category: Data Enrichment & Threat Intelligence sectionorder: - Connect - Collect provider: CrowdStrike commonfields: id: Twinwave version: -1 configuration: - display: Fetch incidents name: isFetch type: 8 required: false section: Collect - display: Incident type name: incidentType type: 13 required: false section: Collect - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 advanced: true section: Collect - display: Twinwave API token name: api-token required: true type: 4 section: Connect - defaultvalue: "10" display: Number of jobs to first fetch name: first_fetch type: 0 required: false section: Collect - defaultvalue: '50' display: Max Fetch name: max_fetch type: 0 required: false section: Collect - defaultvalue: all display: Filter incidents by submission source. name: source options: - all - ui - api type: 15 required: false section: Collect - display: Filter UI incidents by username. Exact match only. (Cannot use if source is all or api) name: username type: 0 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect description: TwinWave’s threat analysis platform analyzes both URLs and files to detect credential phishing and malware threats. Our platform automatically navigates complex attack chains that attackers put in front of threats in order to evade analysis. In addition to detecting threats, the TwinWave platform generates actionable intelligence for threat hunting and other activities. display: Twinwave name: Twinwave script: commands: - arguments: - description: The target URL to visit and analyze. Unlike the UI, the API does not automatically un-defang the submitted URL. name: url required: true - description: 'Array of strings (EngineName). List of engines to be used during the analysis. If you''d like to use the default Engines for your account, omit this field or specify the empty array []. ' name: engines isArray: true - description: 'Optional list of parameters to customize behavior during analysis of the job. (E.g., passwords for archives.) {"archive_document_password": "", "decode_rewritten_urls": "true/false"}.' name: parameters - defaultValue: "10" description: The job's priority relative to other jobs. Jobs with a lower priority value are processed before those with a higher value. (e.g., a priority=1 job will be processed before a priority=2 job.) Valid priority values are between 1 and 255. You may omit this field, in which case a default priority (10) is used. name: priority - description: An optional profile name that defines the analysis behavior to be used during the analysis for this job. Profiles names map to behaviors like identifying what collection of engines will be used. If no profile name is submitted the system will use the default profile. name: profile description: Submit New URL for Scanning. name: twinwave-submit-url outputs: - contextPath: Twinwave.Submissions.JobID description: Job ID. type: Unknown - arguments: - name: entry_id required: true description: The entry id of the File. - description: 'Array of strings (EngineName). List of engines to be used during the analysis. If you''d like to use the default Engines for your account, omit this field or specify the empty array []. ' name: engines isArray: true - defaultValue: "10" description: The job's priority relative to other jobs. Jobs with a lower priority value are processed before those with a higher value. (e.g., a priority=1 job will be processed before a priority=2 job.) Valid priority values are between 1 and 255. You may omit this field, in which case a default priority (10) is used. name: priority - description: An optional profile name that defines the analysis behavior to be used during the analysis for this job. Profiles names map to behaviors like identifying what collection of engines will be used. If no profile name is submitted the system will use the default profile. name: profile description: Submit File for Scanning. name: twinwave-submit-file outputs: - contextPath: Twinwave.Submissions.JobID description: Job ID. type: Unknown - arguments: [] description: Resubmit a Job. name: twinwave-resubmit-job outputs: - contextPath: Twinwave.Submissions.JobID description: Job ID. type: Unknown - arguments: - name: job_id required: true description: the job ID. description: Get Job Summary. name: twinwave-get-job-summary outputs: - contextPath: Twinwave.JobSummary description: Twinwave Job Summary. type: Unknown - contextPath: Twinwave.JobSummary.ID description: Job ID. type: Unknown - contextPath: Twinwave.JobSummary.Tasks.ID description: Task ID. type: Unknown - contextPath: Twinwave.JobSummary.Tasks.JobID description: Job ID associated to the task. type: Unknown - arguments: - name: job_id required: true description: The job ID. description: Get a Job's Normalized Forensics. name: