commonfields:
  id: PTEnrich
  version: -1
name: PTEnrich
script: ''
type: javascript
tags:
- passive-total
- server
- threat-intel
comment: Deprecated. No available replacement. Enrich the given IP or domain with
  metadata, malware, osint.
system: true
args:
- name: query
  required: true
  default: true
  description: The IP or domain to enrich
outputs:
- contextPath: subdomains
  description: List of subdomains as strings
- contextPath: Domain.Name
  description: The name of the queries domain
- contextPath: Domain.DNS.Address
  description: The resolved address of the domain
- contextPath: passivetotal.whois.email
  description: Contact email for the queried domain
- contextPath: passivetotal.resolves
  description: The various resolves from the passive DNS collection
- contextPath: IP.Address
  description: Bad IPs found during enrichment
- contextPath: IP.Malicious.Vendor
  description: For malicious IPs, the vendor that made the decision
- contextPath: IP.Malicious.Description
  description: For malicious IPs, the reason for the vendor to make the decision
- contextPath: Domain.Name
  description: Bad domains found during enrichment
- contextPath: Domain.Malicious.Vendor
  description: For malicious domains, the vendor that made the decision
- contextPath: Domain.Malicious.Description
  description: For malicious domains, the reason for the vendor to make the decision
- contextPath: File.MD5
  description: Bad hash MD5
- contextPath: File.SHA1
  description: Bad hash SHA1
- contextPath: File.SHA256
  description: Bad hash SHA256
- contextPath: File.Malicious.Vendor
  description: For malicious files, the vendor that made the decision
- contextPath: File.Malicious.Description
  description: For malicious files, the reason for the vendor to make the decision
- contextPath: DBotScore.Indicator
  description: The indicator we tested
- contextPath: DBotScore.Type
  description: The type of the indicator
- contextPath: DBotScore.Vendor
  description: Vendor used to calculate the score
- contextPath: DBotScore.Score
  description: The actual score
scripttarget: 0
dependson:
  must:
  - pt-enrichment
  - pt-malware
  - pt-osint
  - pt-get-subdomains
  - pt-passive-dns
  - pt-whois
  - pt-ssl-cert
timeout: 0s
tests:
- No test
fromversion: 5.0.0
deprecated: true