Report Searches in Demisto
Updated 8 months ago
by
TruSTAR
In the TruSTAR Workflow App for Demisto, you can search for Intelligence Reports by TruSTAR Report ID or an external ID (such as a JIRA case number), by Indicator, or use filters or search terms.
Get Report Details
Locates a Report by internal TruSTAR Report ID or an external tracking ID.
Format
trustar-report-details
Example
!trustar-report-details report_id=3ad75dfb-72a1-42fc-9780-xxxxxxxx
Inputs
Argument | Description | Required |
report_id | Finds a Report by its internal or external id. | Yes |
id_type | Type of report ID | No |
Outputs
Path | Type | Description |
TruSTAR.Report.title | string | Title of the Report |
TruSTAR.Report.reportBody | string | Body of the Report |
TruSTAR.Report.id | string | ID of the Report |
Search by Indicators
This command returns a list of all Reports that contain any of the specified Indicators.
Format
trustar-correlated-reports
Example
!trustar-correlated-reports indicators=WANNACRY,COVID-19
Inputs
Argument | Description | Required |
indicators | Comma-separated Indicators. These can be any of the Indicators supported by TruSTAR. | Yes |
distribution_type | Distribution type of the Report. Legal values are COMMUNITY or ENCLAVE (the default). | No |
enclave-ids | Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well. If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR. | No |
limit | Limit of results to return. Max value possible is 1000. Default value is 25. | No |
Output
The list of correlated Intel Reports.
Using Filters
Returns all Reports matching the specified filters. All parameters are optional.
Format
trustar-get-reports
Example
!trustar-get-reports distribution_type=ENCLAVE enclave_ids=xxxxxxx.yyyyyyyyy.zzzzzz from_time="1 day ago"
Inputs
Argument | Description | Required |
from_time | Start of time window. Legal formats are
Default is the last 24 hours. | No |
to_time | End of time window. Legal formats are
Default is the current time. | No |
distribution_type | Distribution type of the report. Legal values are COMMUNITY or ENCLAVE (the default). | No |
enclave_ids | Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well. If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR. | No |
tags | List of tags to use when searching for Reports; only Reports containing ALL of these tags will be returned. | No |
excluded_tags | Reports containing ANY of these tags will be excluded from the results | No |
Outputs
If no arguments are specified, the most recent 25 Intel Reports will be returned. This matches the view you would see in the TruSTAR Web App.
Path | Type | Description |
TruSTAR.Report.title | string | Title of the Report |
TruSTAR.Report.reportBody | string | Body of the Report |
TruSTAR.Report.id | string | ID of the Report |
Using Search Terms
Searches for all Reports that contain the given search term. You can only specify one search term per command.
Format
trustar-search-reports
Example
!trustar-search-reports search_term=8.8.8.1
Inputs
Argument | Description | Required |
search_term | The term to search for (e.g. WANNACRY) If empty, no search term will be applied. Otherwise, must be at least 3 characters. | No |
enclave_ids | Comma-separated list of Enclave IDs to search. If no argument is specified, the default is to search all Enclaves which you have Read access to in TruSTAR. | No |
Outputs
Path | Type | Description |
TruSTAR.Report.title | string | ID of the Report |
TruSTAR.Report.id | string | Title of the Report |
