commonfields: id: TruSTAR version: -1 name: TruSTAR category: Data Enrichment & Threat Intelligence provider: Cisco Systems description: Deprecated. Not supported since TrueSTAR was acquired by Splunk, No available replacement. display: TruSTAR (Deprecated) deprecated: true configuration: - display: Server URL (e.g. https://192.168.0.1) name: server defaultvalue: https://api.trustar.co type: 0 required: true - display: TruSTAR API Key name: key defaultvalue: "" type: 0 required: true - display: TruSTAR API Secret name: secret defaultvalue: "" type: 4 required: true - display: Trust any certificate (not secure) name: insecure defaultvalue: "" type: 8 required: false - display: Use system proxy settings name: proxy defaultvalue: "false" type: 8 required: false - display: File Threshold (LOW, MEDIUM, HIGH). Minimum TruSTAR priority level to consider the file malicious name: file_threshold defaultvalue: MEDIUM type: 0 required: false - display: URL Threshold (LOW, MEDIUM, HIGH). Minimum TruSTAR priority level to consider the URL malicious name: url_threshold defaultvalue: MEDIUM type: 0 required: false - display: IP Threshold (LOW, MEDIUM, HIGH). Minimum TruSTAR priority level to consider the IP malicious name: ip_threshold defaultvalue: MEDIUM type: 0 required: false - display: Domain Threshold (LOW, MEDIUM, HIGH). Minimum TruSTAR priority level to consider the domain malicious name: domain_threshold defaultvalue: MEDIUM type: 0 required: false script: script: '' type: python commands: - name: trustar-related-indicators arguments: - name: indicators required: true default: true description: Indicator value of any type; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave-ids description: Comma-separated list of enclave ids; only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. - name: page-number description: Which page of the result set to get. defaultValue: "0" - name: page-size description: The number of results per page. defaultValue: "25" outputs: - contextPath: File.Name description: File name. type: string - contextPath: File.MD5 description: File MD5. type: string - contextPath: File.SHA1 description: File SHA1. type: string - contextPath: File.SHA256 description: File SHA256. type: string - contextPath: File.priorityLevel description: File priority level. type: string - contextPath: URL.Address description: URL address. type: string - contextPath: URL.priorityLevel description: URL priority level. type: string - contextPath: IP.Address description: IP address. type: string - contextPath: IP.priorityLevel description: IP priority level. type: string - contextPath: Account.Email.Address description: Email address. type: string - contextPath: Account.Email.priorityLevel description: Email priority level. type: string - contextPath: RegistryKey.Path description: Registry key path. type: string - contextPath: RegistryKey.priorityLevel description: Registry key priority level. type: string - contextPath: CVE.ID description: CVE ID. type: string - contextPath: CVE.priorityLevel description: CVE priority level. type: string description: Search all TruSTAR incident reports for provided indicators and return all correlated indicators from search results. Two indicators are considered “correlated” if they can be found in a common report. - name: trustar-trending-indicators arguments: - name: type auto: PREDEFINED predefined: - CVE - MALWARE - other description: The types of indicators to be returned. If other, then all indicator types except for CVE and MALWARE will be returned. defaultValue: other - name: days-back description: The number of days back to count correlations for. defaultValue: "3" outputs: - contextPath: File.Name description: File name. type: string - contextPath: File.MD5 description: File MD5. type: string - contextPath: File.SHA1 description: File SHA1. type: string - contextPath: File.SHA256 description: File SHA256. type: string - contextPath: URL.Address description: URL address. type: string - contextPath: IP.Address description: IP address. type: string - contextPath: Account.Email.Address description: Email address. type: string - contextPath: RegistryKey.Path description: Registry key path. type: string - contextPath: CVE.ID description: CVE ID. type: string description: Returns the 10 indicators that have recently appeared in the most community reports. This is analogous to the Community Trends section of the dashboard on Station. - name: trustar-search-indicators arguments: - name: search-term required: true default: true description: The term to search for. - name: enclave-ids description: Comma-separated list of enclave ids; only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. - name: page-number description: Which page of the result set to get. defaultValue: "0" - name: page-size description: The number of results per