." type: Number - contextPath: ThreatGrid.Path.severity description: "Path severity." type: Number - contextPath: ThreatGrid.Path.ioc description: "Path IOC." type: String - contextPath: ThreatGrid.Path.sample_sha256 description: "Path sha256." type: String - contextPath: ThreatGrid.Path.sample_id description: "Path sample ID." type: String description: Get path threat feed. - name: threat-grid-feeds-url arguments: - name: url description: Restrict returned records to this URL or URL fragment. - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - defaultValue: '80' description: Restrict to IOCs with this confidence score or higher, defaults to 80. name: confidence - defaultValue: '80' description: Restrict to IOCs with this severity score or higher, defaults to 80. name: severity - description: Restrict returned records to events of this type. name: ioc - auto: PREDEFINED description: "If “true”, will only match against samples submitted by your organization." name: org_only predefined: - 'True' - 'False' - auto: PREDEFINED description: "If “true”, will only match against samples you submitted." name: user_only predefined: - 'True' - 'False' - description: A comma-separated list of sample IDs. Restrict results to these samples. name: sample_id - description: Page number of paginated results. name: page - description: The number of items per page. name: page_size - description: The maximum number of records to retrieve. name: limit defaultValue: '50' outputs: - contextPath: ThreatGrid.Url.confidence description: URL confidence. type: Number - contextPath: ThreatGrid.Url.severity description: URL severity. type: Number - contextPath: ThreatGrid.Url.ioc description: "URL IOC." type: String - contextPath: ThreatGrid.Url.sample_sha256 description: URL sha256. type: String - contextPath: ThreatGrid.Url.sample_id description: URL sample ID. type: String - contextPath: ThreatGrid.Url.url description: The URL. type: String description: Get url threat feed. - name: threat-grid-analysis-artifacts-get arguments: - description: the sample id. name: sample_id required: true - description: The artifact id requested. name: artifact_id outputs: - contextPath: ThreatGrid.ArtifactAnalysis.items description: List of artifact analysis of the sample. type: Unknown description: Returns the sample id artifact with artifact id. - name: threat-grid-analysis-iocs-get arguments: - name: sample_id required: true description: the sample id. - description: the IOC requested. name: ioc outputs: - contextPath: ThreatGrid.IOCAnalysis.title description: 'The title of the IOC.' type: String - contextPath: ThreatGrid.IOCAnalysis.confidence description: 'The confidence of the IOC.' type: Number - contextPath: ThreatGrid.IOCAnalysis.severity description: The severity of the IOC. type: String - contextPath: ThreatGrid.IOCAnalysis.ioc description: Threat grid's IOC. type: String - contextPath: ThreatGrid.IOCAnalysis.category description: The IOC category of the IOC. type: String - contextPath: ThreatGrid.IOCAnalysis.sha256 description: The SHA256 value of the IOC. type: String - contextPath: ThreatGrid.IOCAnalysis.tags description: The tags of the IOC. type: String description: Returns data regarding the specified Indicator of Compromise. - name: threat-grid-analysis-metadata-get arguments: - name: sample_id required: true default: true description: the sample id. outputs: - contextPath: ThreatGrid.AnalysisMetadata.general_details description: The Metadata Analysis General Details. type: Unknown - contextPath: ThreatGrid.AnalysisMetadata.malware_desc description: The Metadata Analysis Malware Desc. type: Unknown - contextPath: ThreatGrid.AnalysisMetadata.sandcastle_env description: "The Metadata Analysis Malware Sandcastle ENV." type: Unknown description: Returns metadata about the analysis. - name: threat-grid-analysis-network-streams-get arguments: - name: sample_id required: true description: the sample id. - name: network_stream_id description: The network stream id. outputs: - contextPath: ThreatGrid.NetworkAnalysis.protocol description: The network protocol. type: Number - contextPath: ThreatGrid.NetworkAnalysis.transport description: "The network transport." type: String - contextPath: ThreatGrid.NetworkAnalysis.service description: The network service. type: String - contextPath: ThreatGrid.NetworkAnalysis.client_ip description: The client IP. type: String - contextPath: ThreatGrid.NetworkAnalysis.server_ip description: The server IP. type: String description: Returns data regarding a specific network stream. - name: threat-grid-analysis-processes-get arguments: - name: sample_id required: true description: the sample id. - description: the process id requested. name: process_id description: Returns data regarding the specific process id in the analysis. outputs: - contextPath: ThreatGrid.ProcessAnalysis.process_name description: The process name. type: String - contextPath: ThreatGrid.ProcessAnalysis.process_id description: The process ID. type: String - name: file arguments: - name: file required: true default: true description: A CSV list of hashes of the file to query. Supports MD5, SHA1, and SHA256. isArray: true - auto: PREDEFINED defaultValue: 'false' description: Whether to return full response for scans. Default is "false". name: long predefined: - 'True' - 'False' - description: If the number of positives is higher than the threshold, the file will be considered malicious. If the threshold is not specified, the default file threshold, as configured in the instance settings, will be used. name: threshold - defaultValue: '60' description: Time (in seconds) to wait between tries if the API rate limit is reached. Default is "60". name: wait - defaultValue: '0' description: Number of retries for the API rate limit. Default is "0". name: retries outputs: - contextPath: File.MD5 description: MD5 hash. type: String - contextPath: File.Name description: File name. type: String - contextPath: File.SHA1 description: SHA1 hash. type: String - contextPath: File.sha256 description: SHA256 hash. type: String - contextPath: File.EntryID description: The entry ID of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor that reported the file as malicious. type: String - contextPath: File.Malicious.Description description: A description explaining why the file was determined to be malicious. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: ThreatGrid.File.PositiveDetections description: Number of engines that positively detected the indicator as malicious. type: number - contextPath: ThreatGrid.File.DetectionEngines description: Total number of engines that checked the indicator. type: number - contextPath: ThreatGrid.File.tgLink description: ThreatGrid permanent link. type: string description: Checks the file reputation of the specified hash. - name: ip arguments: - name: ip description: IP address to check. default: true isArray: true required: true - name: long description: Whether to return full response for detected URLs. Default is "false". auto: PREDEFINED defaultValue: 'false' predefined: - 'True' - 'False' - name: threshold description: If the number of positives is higher than the threshold, the IP address will be considered malicious. If the threshold is not specified, the default IP threshold, as configured in the instance settings, will be used. - name: sampleSize description: The number of samples from each type (resolutions, detections, etc.) to display for long format. Default is "10". defaultValue: '10' - name: wait description: Time (in seconds) to wait between tries if the API rate limit is reached. Default is "60". defaultValue: '60' - name: retries description: Number of retries for API rate limit. Default is "0". defaultValue: '0' - name: fullResponse description: Whether to return all results, which can be thousands. Default is "false". We recommend that you don't return full results in playbooks. auto: PREDEFINED defaultValue: 'false' predefined: - 'True' - 'False' description: Checks the reputation of an IP address. outputs: - contextPath: IP.Address description: IP address. type: String - contextPath: IP.ASN description: IP ASN. type: String - contextPath: IP.Geo.Country description: IP country. type: String - contextPath: ThreatGrid.IP.indicator description: IP address. type: String - contextPath: ThreatGrid.IP.confidence description: Indicator confidence between 0-99. type: Number - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - name: url arguments: - name: url description: A comma-seperated list of URLs to check. This command will not work properly on URLs containing commas. default: true isArray: true required: true - defaultValue: '10' description: The number of samples from each type (resolutions, detections, etc.) to display for long format. name: sampleSize - auto: PREDEFINED defaultValue: 'false' description: Whether to return the full response for the detected URLs. name: long predefined: - 'True' - 'False' - description: If the number of positives is higher than the threshold, the URL will be considered malicious. If the threshold is not specified, the default URL threshold, as configured in the instance settings, will be used. name: threshold - defaultValue: '0' description: Time (in seconds) to wait if the URL does not exist and is submitted for scanning. Default is "0". name: submitWait - defaultValue: '60' description: Time (in seconds) to wait between tries if the API rate limit is reached. Default is "60". name: wait - defaultValue: '0' description: Number of retries for API rate limit. Default is "0". name: retries outputs: - contextPath: URL.Data description: URLs found. type: String - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: String - contextPath: URL.Malicious.Description description: For malicious URLs, the reason that the vendor made the decision. type: String - contextPath: URL.PositiveDetections description: Number of engines that positively detected the indicator as malicious. type: Number - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: ThreatGrid.URL.url description: The URL. type: String - contextPath: ThreatGrid.URL.detection_engines description: Number of engines. type: Number - contextPath: ThreatGrid.URL.positive_engines description: Number of positive engines. type: Number description: Checks the reputation of a URL. - name: domain arguments: - name: domain description: Domain name to check. default: true isArray: true required: true - name: long description: Whether to return the full response for detected URLs. Default is "false". auto: PREDEFINED defaultValue: 'false' predefined: - 'True' - 'False' - name: sampleSize description: The number of samples from each type (resolutions, detections, etc.) to display for long format. defaultValue: '10' - name: threshold description: If the number of positives is higher than the threshold, the domain will be considered malicious. If the threshold is not specified, the default domain threshold, as configured in the instance settings, will be used. - name: wait description: Time (in seconds) to wait between tries if the API rate limit is reached. Default is "60". defaultValue: '60' - name: retries description: Number of retries for API rate limit. Default is "0". defaultValue: '0' - name: fullResponse description: Whether to return all results, which can be thousands. Default is "false". We recommend that you don't return full results in playbooks. auto: PREDEFINED defaultValue: 'false' predefined: - 'True' - 'False' outputs: - contextPath: Domain.Name description: domain found. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Domain.CreationDate description: The date that the domain was created. type: Date - contextPath: Domain.DNS description: A list of IP objects resolved by DNS. type: String - contextPath: Domain.WHOIS.NameServers description: Name servers of the domain. type: String - contextPath: Domain.WHOIS.Registrar.AbuseEmail description: The email address of the contact for reporting abuse. type: Unknown - contextPath: Domain.WHOIS.Registrar.AbusePhone description: The phone number of contact for reporting abuse. type: Unknown - contextPath: Domain.WHOIS.Registrar.Name description: 'The name of the registrar, for example: "GoDaddy".' type: String - contextPath: Domain.WHOIS.