commonfields: id: ThreatMiner version: -1 name: ThreatMiner display: ThreatMiner category: Data Enrichment & Threat Intelligence provider: ThreatConnect description: Data Mining for Threat Intelligence. sectionorder: - Connect - Collect configuration: - display: Maximum results per query, enter 'all' to get unlimited results name: limit_results defaultvalue: "30" type: 0 required: false section: Collect - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable display: Source Reliability name: integrationReliability section: Collect options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: ThreatMiner API URL name: threatminer_url defaultvalue: https://api.threatminer.org/v2/ type: 0 required: true section: Connect script: script: '' type: python subtype: python3 commands: - name: domain arguments: - name: domain required: true description: Domain name to get information for. default: true isArray: true outputs: - contextPath: ThreatMiner.Domain.Whois.Server description: Whois server address. type: string - contextPath: ThreatMiner.Domain.Whois.CreateDate description: Creation date. type: date - contextPath: ThreatMiner.Domain.Whois.UpdateDate description: Last update date. type: date - contextPath: ThreatMiner.Domain.Whois.Expiration description: Expiration date. type: date - contextPath: ThreatMiner.Domain.Whois.NameServers description: Whois name servers. type: string - contextPath: ThreatMiner.Domain.PassiveDNS.IP description: Passive DNS IP address. type: string - contextPath: ThreatMiner.Domain.PassiveDNS.FirstSeen description: Passive DNS first seen date. type: date - contextPath: ThreatMiner.Domain.PassiveDNS.LastSeen description: Passive DNS last seen date. type: date - contextPath: ThreatMiner.Domain.Subdomains description: Subdomains. type: string - contextPath: ThreatMiner.Domain.URI.Address description: Related URIs. type: string - contextPath: ThreatMiner.Domain.URI.LastSeen description: URI last seen date. type: string - contextPath: ThreatMiner.Domain.MD5 description: Related samples' MD5 hash. type: string - contextPath: Domain.Name description: Searched domain name. type: string - contextPath: ThreatMiner.Domain.Whois.Domain description: Domain name that was searched. type: string - contextPath: Domain.DNS description: IPs resolved by DNS. - contextPath: Domain.Whois.CreateDate description: Creation date. type: date - contextPath: Domain.Whois.UpdateDate description: Last update date. type: date - contextPath: Domain.Whois.Expiration description: Expiration date. type: date - contextPath: Domain.Whois.Registrant.Name description: Name of the registrant. type: string - contextPath: Domain.Whois.Registrant.Email description: Email of the registrant. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String description: Retrieves data from ThreatMiner about a specified domain. - name: ip arguments: - name: ip required: true description: IP address to get information for. default: true isArray: true outputs: - contextPath: ThreatMiner.IP.Address description: IP address that was searched. type: string - contextPath: ThreatMiner.IP.Whois.Reverse description: Whois reverse name. type: string - contextPath: ThreatMiner.IP.Whois.Bgp description: BGP prefix. type: string - contextPath: ThreatMiner.IP.Whois.Country description: Related country. type: string - contextPath: ThreatMiner.IP.Whois.ASN description: Related ASN. type: string - contextPath: ThreatMiner.IP.Whois.Org description: Organization name. type: string - contextPath: ThreatMiner.IP.PassiveDNS.Domain description: PassiveDNS domain. type: string - contextPath: ThreatMiner.IP.PassiveDNS.FirstSeen description: Passive DNS first seen date. type: date - contextPath: ThreatMiner.IP.PassiveDNS.LastSeen description: Passive DNS last seen date. type: date - contextPath: ThreatMiner.IP.URI.Address description: Related URIs. type: string - contextPath: ThreatMiner.IP.URI.LastSeen description: URI last seen date. type: date - contextPath: ThreatMiner.IP.MD5 description: Related samples MD5 hash. type: string - contextPath: ThreatMiner.IP.SSL description: SSL certificates. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: IP.Address description: IP address that was searched. - contextPath: IP.Geo.Country description: Related country. - contextPath: IP.ASN description: Related ASN. description: Retrieves data from ThreatMiner about a specified IP address. - name: file arguments: - name: file required: true description: File hash (md5, sha1, sha256). default: true isArray: true - name: threshold description: If ThreatScore is greater or equal than the threshold, then file will be considered malicious. defaultValue: "10" outputs: - contextPath: ThreatMiner.File.MD5 description: File MD5 hash. type: string - contextPath: ThreatMiner.File.SHA1 description: File SHA1 hash. type: string - contextPath: ThreatMiner.File.SHA256 description: File SHA256 hash. type: string - contextPath: ThreatMiner.File.Type description: File type. type: string - contextPath: ThreatMiner.File.Name description: File name. type: string - contextPath: ThreatMiner.File.Architecture description: File architecture. type: string - contextPath: ThreatMiner.File.Size description: File size. type: string - contextPath: ThreatMiner.File.Analyzed description: File analyzed date. type: date - contextPath: ThreatMiner.File.HTTP.Domain description: HTTP traffic to domain. type: string - contextPath: ThreatMiner.File.HTTP.URL description: HTTP traffic to URL. type: string - contextPath: ThreatMiner.File.HTTP.Useragent description: HTTP user agent. type: string - contextPath: ThreatMiner.File.Domains.IP description: Related IP address. type: string - contextPath: ThreatMiner.File.Domains.Domain description: Related domain name. type: string - contextPath: ThreatMiner.File.Mutants description: Used mutexes. type: string - contextPath: ThreatMiner.File.Registry description: Used registry keys. type: string - contextPath: ThreatMiner.File.AV.Name description: Detected AV name. type: string - contextPath: ThreatMiner.File.AV.Detection description: AV detection. type: string - contextPath: File.MD5 description: File MD5 hash. type: string - contextPath: File.SHA1 description: File SHA1 hash. type: string - contextPath: File.SHA256 description: File SHA256 hash. type: string - contextPath: File.Malicious.Detections description: For malicious files, the total number of detections. type: number - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: string - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: File.Name description: File name. type: string description: Retrieves data from ThreatMiner about a specified file. runonce: false dockerimage: demisto/python3:3.12.13.10116658 tests: - ThreatMiner-Test fromversion: 5.0.0