category: Data Enrichment & Threat Intelligence provider: Palo Alto Networks sectionorder: - Connect - Collect commonfields: id: Unit 42 Intelligence version: -1 configuration: - display: Source Reliability name: integration_reliability additionalinfo: Reliability of the source providing the intelligence data. type: 15 options: - A++ - Reputation script - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged defaultvalue: A++ - Reputation script required: false section: Collect advanced: true - display: Create relationships name: create_relationships additionalinfo: Create relationships between indicators and threat objects type: 8 defaultvalue: 'true' required: false section: Collect advanced: true - display: Create threat objects as separate indicators name: create_threat_object_indicators additionalinfo: Whether to create threat objects (malware families, actors, campaigns, etc.) as separate indicators type: 8 defaultvalue: 'true' required: false section: Collect advanced: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect advanced: true - display: Use system proxy settings name: proxy type: 8 required: false section: Connect advanced: true description: Enrich indicators with Unit 42 threat intelligence context including verdicts, threat object associations, and relationships. display: Unit 42 Intelligence name: Unit 42 Intelligence script: commands: - arguments: - description: IP address to enrich. name: ip required: true default: true isArray: true description: Enrich an IP address with Unit 42 threat intelligence context. name: ip outputs: - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.Malicious.Vendor description: The vendor reporting the IP as malicious. type: String - contextPath: IP.Malicious.Description description: Description of the malicious IP. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Unit42.IP.Value description: The IP address. type: String - contextPath: Unit42.IP.Type description: The indicator type. type: String - contextPath: Unit42.IP.Counts description: Counts. type: Unknown - contextPath: Unit42.IP.Verdict description: The verdict for the IP. type: String - contextPath: Unit42.IP.VerdictCategory description: The verdict category. type: Unknown - contextPath: Unit42.IP.FirstSeen description: First seen date. type: Date - contextPath: Unit42.IP.LastSeen description: Last seen date. type: Date - contextPath: Unit42.IP.SeenBy description: Sources that have seen this IP. type: Unknown - contextPath: Unit42.IP.EnrichedThreatObjectAssociation description: Enriched threat object association. type: Unknown - arguments: - description: Domain to enrich. name: domain default: true required: true isArray: true description: Enrich a domain with Unit 42 threat intelligence context. name: domain outputs: - contextPath: Domain.Name description: The domain name. type: String - contextPath: Domain.Malicious.Vendor description: The vendor reporting the domain as malicious. type: String - contextPath: Domain.Malicious.Description description: Description of the malicious domain. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Unit42.Domain.Value description: The domain name. type: String - contextPath: Unit42.Domain.Type description: The indicator type. type: String - contextPath: Unit42.Domain.Counts description: Counts. type: Unknown - contextPath: Unit42.Domain.Verdict description: The verdict for the domain. type: String - contextPath: Unit42.Domain.VerdictCategory description: The verdict category. type: Unknown - contextPath: Unit42.Domain.FirstSeen description: First seen date. type: Date - contextPath: Unit42.Domain.LastSeen description: Last seen date. type: Date - contextPath: Unit42.Domain.SeenBy description: Sources that have seen this domain. type: Unknown - contextPath: Unit42.Domain.EnrichedThreatObjectAssociation description: Enriched threat object association. type: Unknown - arguments: - description: URL to enrich. name: url default: true required: true isArray: true description: Enrich a URL with Unit 42 threat intelligence context. name: url outputs: - contextPath: URL.Data description: The URL. type: String - contextPath: URL.Malicious.Vendor description: The vendor reporting the URL as malicious. type: String - contextPath: URL.Malicious.Description description: Description of the malicious URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Unit42.URL.Value description: The URL. type: String - contextPath: Unit42.URL.Type description: The indicator type. type: String - contextPath: Unit42.URL.Counts description: Counts. type: Unknown - contextPath: Unit42.URL.Verdict description: The verdict for the URL. type: String - contextPath: Unit42.URL.VerdictCategory description: The verdict category. type: Unknown - contextPath: Unit42.URL.FirstSeen description: First seen date. type: Date - contextPath: Unit42.URL.LastSeen description: Last seen date. type: Date - contextPath: Unit42.URL.SeenBy description: Sources that have seen this URL. type: Unknown - contextPath: Unit42.URL.EnrichedThreatObjectAssociation description: Enriched threat object association. type: Unknown - arguments: - description: File hash to enrich (SHA256). name: file default: true required: true isArray: true description: Enrich a file hash with Unit 42 threat intelligence context. name: file outputs: - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Malicious.Vendor description: The vendor reporting the file as malicious. type: String - contextPath: File.Malicious.Description description: Description of the malicious file. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: Unit42.File.Value description: The file hash. type: String - contextPath: Unit42.File.Type description: The indicator type. type: String - contextPath: Unit42.File.Counts description: Counts. type: Unknown - contextPath: Unit42.File.Verdict description: The verdict for the file. type: String - contextPath: Unit42.File.VerdictCategory description: The verdict category. type: Unknown - contextPath: Unit42.File.FirstSeen description: First seen date. type: Date - contextPath: Unit42.File.LastSeen description: Last seen date. type: Date - contextPath: Unit42.File.SeenBy description: Sources that have seen this file. type: Unknown - contextPath: Unit42.File.EnrichedThreatObjectAssociation description: Enriched threat object association. type: Unknown dockerimage: demisto/python3:3.12.13.10404775 runonce: false script: '-' subtype: python3 type: python tests: - Unit 42 Intelligence Test fromversion: 6.10.0