page. defaultValue: "25" outputs: - contextPath: File.Name description: File name. type: string - contextPath: File.MD5 description: File MD5. type: string - contextPath: File.SHA1 description: File SHA1. type: string - contextPath: File.SHA256 description: File SHA256. type: string - contextPath: URL.Address description: URL address. type: string - contextPath: IP.Address description: IP address. type: string - contextPath: Account.Email.Address description: Email address. type: string - contextPath: RegistryKey.Path description: Registry key path. type: string - contextPath: CVE.ID description: CVE ID. type: string description: Searches for all indicators that contain the given search term. - name: trustar-submit-report arguments: - name: title required: true description: Title of the report. - name: report-body required: true description: Text content of report. - name: enclave-ids description: CSV of TruSTAR-generated enclave ids. Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. - name: distribution-type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE - name: external-url description: URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. - name: time-began description: ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. outputs: - contextPath: TruSTAR.Report.reportTitle description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Submit a new incident report, and receive the ID it has been assigned in TruSTAR’s system. - name: trustar-update-report arguments: - name: report-id required: true description: TruSTAR report id or external tracking id. - name: title required: true description: Title of the report. - name: report-body required: true description: Text content of report. - name: enclave-ids description: CSV of TruSTAR-generated enclave ids. Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. - name: external-url description: URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. - name: distribution-type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE - name: time-began description: ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. outputs: - contextPath: TruSTAR.Report.reportTitle description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Update the report with the specified ID. Either the internal TruSTAR report ID or an external tracking ID can be used. Only the fields passed will be updated. All others will be left unchanged. - name: trustar-report-details arguments: - name: report-id required: true description: Finds a report by its internal or external id. - name: id-type auto: PREDEFINED predefined: - internal - external description: Type of report ID. defaultValue: internal outputs: - contextPath: TruSTAR.Report.reportTitle description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Finds a report by its internal or external id. - name: trustar-delete-report arguments: - name: report-id required: true description: Finds a report by its internal or external id. - name: id-type auto: PREDEFINED predefined: - internal - external description: Type of report ID. defaultValue: internal description: Deletes a report as specified by given id (id can be TruSTAR report id or external id). - name: trustar-get-reports arguments: - name: from description: Start of time window (format is YY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00). Based on updated time, and not created time. Default is 1 day ago. - name: to description: End of time window (format is YY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00). Based on updated time, and not created time. Default is current time. - name: distribution-type auto: PREDEFINED predefined: - ENCLAVE - COMMUNITY description: Whether to search for reports in the community, or only in enclaves. defaultValue: ENCLAVE - name: enclave-ids description: Comma separated list of enclave ids to search for reports in. Even if distributionType is COMMUNITY, these enclaves will still be searched as well. Default is All enclaves the user has READ access to. - name: tags description: a list of names of tags to filter by; only reports containing ALL of these tags will be returned. - name: excluded-tags description: reports containing ANY of these tags will be excluded from the results. outputs: - contextPath: TruSTAR.Report.reportTitle description: Title of the report. - contextPath: TruSTAR.Report.reportBody description: Body of the report. - contextPath: TruSTAR.Report.id description: ID of the report. description: 'Returns incident reports matching the specified filters. All parameters are optional: if nothing is specified, the latest 25 reports accessible by the user will be returned (matching the view the user would have by logging into Station).' - name: trustar-correlated-reports arguments: - name: indicators required: true description: Indicator value of any type; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave-ids description: Comma-separated list of enclave ids; only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. - name: page-number description: Which page of the result set to get. defaultValue: "0" - name: page-size description: The number of results per page. defaultValue: "25" - name: distribution-type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE description: Returns a paginated list of all reports that contain any of the provided indicator values. - name: trustar-search-reports arguments: - name: search-term required: true default: true description: The term to search for. - name: enclave-ids description: Comma-separated list of enclave ids; only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). description: Searches for all reports that contain the given search term. - name: trustar-add-to-whitelist arguments: - name: indicators required: true default: true description: CSV of indicators to add to allow list, i.e. evil.com,101.43.52.224. description: Add to allow list a list of indicator values for the user’s company. - name: trustar-remove-from-whitelist arguments: - name: indicator required: true description: The value of the indicator to delete. - name: indicator-type required: true auto: PREDEFINED predefined: - URL - IP - SHA256 - SHA1 - MD5 - SOFTWARE - EMAIL_ADDRESS - BITCOIN_ADDRESS - CIDR_BLOCK - CVE - REGISTRY_KEY description: The type of the indicator to delete. description: Delete an indicator from the user’s company allow list. - name: trustar-get-enclaves arguments: [] description: Returns the list of all enclaves that the user has access to, as well as whether they can read, create, and update reports in that enclave. - name: file deprecated: true arguments: - name: file required: true description: File hash - MD5, SHA1 or SHA256. default: true - name: threshold auto: PREDEFINED predefined: - LOW - MEDIUM - HIGH description: If ThreatScore is greater or equal than the threshold, then ip will be considered malicious. outputs: - contextPath: File.MD5 description: File MD5. type: string - contextPath: File.SHA1 description: File SHA1. type: string - contextPath: File.SHA256 description: File SHA256. type: string - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: string - contextPath: DBotScore.Indicator description: The indicator we tested. type: string - contextPath: DBotScore.Type description: The type of the indicator. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: TruSTAR.File.Value description: Indicator value. type: string - contextPath: TruSTAR.File.Whitelisted description: Is the indicator on allow list. type: boolean - contextPath: TruSTAR.File.Priority description: Indicator's priority level by TruSTAR - LOW, MEDIUM or HIGH. type: string - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision. description: Check file reputation on TruSTAR. - name: ip deprecated: true arguments: - name: ip required: true description: IP address (e.g. 8.8.8.8) or a CIDR (e.g. 1.1.1.0/18). - name: threshold auto: PREDEFINED predefined: - LOW - MEDIUM - HIGH description: If ThreatScore is greater or equal than the threshold, then ip will be considered malicious. outputs: - contextPath: IP.Address description: IP Address. type: string - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision. type: string - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision. type: string - contextPath: DBotScore.Indicator description: The indicator we tested. type: string - contextPath: DBotScore.Type description: The type of the indicator. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: string - contextPath: TruSTAR.IP.Value description: Indicator value. type: string - contextPath: TruSTAR.IP.Whitelisted description: Is the indicator on allow list. type: boolean - contextPath: TruSTAR.IP.Priority description: Indicator's priority level by TruSTAR - LOW, MEDIUM or HIGH. description: Check IP Reputation on TruSTAR. - name: url deprecated: true arguments: - name: url required: true description: Enter a URL to search. - name: threshold auto: PREDEFINED predefined: - LOW - MEDIUM - HIGH description: If ThreatScore is greater or equal than the threshold, then ip will be considered malicious. outputs: - contextPath: URL.Data description: URL data. type: string - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: string - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision. type: string - contextPath: DBotScore.Indicator description: The indicator we tested. type: string - contextPath: DBotScore.Type description: The type of the indicator. