Indicator Retrieval in Demisto
The TruSTAR Workflow App for Demisto supports these actions for retrieving Indicators from TruSTAR:
- Fetch Indicator Information
- Fetch Indicator Metadata
- Fetch Trending Indicators
Fetch Indicator Information
This command provides structured summaries about Indicators, which are derived from external intelligence sources available on the TruSTAR Marketplace.
Format
trustar-indicator-summaries
Example
!trustar-indicator-summaries values=LOCKY,23.121.54.102
Inputs
Argument | Description | Required |
values | Comma-separated Indicator values. | Yes |
enclave_ids | The Enclaves where you want to search for indicators. These should be Enclaves containing data from sources on the TruSTAR Marketplace. Finding Enclave IDs | No |
limit | Limit of results to return. Max value possible is 1000. Default value is 25. | No |
Outputs
Path | Type | Description |
TruSTAR.IndicatorSummaries.severityLevel | string | Indicator severity level |
TruSTAR.IndicatorSummaries.reportId | string | Indicator report ID |
TruSTAR.IndicatorSummaries.value | string | Indicator value |
TruSTAR.IndicatorSummaries.score.name | string | Indicator score name |
TruSTAR.IndicatorSummaries.score.value | string | Indicator score value |
TruSTAR.IndicatorSummaries.attributes | string | Indicator attributes |
TruSTAR.IndicatorSummaries.enclaveId | string | Indicator enclave ID |
TruSTAR.IndicatorSummaries.type | string | Indicator type |
TruSTAR.IndicatorSummaries.source.key | string | Indicator source key |
TruSTAR.IndicatorSummaries.source.name | string | Indicator source name |
TruSTAR.IndicatorSummaries.updated | string | Indicator last update value |
File.Name | string | The full file name |
<indicator> | String | |
DBotScore.Indicator | string | The indicator we tested |
DBotScore.Type | string | The type of the indicator |
DBotScore.Vendor | string | Vendor used to calculate the score |
DBotScore.Score | number | The actual score |
Fetch Indicator Metadata
This command returns the metadata associated with a list of Indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags.
Format
trustar-indicators-metadata
Example
!trustar-indicators-metadata indicators=37.26.xx.yyy
Inputs
Argument | Description | Required |
indicators | Comma-separated Indicators. Supported Indicators | Yes |
enclave_ids | List of enclave IDs to search. The default is to search all Enclaves that you have read access to. Finding Enclave IDs | No |
Outputs
Path | Type | Description |
TruSTAR.IndicatorsMetadata.notes | string | Indicator notes |
TruSTAR.IndicatorsMetadata.indicatorType | string | Indicator type |
TruSTAR.IndicatorsMetadata.firstSeen | Date | Indicator first seen value |
TruSTAR.IndicatorsMetadata.correlationCount | Number | Indicator correlation count |
TruSTAR.IndicatorsMetadata.value | string | Indicator value |
TruSTAR.IndicatorsMetadata.lastSeen | Date | Indicator last seen value |
TruSTAR.IndicatorsMetadata.tags | string | Indicator tags |
TruSTAR.IndicatorsMetadata.enclaveIds | string | Enclave IDs where indicator is present |
File.Name | string | The full file name (including file extension). |
<indicator> | string | |
DBotScore.Indicator | string | The indicator we tested |
DBotScore.Type | string | The type of the indicator |
DBotScore.Vendor | string | Vendor used to calculate the score |
DBotScore.Score | number | The actual score |
Fetch Trending Indicators
This command returns the ten Indicators that have most recently appeared in TruSTAR Community Intel Reports. This is the same list you would see in the Community Trends section of the dashboard on the TruSTAR Web App.
Format
trustar-trending-indicators
Example
!trustar-trending-indicators indicator_type=MALWARE days_back=5
Inputs
Argument | Description | Required |
indicator_type | The types of indicators to be returned. If other, then all supported indicators except for CVE and MALWARE will be returned. | No |
days_back | The number of days back to count correlations for. Legal value is an integer between 1 and 30. The default value is 30. | No |
Outputs
Path | Type | Description |
TruSTAR.Indicators.correlationCount | Number | Indicator correlation count |
TruSTAR.Indicators.indicatorType | string | Indicator type |
TruSTAR.Indicators.value | string | Indicator value |
File.Name | string | The full file name |
<Indicator> | string | |
DBotScore.Indicator | string | The indicator we tested |
DBotScore.Type | string | The type of the indicator |
DBotScore.Vendor | string | Vendor used to calculate the score |
DBotScore.Score | number | The actual score |
