diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json new file mode 100644 index 000000000000..6fbe88958aa6 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatscombinedcount", + "version": -1, + "name": "DomainToolsFeed IP All Threats Combined Count", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatscombinedcount", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json new file mode 100644 index 000000000000..9e44a1101880 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatscombinedpercent", + "version": -1, + "name": "DomainToolsFeed IP All Threats Combined Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatscombinedpercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json new file mode 100644 index 000000000000..7e04e8107a0a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatsperecent", + "version": -1, + "name": "DomainToolsFeed IP All Threats Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatsperecent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json new file mode 100644 index 000000000000..222ddbd71c8a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipasn", + "version": -1, + "name": "DomainToolsFeed IP ASN", + "ownerOnly": false, + "cliName": "domaintoolsfeedipasn", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json new file mode 100644 index 000000000000..95f8c909eb5f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipbadpdnsresolutions", + "version": -1, + "name": "DomainToolsFeed IP Bad PDNS Resolutions", + "ownerOnly": false, + "cliName": "domaintoolsfeedipbadpdnsresolutions", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json new file mode 100644 index 000000000000..86369d40e949 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcity", + "version": -1, + "name": "DomainToolsFeed IP City", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcity", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json new file mode 100644 index 000000000000..1121545d72c5 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedmalwarepercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Malware Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedmalwarepercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json new file mode 100644 index 000000000000..151cacf0222f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedphishingpercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Phishing Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedphishingpercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json new file mode 100644 index 000000000000..e218b79ab38b --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedspampercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Spam Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedspampercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json new file mode 100644 index 000000000000..c4467ee619e2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedmalware", + "version": -1, + "name": "DomainToolsFeed IP Compromised Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json new file mode 100644 index 000000000000..a0817094d3b0 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedphishing", + "version": -1, + "name": "DomainToolsFeed IP Compromised Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json new file mode 100644 index 000000000000..ba8c7a27640e --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedspam", + "version": -1, + "name": "DomainToolsFeed IP Compromised Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json new file mode 100644 index 000000000000..ca81f7231429 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcountry", + "version": -1, + "name": "DomainToolsFeed IP Country", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcountry", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json new file mode 100644 index 000000000000..293769403f83 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipfeedtimestamp", + "version": -1, + "name": "DomainToolsFeed IP Feed Timestamp", + "ownerOnly": false, + "cliName": "domaintoolsfeedipfeedtimestamp", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json new file mode 100644 index 000000000000..47347920aa33 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediplatitude", + "version": -1, + "name": "DomainToolsFeed IP Latitude", + "ownerOnly": false, + "cliName": "domaintoolsfeediplatitude", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json new file mode 100644 index 000000000000..358e8ee29bb2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediplongitude", + "version": -1, + "name": "DomainToolsFeed IP Longitude", + "ownerOnly": false, + "cliName": "domaintoolsfeediplongitude", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json new file mode 100644 index 000000000000..ade37db0b9eb --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousmalware", + "version": -1, + "name": "DomainToolsFeed IP Malicious Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json new file mode 100644 index 000000000000..daf33efecc7c --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousphishing", + "version": -1, + "name": "DomainToolsFeed IP Malicious Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json