category: Network Security provider: A10 Networks commonfields: id: ThreatX version: -1 configuration: - defaultvalue: https://provision.threatx.io display: ThreatX Server URL (e.g., https://provision.threatx.io) name: url required: true type: 0 - display: Customer Name name: customer_name type: 0 hidden: true required: false - display: API Key name: api_key type: 4 hidden: true required: false - name: credentials type: 9 display: Customer Name displaypassword: API Key required: false - defaultvalue: '70' display: IP Threshold. Minimum risk score from ThreatX to consider the IP malicious. name: dbot_threshold required: true type: 0 - defaultvalue: 'false' display: Use system proxy settings name: proxy type: 8 required: false - defaultvalue: 'false' display: Trust any certificate (not secure) name: insecure type: 8 required: false description: The ThreatX integration allows automated enforcement and intel gathering actions. display: ThreatX name: ThreatX script: commands: - arguments: - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".' name: ip required: true - defaultValue: 'Added by ThreatX Demisto Integration' description: 'The description of the IP record in the block list.' name: description description: Temporarily blocks an IP address or CIDR. Default is 30 minutes. execution: true name: threatx-block-ip outputs: - contextPath: IP.Address description: IP address or CIDR that was blocked. type: string - arguments: - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".' name: ip required: true description: Unblocks a blocked IP address or CIDR. execution: true name: threatx-unblock-ip outputs: - contextPath: IP.Address description: IP address or CIDR that was unblocked. type: Unknown - arguments: - description: 'IP address or CIDR in CSV format, for example: "10.1.1.1,10.1.1.0/24".' isArray: true name: ip required: true - defaultValue: 'Added by ThreatX Demisto Integration' description: 'The description of the IP record in the block list.' name: description description: Adds an IP address or CIDR to the block list. execution: true name: threatx-blacklist-ip outputs: - contextPath: IP.Address description: IP address or CIDR that was added to the block list. type: string - arguments: - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".' name: ip required: true description: Removes an IP or CIDR from the block list. execution: true name: threatx-unblacklist-ip outputs: - contextPath: IP.Address description: IP address or CIDR that was removed from the block list. type: string - arguments: - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".' name: ip required: true - defaultValue: 'Added by ThreatX Demisto Integration' description: 'The description of the IP record in the allow list.' name: description description: Adds an IP address or CIDR to the allow list. execution: true name: threatx-whitelist-ip outputs: - contextPath: IP.Address description: IP address or CIDR was added to the allow list. type: string - arguments: - description: 'IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24".' name: ip required: true description: Removes an IP address or CIDR from the allow list. execution: true name: threatx-unwhitelist-ip outputs: - contextPath: IP.Address description: IP address or CIDR that was removed from the allow list. type: string - arguments: - description: CSV list of Entity names. name: entity_name - description: CSV list of Entity ID hashes. name: entity_id - description: CSV list of Entity IP addresses. name: entity_ip - auto: PREDEFINED defaultValue: 1-Hour description: 'Look-back timeframe for the query. Options are 1-Hour, 1-Day, 1-Week, 1-Month, or 3-Months. Note: long look-back timeframes for a large number of Entities can timeout.' name: timeframe predefined: - 1-Hour - 1-Day - 1-Week - 1-Month - 3-Months required: true description: 'Get high-level Entity information using the Entity ID, Entity Name, or Entity IP. For example: !threatx-get-entities timeframe=1-Day entity_name=CynicalGraaf,MJ12Bot entity_id= 566056709675514809 entity_ip=12.12.12.12,14.14.14.14. Note: long look-back timeframes for a large number of Entities can timeout.' name: threatx-get-entities outputs: - contextPath: Threatx.Entity.ID description: ID hash of the entity. type: string - contextPath: Threatx.Entity.Name description: Name of the entity. type: string - contextPath: Threatx.Entity.IP description: IP address of the entity. type: string - contextPath: Threatx.Entity.Risk description: Risk score of the entity. type: Unknown - arguments: - description: 'ID hash of the Entity. Note: this value can be retrieved using the "!threatx-get-entities" command.' name: entity_id required: true description: Returns the notes attached to an Entity, by Entity ID. name: threatx-get-entity-notes outputs: - contextPath: Threatx.Entity.Note description: Notes attached to the entity. type: number - contextPath: Threatx.Entity.ID description: ID hash of the entity. type: Unknown - contextPath: Threatx.Entity.Note.content description: Content of the note. type: Unknown - contextPath: Threatx.Entity.Note.timestamp description: Timestamp of the note. type: Unknown - contextPath: Threatx.Entity.Note.username description: Author of the note. type: Unknown - arguments: - description: 'ID hash of the Entity. To retrieve this value, run the "!threatx-get-entities" command.' name: entity_id required: true - description: Contents of the note. name: message required: true description: 'Add a new note to the entity. For example: !threatx-add-entity-note entity_id=566056709695514809 message="test note"' execution: true name: threatx-add-entity-note runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 5.0.0 tests: - No tests (auto formatted)