commonfields: id: TruSTAR v2 version: -1 name: TruSTAR v2 display: TruSTAR v2 (Deprecated) category: Data Enrichment & Threat Intelligence provider: Cisco Systems description: Deprecated. Not supported since TrueSTAR was acquired by Splunk, No available replacement. configuration: - display: Server URL (e.g. https://api.trustar.co) name: server defaultvalue: https://api.trustar.co type: 0 required: true - display: Station URL (e.g. https://station.trustar.co) name: station defaultvalue: https://station.trustar.co type: 0 required: false - display: TruSTAR API Key name: key type: 0 required: true - display: TruSTAR API Secret name: secret type: 4 required: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: commands: - name: trustar-search-indicators arguments: - name: search_term description: The term to search for (e.g. covid-19). - name: enclave_ids description: Comma-separated list of enclave ids; (i.e. ,,). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. isArray: true - name: from_time description: Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: to_time description: End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: indicator_types description: comma-separated indicator types to filter by. e.g. "URL, IP". isArray: true - name: tags description: Name (or list of names) of tag(s) to filter indicators by. (i.e. ,,). Only indicators containing ALL of these tags will be returned. isArray: true - name: excluded_tags description: Indicators containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. ,,). isArray: true - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" outputs: - contextPath: TruSTAR.Indicators.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.Indicators.value description: Indicator value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Searches for all indicators that contain the given search term. - name: trustar-get-enclaves arguments: [] outputs: - contextPath: TruSTAR.Enclaves.id description: Enclave type. type: string - contextPath: TruSTAR.Enclaves.name description: Enclave name. type: string - contextPath: TruSTAR.Enclaves.type description: Enclave type. type: string - contextPath: TruSTAR.Enclaves.create description: True if I have create permissions on enclave. type: Bool - contextPath: TruSTAR.Enclaves.update description: True if I have update permissions on enclave. type: Bool - contextPath: TruSTAR.Enclaves.read description: True if I have read permissions on enclave. type: Bool description: Returns the list of all enclaves that the user has access to, as well as whether they can read, create, and update reports in that enclave. - name: trustar-related-indicators arguments: - name: indicators required: true default: true isArray: true description: Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave_ids isArray: true description: Comma-separated list of enclave IDs; (i.e. ,,). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" outputs: - contextPath: TruSTAR.Indicators.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.Indicators.value description: Indicator value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Finds all reports that contain any of the given indicators and returns correlated indicators from those reports. - name: trustar-trending-indicators arguments: - name: indicator_type auto: PREDEFINED predefined: - CVE - MALWARE - other description: The types of indicators to be returned. If other, then all indicator types except for CVE and MALWARE will be returned. defaultValue: other - name: days_back description: The number of days back to count correlations for. defaultValue: "3" outputs: - contextPath: TruSTAR.Indicators.correlationCount description: Indicator correlation count. type: Number - contextPath: TruSTAR.Indicators.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.Indicators.value description: Indicator value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Find indicators that are trending in the community. - name: trustar-indicators-metadata arguments: - name: indicators required: true default: true isArray: true description: Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave_ids isArray: true description: CSV of enclave IDs to restrict to. (i.e. ,,). By default, uses all of the user’s enclaves. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. outputs: - contextPath: TruSTAR.IndicatorsMetadata.notes description: Indicator notes. type: string - contextPath: TruSTAR.IndicatorsMetadata.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.IndicatorsMetadata.firstSeen description: Indicator first seen value. type: Date - contextPath: TruSTAR.IndicatorsMetadata.correlationCount description: Indicator correlation count. type: Number - contextPath: TruSTAR.IndicatorsMetadata.value description: Indicator value. type: string - contextPath: TruSTAR.IndicatorsMetadata.lastSeen description: Indicator last seen value. type: Date - contextPath: TruSTAR.IndicatorsMetadata.tags description: Indicator tags. type: string - contextPath: TruSTAR.IndicatorsMetadata.enclaveIds description: Enclave IDs where indicator is present. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Provide metadata associated with a list of indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags. The metadata is determined based on the enclaves the user making the request has READ access to. - name: trustar-indicator-summaries arguments: - name: values required: true default: true isArray: true description: Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave_ids isArray: true description: CSV of enclaves to search for indicator summaries in. (i.e. ,,). These should be enclaves containing data from sources on the TruSTAR Marketplace. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" outputs: - contextPath: TruSTAR.IndicatorSummaries.severityLevel description: Indicator severity level. type: string - contextPath: TruSTAR.IndicatorSummaries.reportId description: Indicator report ID. type: string - contextPath: TruSTAR.IndicatorSummaries.value description: Indicator value. type: string - contextPath: TruSTAR.IndicatorSummaries.score.name description: Indicator score name. type: string - contextPath: TruSTAR.IndicatorSummaries.score.value description: Indicator score value. type: string - contextPath: TruSTAR.IndicatorSummaries.attributes description: Indicator attributes. type: String - contextPath: TruSTAR.IndicatorSummaries.enclaveId description: Indicator enclave ID. type: string - contextPath: TruSTAR.IndicatorSummaries.type description: Indicator type. type: string - contextPath: TruSTAR.IndicatorSummaries.source.key description: Indicator source key. type: string - contextPath: TruSTAR.IndicatorSummaries.source.name description: Indicator source name. type: string - contextPath: TruSTAR.IndicatorSummaries.updated description: Indicator last update value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Provides structured summaries about indicators, which are derived from intelligence sources on the TruSTAR Marketplace. - name: trustar-get-whitelisted-indicators arguments: - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" outputs: - contextPath: TruSTAR.WhitelistedIndicators.indicatorType description: File MD5. type: string - contextPath: TruSTAR.WhitelistedIndicators.value description: File SHA1. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Gets a list of indicators that the user’s company has added to allow list. - name: trustar-get-reports arguments: - name: from_time description: Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: to_time description: End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: distribution_type auto: PREDEFINED predefined: - ENCLAVE - COMMUNITY description: Whether to search for reports in the community, or only in enclaves. defaultValue: ENCLAVE - name: enclave_ids isArray: true description: Comma separated list of enclave ids to search for reports in. (i.e. ,,). Even if distributionType is COMMUNITY, these enclaves will still be searched as well. Default is All enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: tags description: a list of names of tags to filter by; only reports containing ALL of these tags will be returned. i.e. ,,). isArray: true - name: excluded_tags description: reports containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. ,,). isArray: true outputs: - contextPath: TruSTAR.Report.title description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: 'Returns incident reports matching the specified filters. All parameters are optional: if nothing is specified, the latest 25 reports accessible by the user will be returned (matching the view the user would have by logging into Station).' - name: trustar-get-indicators-for-report arguments: - name: report_id required: true description: the ID of the report to get the indicators from. - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: '25' outputs: - contextPath: TruSTAR.Indicators.type description: Indicator type. type: string - contextPath: TruSTAR.Indicators.value description: Indicator value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Return a list of indicators extracted from a report. - name: trustar-move-report arguments: - name: report_id description: the ID of the report you want to move. required: true - name: dest-enclave-id description: the ID of the destination enclave. required: true description: Move a report from one enclave to another. - name: trustar-copy-report arguments: - name: report_id description: the ID of the report you want to move. required: true - name: dest_enclave_id description: the ID of the destination enclave. required: true description: Copies a report from one enclave to another. - name: trustar-submit-report arguments: - name: title required: true description: Title of the report. - name: report_body required: true description: Text content of report. - name: enclave_ids isArray: true description: CSV of TruSTAR-generated enclave ids. (i.e. ,,). Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: distribution_type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE - name: external_url description: URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. - name: time_began description: ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. - name: redact auto: PREDEFINED predefined: - "YES" - "NO" description: YES OR NO. If redact is YES, all terms from user's company redaction library in TruSTAR will be applied before submitting. If NO, submits the report with body and title as written by the user. defaultValue: "NO" outputs: - contextPath: TruSTAR.Report.title description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Submit a new incident report, and receive the ID it has been assigned in TruSTAR’s system. - name: trustar-delete-report arguments: - name: report_id required: true description: Finds a report by its internal or external id. - name: id_type auto: PREDEFINED predefined: - internal - external description: Type of report ID. defaultValue: internal description: Deletes a report as specified by given id (id can be TruSTAR report id or external id). - name: trustar-correlated-reports arguments: - name: indicators required: true isArray: true description: Comma separated indicator values. Values can be any of the following types; i.e. an IP address, email address, URL, MD5, SHA1, SHA256, Registry Key, Malware name, etc. - name: enclave-ids isArray: true description: Comma-separated list of enclave ids; (i.e. ,,). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). Defaults is all enclaves the user has READ access to. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" - name: distribution_type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE description: Returns a list of all reports that contain any of the provided indicator values. - name: trustar-report-details arguments: - name: report_id required: true description: Finds a report by its internal or external id. - name: id_type auto: PREDEFINED predefined: - internal - external description: Type of report ID. defaultValue: internal outputs: - contextPath: TruSTAR.Report.title description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Finds a report by its ID and returns the report details. - name: trustar-update-report arguments: - name: report_id required: true description: TruSTAR report id or external tracking id. - name: title description: Title of the report. - name: report-body description: Text content of report. - name: enclave_ids isArray: true description: CSV of TruSTAR-generated enclave ids. (i.e. ,,). Use the enclave ID, NOT the enclave name. Mandatory if the distribution type is ENCLAVE. You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. - name: external_url description: URL for the external report that this originated from, if one exists. Limit 500 alphanumeric characters. Must be unique across all reports for a given company. - name: distribution_type auto: PREDEFINED predefined: - COMMUNITY - ENCLAVE description: Distribution type of the report. defaultValue: ENCLAVE - name: time_began description: ISO-8601 formatted incident time with timezone, e.g. 2016-09-22T11:38:35+00:00. Default is current time. outputs: - contextPath: TruSTAR.Report.title description: Title of the report. type: string - contextPath: TruSTAR.Report.reportBody description: Body of the report. type: string - contextPath: TruSTAR.Report.id description: ID of the report. type: string description: Update the report with the specified ID. Either the internal TruSTAR report ID or an external tracking ID can be used. Only the fields passed will be updated. All others will be left unchanged. - name: trustar-search-reports arguments: - name: search_term default: true description: The term to search for (e.g. covid-19) If empty, no search term will be applied. Otherwise, must be at least 3 characters. - name: enclave_ids description: Comma-separated list of enclave ids (i.e. ,,). Only indicators found in reports from these enclaves will be returned (defaults to all of user’s enclaves). You can get a list of your enclave IDs executing the command '!trustar-get-enclaves'. isArray: true - name: from_time description: Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: to_time description: End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: tags description: Name (or list of names) of tag(s) to filter indicators by. i.e. ,,). Only indicators containing ALL of these tags will be returned. isArray: true - name: excluded_tags description: Indicators containing ANY of these tags will be excluded from the results. Can be a single tag or a list of tags. i.e. ,,). isArray: true - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: "25" outputs: - contextPath: TruSTAR.Report.id description: ID of the report. type: string - contextPath: TruSTAR.Report.title description: Report Title. type: string description: Searches for all reports that contain the given search term. - name: trustar-add-to-whitelist arguments: - name: indicators required: true default: true isArray: true description: CSV of indicators to add to allow list, i.e. evil.com,101.43.52.224. description: Add to allow list a list of indicator values for the user’s company. - name: trustar-remove-from-whitelist arguments: - name: indicator required: true description: The value of the indicator to delete. - name: indicator_type required: true auto: PREDEFINED predefined: - URL - IP - SHA256 - SHA1 - MD5 - SOFTWARE - EMAIL_ADDRESS - BITCOIN_ADDRESS - CIDR_BLOCK - CVE - REGISTRY_KEY description: The type of the indicator to delete. description: Delete an indicator from the user’s company allow list. - name: trustar-get-phishing-submissions arguments: - name: priority_event_score description: List of email submissions scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. -1,0,2). isArray: true defaultValue: -1,0,1,2,3 - name: from_time description: Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: to_time description: End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: status auto: PREDEFINED predefined: - UNRESOLVED - CONFIRMED - IGNORED description: A list of triage statuses for submissions (UNRESOLVED,CONFIRMED,IGNORED); only email submissions marked with at least one of these statuses will be returned. isArray: true defaultValue: UNRESOLVED - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: 25 outputs: - contextPath: TruSTAR.PhishingSubmission.submissionId description: The submission ID. type: string - contextPath: TruSTAR.PhishingSubmission.title description: Submission title. type: string - contextPath: TruSTAR.PhishingSubmission.normalizedTriageScore description: Submission triage score. type: number - contextPath: TruSTAR.PhishingSubmission.context.indicatorType description: Indicator type. type: string - contextPath: TruSTAR.PhishingSubmission.context.sourceKey description: Indicator source. type: string - contextPath: TruSTAR.PhishingSubmission.context.normalizedSourceScore description: Indicator score. type: number - contextPath: TruSTAR.PhishingSubmission.context.originalIndicatorScore.name description: Original Indicator score name. type: string - contextPath: TruSTAR.PhishingSubmission.context.originalIndicatorScore.value description: Original Indicator score value. type: string description: Fetches all phishing submissions that fit the given criteria. - name: trustar-set-triage-status arguments: - name: submission_id required: true description: ID of the email submission. - name: status required: true auto: PREDEFINED predefined: - CONFIRMED - IGNORED description: Submission status. description: Marks a phishing email submission with one of the phishing namespace tags. - name: trustar-get-phishing-indicators arguments: - name: normalized_indicator_score description: List of Intel scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. 0,2,3),. isArray: true defaultValue: -1,0,1,2,3 - name: priority_event_score description: List of email submissions scores to restrict the query. Possible values are -1, 0, 1, 2, 3. (i.e. 0,2,3),. isArray: true defaultValue: -1,0,1,2,3 - name: from_time description: Start of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: to_time description: End of time window (format can be absolute like YYYY-MM-DD HH:MM:SS, i.e. 2018-01-01 10:30:00; OR relative, i.e. '10 minutes ago', '5 days ago', etc). Based on updated time, and not created time. Default is 1 day ago. - name: status auto: PREDEFINED predefined: - UNRESOLVED - CONFIRMED - IGNORED description: A list of triage statuses for submissions; only email submissions marked with at least one of these statuses will be returned. Options are 'UNRESOLVED', 'CONFIRMED', 'IGNORED'. isArray: true defaultValue: UNRESOLVED,CONFIRMED,IGNORED - name: limit description: Limit of results to return. Max value possible is 1000. defaultValue: 25 outputs: - contextPath: TruSTAR.PhishingIndicator.indicatorType description: Indicator Type. type: string - contextPath: TruSTAR.PhishingIndicator.normalizedIndicatorScore description: Indicator normalized score. type: number - contextPath: TruSTAR.PhishingIndicator.originalIndicatorScore.name description: Indicator original score name. type: string - contextPath: TruSTAR.PhishingIndicator.originalIndicatorScore.value description: Indicator original score value. type: string - contextPath: TruSTAR.PhishingIndicator.sourceKey description: Indicator source key. type: string - contextPath: TruSTAR.PhishingIndicator.value description: Indicator value. type: string - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA1 hash of the file. type: String - contextPath: IP.Address description: IP address. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: CVE.ID description: 'The ID of the CVE, for example: CVE-2015-1653.' type: String - contextPath: Account.Email.Address description: The email address of the account. type: String - contextPath: RegistryKey.Path description: The path to the registry key. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: DBotScore.Score description: The actual score. type: number description: Get phishing indicators that match the given criteria. runonce: false script: '' type: python subtype: python3 dockerimage: demisto/trustar:20.2.0.2058885 fromversion: 5.0.0 tests: - TruSTAR v2-Test deprecated: true