Indicator Retrieval in Demisto

Updated 5 days ago by Elvis Hovor

The TruSTAR Workflow App for Demisto supports these actions for retrieving Indicators from TruSTAR:

  • Fetch Indicator Information
  • Fetch Indicator Metadata
  • Fetch Trending Indicators

Fetch Indicator Information

This command provides structured summaries about Indicators, which are derived from external intelligence sources available on the TruSTAR Marketplace.

Format

trustar-indicator-summaries

Example

!trustar-indicator-summaries values=LOCKY,23.121.54.102

Inputs

Argument

Description

Required

values

Comma-separated Indicator values.

Supported Indicators

Yes

enclave_ids

The Enclaves where you want to search for indicators. These should be Enclaves containing data from sources on the TruSTAR Marketplace. Finding Enclave IDs

No

limit

Limit of results to return. Max value possible is 1000.

Default value is 25.

No

Outputs

Path

Type

Description

TruSTAR.IndicatorSummaries.severityLevel

string

Indicator severity level

TruSTAR.IndicatorSummaries.reportId

string

Indicator report ID

TruSTAR.IndicatorSummaries.value

string

Indicator value

TruSTAR.IndicatorSummaries.score.name

string

Indicator score name

TruSTAR.IndicatorSummaries.score.value

string

Indicator score value

TruSTAR.IndicatorSummaries.attributes

string

Indicator attributes

TruSTAR.IndicatorSummaries.enclaveId

string

Indicator enclave ID

TruSTAR.IndicatorSummaries.type

string

Indicator type

TruSTAR.IndicatorSummaries.source.key

string

Indicator source key

TruSTAR.IndicatorSummaries.source.name

string

Indicator source name

TruSTAR.IndicatorSummaries.updated

string

Indicator last update value

File.Name

string

The full file name

<indicator>

String

Supported Indicators

DBotScore.Indicator

string

The indicator we tested

DBotScore.Type

string

The type of the indicator

DBotScore.Vendor

string

Vendor used to calculate the score

DBotScore.Score

number

The actual score

Fetch Indicator Metadata

This command returns the metadata associated with a list of Indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags.

Format

trustar-indicators-metadata

Example

!trustar-indicators-metadata indicators=37.26.xx.yyy

Inputs

Argument

Description

Required

indicators

Comma-separated Indicators. Supported Indicators

Yes

enclave_ids

List of enclave IDs to search. The default is to search all Enclaves that you have read access to. Finding Enclave IDs

No

Outputs

Path

Type

Description

TruSTAR.IndicatorsMetadata.notes

string

Indicator notes

TruSTAR.IndicatorsMetadata.indicatorType

string

Indicator type

TruSTAR.IndicatorsMetadata.firstSeen

Date

Indicator first seen value

TruSTAR.IndicatorsMetadata.correlationCount

Number

Indicator correlation count

TruSTAR.IndicatorsMetadata.value

string

Indicator value

TruSTAR.IndicatorsMetadata.lastSeen

Date

Indicator last seen value

TruSTAR.IndicatorsMetadata.tags

string

Indicator tags

TruSTAR.IndicatorsMetadata.enclaveIds

string

Enclave IDs where indicator is present

File.Name

string

The full file name (including file extension).

<indicator>

string

Supported Indicators

DBotScore.Indicator

string

The indicator we tested

DBotScore.Type

string

The type of the indicator

DBotScore.Vendor

string

Vendor used to calculate the score

DBotScore.Score

number

The actual score

This command returns the ten Indicators that have most recently appeared in TruSTAR Community Intel Reports. This is the same list you would see in the Community Trends section of the dashboard on the TruSTAR Web App.

Format

trustar-trending-indicators

Example

!trustar-trending-indicators indicator_type=MALWARE days_back=5

Inputs

Argument

Description

Required

indicator_type

The types of indicators to be returned. If other, then all supported indicators except for CVE and MALWARE will be returned.

No

days_back

The number of days back to count correlations for. Legal value is an integer between 1 and 30.

The default value is 30.

No

Outputs

Path

Type

Description

TruSTAR.Indicators.correlationCount

Number

Indicator correlation count

TruSTAR.Indicators.indicatorType

string

Indicator type

TruSTAR.Indicators.value

string

Indicator value

File.Name

string

The full file name

<Indicator>

string

Supported Indicators

DBotScore.Indicator

string

The indicator we tested

DBotScore.Type

string

The type of the indicator

DBotScore.Vendor

string

Vendor used to calculate the score

DBotScore.Score

number

The actual score


How Did We Do?