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: string - contextPath: TruSTAR.URL.Value description: Indicator value. type: string - contextPath: TruSTAR.URL.Whitelisted description: Is the indicator on allow list. type: boolean - contextPath: TruSTAR.URL.Priority description: Indicator's priority level by TruSTAR - LOW, MEDIUM or HIGH. type: string description: Check URL reputation on TruSTAR. - name: domain deprecated: true arguments: - name: domain required: true description: Enter domain name to search. - name: threshold auto: PREDEFINED predefined: - LOW - MEDIUM - HIGH description: If ThreatScore is greater or equal than the threshold, then ip will be considered malicious. outputs: - contextPath: Domain.Name description: Domain Name. type: string - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: string - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision. type: string - contextPath: DBotScore.Indicator description: The indicator we tested. type: string - contextPath: DBotScore.Type description: The type of the indicator. type: string - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: string - contextPath: TruSTAR.Domain.Value description: Indicator value. type: string - contextPath: TruSTAR.Domain.Whitelisted description: Is the indicator on allow list. type: boolean - contextPath: TruSTAR.Domain.Priority description: Indicator's priority level by TruSTAR - LOW, MEDIUM or HIGH. type: string description: Check Domain reputation on TruStar. - name: trustar-get-phishing-submissions arguments: - name: priority_event_score description: Score of email submission. isArray: true defaultValue: -1,0,1,2,3 - name: from_time description: Start of time window (defaults to 24 hours ago) (YYYY-MM-DD HH:MM:SS). - name: to_time description: End of time window (defaults to current time) (YYYY-MM-DD HH:MM:SS). - name: status auto: PREDEFINED predefined: - UNRESOLVED - CONFIRMED - IGNORED description: A list of triage statuses for submissions (UNRESOLVED,CONFIRMED,IGNORED); only email submissions marked with at least one of these statuses will be returned. isArray: true defaultValue: UNRESOLVED outputs: - contextPath: TruSTAR.PhishingSubmission.submissionId description: The submission ID. type: string - contextPath: TruSTAR.PhishingSubmission.title description: Submission title. type: string - contextPath: TruSTAR.PhishingSubmission.priorityEventScore description: Submission triage score. type: number - contextPath: TruSTAR.PhishingSubmission.context.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.PhishingSubmission.context.sourceKey description: Indicator source. type: string - contextPath: TruSTAR.PhishingSubmission.context.normalizedIndicatorScore description: Indicator score. type: number - contextPath: TruSTAR.PhishingSubmission.context.originalIndicatorScore.name description: Original Indicator score name. type: string - contextPath: TruSTAR.PhishingSubmission.context.originalIndicatorScore.value description: Original Indicator score value. type: string description: Fetches all phishing submissions that fit the given criteria. - name: trustar-set-triage-status arguments: - name: submission_id required: true description: ID of the email submission. - name: status required: true auto: PREDEFINED predefined: - CONFIRMED - IGNORED description: Submission status. description: Marks a phishing email submission with one of the phishing namespace tags. - name: trustar-get-phishing-indicators arguments: - name: normalized_indicator_score description: Intel score of the indicator. isArray: true defaultValue: -1,0,1,2,3 - name: priority_event_score description: Score of email submission. isArray: true defaultValue: -1,0,1,2,3 - name: from_time description: Start of time window (defaults to 24 hours ago) (YYYY-MM-DD HH:MM:SS). - name: to_time description: End of time window (defaults to current time) (YYYY-MM-DD HH:MM:SS). - name: status auto: PREDEFINED predefined: - UNRESOLVED - CONFIRMED - IGNORED description: A list of triage statuses for submissions; only email submissions marked with at least one of these statuses will be returned. Options are 'UNRESOLVED', 'CONFIRMED', 'IGNORED'. isArray: true defaultValue: UNRESOLVED,CONFIRMED,IGNORED outputs: - contextPath: TruSTAR.PhishingIndicator.indicatorType description: Indicator Type. type: string - contextPath: TruSTAR.PhishingIndicator.normalizedIndicatorScore description: Indicator normalized score. type: number - contextPath: TruSTAR.PhishingIndicator.originalIndicatorScore.name description: Indicator original score name. type: string - contextPath: TruSTAR.PhishingIndicator.originalIndicatorScore.value description: Indicator original score value. type: string - contextPath: TruSTAR.PhishingIndicator.sourceKey description: Indicator source key. type: string - contextPath: TruSTAR.PhishingIndicator.value description: Indicator value. type: string description: Get phishing indicators that match the given criteria. dockerimage: demisto/trustar:20.1.0.8039 subtype: python2 fromversion: 5.0.0 tests: - No tests (auto formatted)