Report Searches in Demisto

Updated 5 months ago by TruSTAR

In the TruSTAR Workflow App for Demisto, you can search for Intelligence Reports by TruSTAR Report ID or an external ID (such as a JIRA case number), by Indicator, or use filters or search terms.

Get Report Details

Locates a Report by internal TruSTAR Report ID or an external tracking ID.

Format

trustar-report-details

Example
!trustar-report-details report_id=3ad75dfb-72a1-42fc-9780-xxxxxxxx
Inputs

Argument

Description

Required

report_id

Finds a Report by its internal or external id.

Yes

id_type

Type of report ID

No

Outputs

Path

Type

Description

TruSTAR.Report.title

string

Title of the Report

TruSTAR.Report.reportBody

string

Body of the Report

TruSTAR.Report.id

string

ID of the Report

Search by Indicators

This command returns a list of all Reports that contain any of the specified Indicators.

Format

trustar-correlated-reports

Example
!trustar-correlated-reports indicators=WANNACRY,COVID-19
Inputs

Argument

Description

Required

indicators

Comma-separated Indicators. These can be any of the Indicators supported by TruSTAR.

Yes

distribution_type

Distribution type of the Report. Legal values are COMMUNITY or ENCLAVE (the default).

No

enclave-ids

Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

No

limit

Limit of results to return. Max value possible is 1000.

Default value is 25.

No

Output

The list of correlated Intel Reports.

Using Filters

Returns all Reports matching the specified filters. All parameters are optional.

Format

trustar-get-reports

Example
!trustar-get-reports distribution_type=ENCLAVE enclave_ids=xxxxxxx.yyyyyyyyy.zzzzzz from_time="1 day ago"
Inputs

Argument

Description

Required

from_time

Start of time window. Legal formats are

  • ISO 8601 (YYYY-MM-DD HH:MM:SS
  • Relative time LAST <##> <time period> where an example is LAST 1 MONTH

Default is the last 24 hours.

No

to_time

End of time window. Legal formats are

  • ISO 8601 (YYYY-MM-DD HH:MM:SS
  • Relative time LAST <##> <time period> where an example is LAST 1 MONTH

Default is the current time.

No

distribution_type

Distribution type of the report. Legal values are COMMUNITY or ENCLAVE (the default).

No

enclave_ids

Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

No

tags

List of tags to use when searching for Reports; only Reports containing ALL of these tags will be returned.

No

excluded_tags

Reports containing ANY of these tags will be excluded from the results

No

Outputs

If no arguments are specified, the most recent 25 Intel Reports will be returned. This matches the view you would see in the TruSTAR Web App.

Path

Type

Description

TruSTAR.Report.title

string

Title of the Report

TruSTAR.Report.reportBody

string

Body of the Report

TruSTAR.Report.id

string

ID of the Report

Using Search Terms

Searches for all Reports that contain the given search term. You can only specify one search term per command.

Format

trustar-search-reports

Example

!trustar-search-reports search_term=8.8.8.1

Inputs

Argument

Description

Required

search_term

The term to search for (e.g. WANNACRY) If empty, no search term will be applied. Otherwise, must be at least 3 characters.

No

enclave_ids

Comma-separated list of Enclave IDs to search.

If no argument is specified, the default is to search all Enclaves which you have Read access to in TruSTAR.

No

Outputs

Path

Type

Description

TruSTAR.Report.title

string

ID of the Report

TruSTAR.Report.id

string

Title of the Report


How Did We Do?