twinwave-get-job-normalized-forensics outputs: - contextPath: Twinwave.JobNormalizedForensics description: Twinwave Job Normalized Forensics. type: Unknown - contextPath: Twinwave.JobNormalizedForensics.JobID description: Job ID. type: Unknown - arguments: - name: job_id required: true description: The job ID. - name: task_id required: true description: The task ID. description: Get a Task's Normalized Forensics. name: twinwave-get-task-normalized-forensics outputs: - contextPath: Twinwave.TaskNormalizedForensics description: Twinwave Task Normalized Forensics. type: Unknown - contextPath: Twinwave.TaskNormalizedForensics.TaskID description: Task ID. type: Unknown - contextPath: Twinwave.TaskNormalizedForensics.JobID description: Job ID. type: Unknown - arguments: - name: job_id required: true description: The job ID. - name: task_id required: true description: The task ID. description: Get a Task's Raw Forensics. name: twinwave-get-task-raw-forensics outputs: - contextPath: Twinwave.TaskRawForensics description: Twinwave Task Raw Forensics. type: Unknown - contextPath: Twinwave.TaskRawForensics.JobID description: Job ID. type: Unknown - contextPath: Twinwave.TaskRawForensics.TaskID description: Task ID. type: Unknown - arguments: - name: job_id required: true description: The job ID. - name: sha256 required: true description: The File sha256. description: "Download the Submitted Resource. \n\nDownload a password-protected Zip archive of the Resource. Use the password 'infected' to decrypt the archive.\n\nAll Resources discovered during the analysis are available for download via this endpoint. To get the list of SHA256s for the Job's Resources, see The Resources array from Get a Job Summary." name: twinwave-download-submitted-resource outputs: - contextPath: File.Name description: Name of the file. type: Unknown - contextPath: File.EntryID description: Entry ID of the file. type: Unknown - arguments: [] description: List Available Engines. name: twinwave-get-engines outputs: - contextPath: Twinwave.Engines description: Available Engines. type: Unknown - contextPath: Twinwave.Engines.Name description: Name of the engine. type: Unknown - contextPath: Twinwave.Engines.DefaultEnabled description: Default Enabled (True/False). type: Unknown - contextPath: Twinwave.Engines.SupportedTypes description: Supported Types. type: Unknown - arguments: - description: Specify the string to search for in the specified field. (E.g. .exe or example.com). name: term - description: 'Enum: "filename" "url" "tag" "sha256" "md5".' name: field - description: 'Enum: "exact" "substring".' name: type - description: Specify the maximum number of results to be returned. This has a hard limit of 100; specifying a number greater than that will result in a 400 Bad Request and the search will not be performed. name: count - description: Specify true to only search across Jobs (and their Resources) which have been shared. name: shared_only - description: Specify a username or part of a username (e.g. alice@example.com or alice) to only search across Jobs (and their Resources) submitted by the matching user. name: submitted_by - description: Specify the maximum number of days back to search for results. Specify 0 for no limit. For example, setting this to 7 returns results within the last week. name: timeframe - description: The page for which you want results. This defaults to 1 the first page. See HasNext in the response of your search to know whether or not there are more pages for your search criteria. name: page description: Search Across Jobs and Resources. name: twinwave-search-across-jobs-and-resources outputs: - contextPath: Twinwave.JobsAndResources description: Jobs and Resources. type: Unknown - contextPath: Twinwave.JobsAndResources.Jobs description: Job Details. type: Unknown - contextPath: Twinwave.JobsAndResources.Jobs.ID description: Job ID. type: Unknown - arguments: - description: |- Throughout the analysis of a Resource, a variety of Artifacts may be generated. These include things like Screenshots, PCAPs, HAR files, etc. This API endpoint generates a temporary URL that can be used to download the contents of an artifact. After making a call to this endpoint, the URL field will contain a link to a signed URL for the desired Artifact. This link has a limited lifetime, so upon receiving it, you should immediately make a GET request to retrieve the actual Artifact. name: path required: true description: Get a Temporary Artifact URL. name: twinwave-get-temp-artifact-url outputs: - contextPath: Twinwave.TempArtifactURL.URL description: Temporary URL. type: Unknown dockerimage: demisto/python3:3.12.8.3296088 isfetch: true script: '' subtype: python3 type: python fromversion: 6.0.0 tests: - No tests (auto formatted)