category: Data Enrichment & Threat Intelligence provider: Accenture commonfields: id: iDefense_v2 version: -1 configuration: - display: URL name: url defaultvalue: https://api.intelgraph.idefense.com/ type: 0 required: true - displaypassword: API Token name: api_token type: 9 required: true hiddenusername: true - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: use_proxy type: 8 required: false description: Deprecated. Use Accenture CTI v2 instead. display: Accenture CTI (Deprecated) name: iDefense_v2 deprecated: true script: commands: - name: ip arguments: - name: ip default: true description: IP address to check. isArray: true outputs: - contextPath: IP.Address description: The IP address that was checked. type: String - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: String - contextPath: IP.Malicious.Description description: For malicious IP addresses, the reason the vendor made that decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor that was used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: String description: Checks the reputation of the given IP address. - name: domain arguments: - name: domain default: true description: The domain to check. isArray: true outputs: - contextPath: Domain.Name description: The name of the domain that was checked. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason the vendor made that decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Checks the reputation of the given domain. - name: url arguments: - name: url default: true description: The URL to check (must start with "http://"). isArray: true outputs: - contextPath: URL.Data description: The URL that was checked. type: String - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: String - contextPath: URL.Malicious.Description description: For malicious URLs, the reason the vendor made that decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Checks the reputation of the given URL. - name: idefense-get-ioc-by-uuid arguments: - name: uuid required: true description: Unique User ID. outputs: - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.Malicious.Vendor description: For malicious IP addresses, the vendor that made the decision. type: String - contextPath: IP.Malicious.Description description: For malicious IP addresses, the reason the vendor made that decision. type: String - contextPath: Domain.Name description: The domain name. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason the vendor made that decision. type: String - contextPath: URL.Data description: The URL. type: String - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision. type: String - contextPath: URL.Malicious.Description description: For malicious URLs, the reason the vendor made that decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number description: Get specific indicator reputation dockerimage: demisto/python3:3.10.1.25933 runonce: false script: '-' subtype: python3 type: python fromversion: 5.5.0 tests: - iDefense_v2_Test