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: Domain.WHOIS.DomainStatus description: The status of the domain. type: String - contextPath: ThreatGrid.Domain.domain description: The domain name. type: String description: Checks the reputation of a domain. - name: threat-grid-domain-samples-list arguments: - name: domain description: The domain to search for. required: true - name: after description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: before description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: limit description: The maximum number of records to retrieve. defaultValue: '50' - name: page_size description: The number of items per page. - name: page description: Page number of paginated results. description: Returns a list of samples associated with a Domain. outputs: - contextPath: ThreatGrid.DomainAssociatedSample.domain description: The domain. type: string - contextPath: ThreatGrid.DomainAssociatedSample.samples description: The associated samples. type: string - name: threat-grid-ip-samples-list arguments: - name: ip description: The IP to search for. required: true - description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: after - description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' name: before - defaultValue: '50' description: The maximum number of records to retrieve. name: limit - description: The number of items per page. name: page_size - description: Page number of paginated results. name: page outputs: - contextPath: ThreatGrid.IpAssociatedSample.ip description: The IP. type: string - contextPath: ThreatGrid.IpAssociatedSample.samples description: The associated samples. type: string description: Returns a list of samples associated with an IP. - name: threat-grid-path-samples-list arguments: - name: path description: "The path to search for. A path is a slash-separated list of directory names followed by either a directory name or a file name. Path example: ‘/user/name/file’." required: true - name: after description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: before description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: limit description: The maximum number of records to retrieve. defaultValue: '50' - name: page_zise description: The number of items per page. - name: page description: Page number of paginated results. outputs: - contextPath: ThreatGrid.PathAssociatedSample.path description: The Path. type: string - contextPath: ThreatGrid.PathAssociatedSample.samples description: The associated samples. type: string description: Returns a list of samples associated with a Path. - name: threat-grid-url-samples-list arguments: - name: url description: The target URL. Please provide the URL in the format http://example.com:80/ . required: true - name: after description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: before description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: limit description: The maximum number of records to retrieve. defaultValue: '50' - name: page_zise description: The number of items per page. - name: page description: Page number of paginated results. outputs: - contextPath: ThreatGrid.UrlAssociatedSample.url description: The URL. type: string - contextPath: ThreatGrid.UrlAssociatedSample.samples description: The associated samples. type: string description: Returns a list of samples associated with an URL. - name: threat-grid-registry-key-samples-list arguments: - name: registry_key description: The registry key to search for. required: true - name: after description: 'A date/time (ISO 8601), restricting results to samples submitted after it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: before description: 'A date/time (ISO 8601), restricting results to samples submitted before it. Please use the following date/time format. YYYY-MM-DD Thhmmss+|-hhmm e.g. : 2012-04-19T04:00:55-0500.' - name: limit description: The maximum number of records to retrieve. defaultValue: '50' - name: page_size description: The number of items per page. - name: page description: Page number of paginated results. outputs: - contextPath: ThreatGrid.RegistryKeyAssociatedSample.key description: The Registry Key. type: string - contextPath: ThreatGrid.RegistryKeyAssociatedSample.samples description: The associated samples. type: string description: Returns a list of samples associated with a specified registry key. - name: threat-grid-ip-associated-domains arguments: - name: ip description: The IP to search for. required: true outputs: - contextPath: ThreatGrid.IpAssociatedDomain.ip description: The IP. type: string - contextPath: ThreatGrid.IpAssociatedDomain.domains description: The associated Domain. type: string description: Returns a list of domains associated with the IP. - name: threat-grid-ip-associated-urls arguments: - name: ip description: The IP to search for. required: true outputs: - contextPath: ThreatGrid.IpAssociatedUrl.ip description: The IP. type: string - contextPath: ThreatGrid.IpAssociatedUrl.urls description: The associated URL. type: string description: Returns a list of URLs associated to the IP. - name: threat-grid-domain-associated-urls arguments: - name: domain description: The domain to search for. required: true outputs: - contextPath: ThreatGrid.DomainAssociatedUrl.domain description: The Domain. type: string - contextPath: ThreatGrid.DomainAssociatedUrl.urls description: The associated URL. type: string description: Returns a list of URLs associated to the domain. - name: threat-grid-domain-associated-ips arguments: - name: domain required: true description: The domain to search for. description: Returns a list of IPs associated to the domain. outputs: - contextPath: ThreatGrid.DomainAssociatedIp.domain description: The Domain. type: String - contextPath: ThreatGrid.DomainAssociatedIp.ips description: The associated IP. type: String dockerimage: demisto/python3:3.12.13.10325753 tests: - No tests (auto formatted) fromversion: 5.0.0