Report Searches in Demisto

Updated 20 hours ago by Elvis Hovor

The TruSTAR Workflow App for Demisto offers these actions you can use when searching for reports.

  • Get Report details, using either a TruSTAR Report ID or an external tracking ID.
  • Search by Indicator
  • Search using filters
  • Search using search terms

Get Report Details

In the TruSTAR App for Demisto, this command finds an Intel Report by internal TruSTAR Report ID or an external tracking ID, such as a JIRA report number.

Format

trustar-report-details

Example

!trustar-report-details report_id=3ad95dfb-72a1-42fc-9780-xxxxxxxx

Inputs

Argument

Description

Required

report_id

Finds a report by its internal or external id.

Yes

id_type

Type of report ID

No

Outputs

Path

Type

Description

TruSTAR.Report.title

string

Title of the report

TruSTAR.Report.reportBody

string

Body of the report

TruSTAR.Report.id

string

ID of the report

Search by Indicators

This command returns a list of all Intel Reports that contain any of the specified Indicators.

Format

trustar-correlated-reports

Example

!trustar-correlated-reports indicators=WANNACRY,COVID-19

Inputs

Argument

Description

Required

indicators

Comma-separated Indicators. These can be any of the Indicators supported by TruSTAR.

Yes

distribution_type

Distribution type of the report. Legal values are COMMUNITY or ENCLAVE (the default).

No

enclave-ids

Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

No

limit

Limit of results to return. Max value possible is 1000.

Default value is 25.

No

Output

The list of correlated Intel Reports.

Search Using Filters

In the TruSTAR App for Demisto, this command returns Intel Reports matching the specified filters. All parameters are optional.

Format

trustar-get-reports

Example

!trustar-get-reports distribution_type=ENCLAVE enclave_ids=xxxxxxx.yyyyyyyyy.zzzzzz from_time="1 day ago"

Inputs

Argument

Description

Required

from_time

Start of time window. Legal formats are

  • ISO 8601 (YYYY-MM-DD HH:MM:SS
  • Relative time LAST <##> <time period> where an example is LAST 1 MONTH

Default is the last 24 hours.

No

to_time

End of time window. Legal formats are

  • ISO 8601 (YYYY-MM-DD HH:MM:SS
  • Relative time LAST <##> <time period> where an example is LAST 1 MONTH

Default is the current time.

No

distribution_type

Distribution type of the report. Legal values are COMMUNITY or ENCLAVE (the default).

No

enclave_ids

Comma-separated list of Enclave IDs to search. Even if distributionType is COMMUNITY, these enclaves will still be searched as well.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

No

tags

List of tags to use when searching for Intel Reports; only Intel Reports containing ALL of these tags will be returned.

No

excluded_tags

Intel Reports containing ANY of these tags will be excluded from the results

No

Outputs

If no arguments are specified, the most recent 25 Intel Reports will be returned. This matches the view you would see in the TruSTAR Web App.

Path

Type

Description

TruSTAR.Report.title

string

Title of the report

TruSTAR.Report.reportBody

string

Body of the report

TruSTAR.Report.id

string

ID of the report

Search Using Search Terms

This command searches for all Intel Reports that contain the given search term.

Format

trustar-search-reports

Example

!trustar-search-reports search_term=8.8.8.1

Inputs

Argument

Description

Required

search_term

The term to search for (e.g. WANNACRY) If empty, no search term will be applied. Otherwise, must be at least 3 characters.

No

enclave_ids

Comma-separated list of Enclave IDs to search.

If no argument is specified, the default is to search all enclaves which you have Read access to in TruSTAR.

No

Outputs

Path

Type

Description

TruSTAR.Report.title

string

ID of the report

TruSTAR.Report.id

string

Title of the report


How Did We Do?