new file mode 100644 index 000000000000..10ca1925985d --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousspam", + "version": -1, + "name": "DomainToolsFeed IP Malicious Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json new file mode 100644 index 000000000000..ae5ec2f9aee2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediporganization", + "version": -1, + "name": "DomainToolsFeed IP Organization", + "ownerOnly": false, + "cliName": "domaintoolsfeediporganization", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json new file mode 100644 index 000000000000..b6b0934f2d71 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippdnsresolutions", + "version": -1, + "name": "DomainToolsFeed IP PDNS Resolutions", + "ownerOnly": false, + "cliName": "domaintoolsfeedippdnsresolutions", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json new file mode 100644 index 000000000000..f427f71dc820 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentmalware", + "version": -1, + "name": "DomainToolsFeed IP Percent Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json new file mode 100644 index 000000000000..223da246d416 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentphishing", + "version": -1, + "name": "DomainToolsFeed IP Percent Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json new file mode 100644 index 000000000000..164126c946dd --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentspam", + "version": -1, + "name": "DomainToolsFeed IP Percent Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json new file mode 100644 index 000000000000..c4d8f9d6d2be --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedmalware", + "version": -1, + "name": "DomainToolsFeed IP Predicted Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json new file mode 100644 index 000000000000..0bfa0172089f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedphishing", + "version": -1, + "name": "DomainToolsFeed IP Predicted Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json new file mode 100644 index 000000000000..c5feb6a2cc0e --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedspam", + "version": -1, + "name": "DomainToolsFeed IP Predicted Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json new file mode 100644 index 000000000000..628c66841584 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipthirdpartythreats", + "version": -1, + "name": "DomainToolsFeed IP Third Party Threats", + "ownerOnly": false, + "cliName": "domaintoolsfeedipthirdpartythreats", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json new file mode 100644 index 000000000000..7caccbf08447 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediptotaldomains", + "version": -1, + "name": "DomainToolsFeed IP Total Domains", + "ownerOnly": false, + "cliName": "domaintoolsfeediptotaldomains", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json new file mode 100644 index 000000000000..3f06e9b3c451 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipzerolistdomains", + "version": -1, + "name": "DomainToolsFeed IP Zerolist Domains", + "ownerOnly": false, + "cliName": "domaintoolsfeedipzerolistdomains", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json new file mode 100644 index 000000000000..3b1d3780636a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipzerolistip", + "version": -1, + "name": "DomainToolsFeed IP Zerolist IP", + "ownerOnly": false, + "cliName": "domaintoolsfeedipzerolistip", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json new file mode 100644 index 000000000000..9f57f067d6a6 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json @@ -0,0 +1,18 @@ +{ + "id": "DomainToolsFeed IP", + "version": -1, + "fromVersion": "6.0.0", + "regex": "\\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\\[\\.\\]|\\.)){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\b", + "details": "DomainToolsFeed IP", + "reputationCommand": "ip", + "system": false, + "locked": false, + "disabled": false, + "file": false, + "updateAfter": 0, + "mergeContext": false, + "contextPath": "IP(val.Address \u0026\u0026 val.Address === obj.Address)", + "contextValue": "Address", + "expiration": 10080, + "layout": "DomainToolsFeed IP Indicator" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py index bb9ac3a3ba62..a586b80e5b0f 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py @@ -240,7 +240,7 @@ def build_iterator(self, feed_type: str = "nod", dt_feed_kwargs: dict = {}) -> I if feed_type in (self.IPHOTLIST, self.IPRISK): indicator = json_feed.get("ip") - indicator_type = FeedIndicatorType.IP + indicator_type = "DomainToolsFeed IP" else: indicator = json_feed.get("domain") indicator_type = FeedIndicatorType.Domain @@ -287,8 +287,27 @@ def build_iterator(self, feed_type: str = "nod", dt_feed_kwargs: dict = {}) -> I "pdns_resolutions": json_feed.get("pdns_resolutions"), "bad_pdns_resolutions": json_feed.get("bad_pdns_resolutions"), "total_domains": json_feed.get("total_domains"), - "all_threats_combined_count": json_feed.get("all_threats_combined_count"), + "zerolist_domains": json_feed.get("zerolist_domains"), + "zerolist_ip": json_feed.get("zerolist_ip"), "third_party_threats": json_feed.get("third_party_threats"), + "all_threats_combined_count": json_feed.get("all_threats_combined_count"), + "all_threats_combined_percent": json_feed.get("all_threats_combined_percent"), + "all_threats_percent": json_feed.get("all_threats_percent"), + "combined_phishing_percent": json_feed.get("combined_phishing_percent"), + "combined_malware_percent": json_feed.get("combined_malware_percent"), + "combined_spam_percent": json_feed.get("combined_spam_percent"), + "malicious_phishing": json_feed.get("malicious_phishing"), + "malicious_malware": json_feed.get("malicious_malware"), + "malicious_spam": json_feed.get("malicious_spam"), + "percent_phishing": json_feed.get("percent_phishing"), + "percent_malware": json_feed.get("percent_malware"), + "percent_spam": json_feed.get("percent_spam"), + "compromised_phishing": json_feed.get("compromised_phishing"), + "compromised_malware": json_feed.get("compromised_malware"), + "compromised_spam": json_feed.get("compromised_spam"), + "predicted_phishing": json_feed.get("predicted_phishing"), + "predicted_malware": json_feed.get("predicted_malware"), + "predicted_spam": json_feed.get("predicted_spam"), } dt_feed_data["ip_threat_data"] = ip_threat_data @@ -399,9 +418,52 @@ def fetch_indicators(client: DomainToolsClient, feed_type: str = "nod", dt_feed_ "rawJSON": raw_data, } + if timestamp_ and type_ == "DomainToolsFeed IP": + indicator_obj["fields"]["domaintoolsfeedipfeedtimestamp"] = timestamp_ + if tlp_color_: indicator_obj["fields"]["trafficlightprotocol"] = tlp_color_ + if ip_threat_data_: + indicator_obj["fields"]["domaintoolsfeedipasn"] = ip_threat_data_.get("asn") + indicator_obj["fields"]["domaintoolsfeediporganization"] = ip_threat_data_.get("organization") + indicator_obj["fields"]["domaintoolsfeedipcity"] = ip_threat_data_.get("city") + indicator_obj["fields"]["domaintoolsfeedipcountry"] = ip_threat_data_.get("country") + indicator_obj["fields"]["domaintoolsfeediplatitude"] = ip_threat_data_.get("latitude") + indicator_obj["fields"]["domaintoolsfeediplongitude"] = ip_threat_data_.get("longitude") + indicator_obj["fields"]["domaintoolsfeedippdnsresolutions"] = ip_threat_data_.get("pdns_resolutions") + indicator_obj["fields"]["domaintoolsfeedipbadpdnsresolutions"] = ip_threat_data_.get("bad_pdns_resolutions") + indicator_obj["fields"]["domaintoolsfeediptotaldomains"] = ip_threat_data_.get("total_domains") + indicator_obj["fields"]["domaintoolsfeedipzerolistdomains"] = ip_threat_data_.get("zerolist_domains") + indicator_obj["fields"]["domaintoolsfeedipzerolistip"] = ip_threat_data_.get("zerolist_ip") + indicator_obj["fields"]["domaintoolsfeedipthirdpartythreats"] = ip_threat_data_.get("third_party_threats") + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedcount"] = ip_threat_data_.get( + "all_threats_combined_count" + ) + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedpercent"] = ip_threat_data_.get( + "all_threats_combined_percent" + ) + indicator_obj["fields"]["domaintoolsfeedipallthreatsperecent"] = ip_threat_data_.get("all_threats_percent") + indicator_obj["fields"]["domaintoolsfeedipcombinedphishingpercent"] = ip_threat_data_.get( + "combined_phishing_percent" + ) + indicator_obj["fields"]["domaintoolsfeedipcombinedmalwarepercent"] = ip_threat_data_.get( + "combined_malware_percent" + ) + indicator_obj["fields"]["domaintoolsfeedipcombinedspampercent"] = ip_threat_data_.get("combined_spam_percent") + indicator_obj["fields"]["domaintoolsfeedipmaliciousphishing"] = ip_threat_data_.get("malicious_phishing") + indicator_obj["fields"]["domaintoolsfeedipmaliciousmalware"] = ip_threat_data_.get("malicious_malware") + indicator_obj["fields"]["domaintoolsfeedipmaliciousspam"] = ip_threat_data_.get("malicious_spam") + indicator_obj["fields"]["domaintoolsfeedippercentphishing"] = ip_threat_data_.get("percent_phishing") + indicator_obj["fields"]["domaintoolsfeedippercentmalware"] = ip_threat_data_.get("percent_malware") + indicator_obj["fields"]["domaintoolsfeedippercentspam"] = ip_threat_data_.get("percent_spam") + indicator_obj["fields"]["domaintoolsfeedipcompromisedphishing"] = ip_threat_data_.get("compromised_phishing") + indicator_obj["fields"]["domaintoolsfeedipcompromisedmalware"] = ip_threat_data_.get("compromised_malware") + indicator_obj["fields"]["domaintoolsfeedipcompromisedspam"] = ip_threat_data_.get("compromised_spam") + indicator_obj["fields"]["domaintoolsfeedippredictedphishing"] = ip_threat_data_.get("predicted_phishing") + indicator_obj["fields"]["domaintoolsfeedippredictedmalware"] = ip_threat_data_.get("predicted_malware") + indicator_obj["fields"]["domaintoolsfeedippredictedspam"] = ip_threat_data_.get("predicted_spam") + if overall_risk_score_: indicator_obj["score"] = get_dbot_score(overall_risk_score=overall_risk_score_) diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py index fe3cf403656c..16bd69c95dff 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py @@ -153,7 +153,7 @@ def test_iphotlist_build_iterator(self, mocker, dt_feeds_client): assert "203.0.113.5" in ips assert len(indicators) == 3 - assert indicators[0].get("type") == FeedIndicatorType.IP + assert indicators[0].get("type") == "DomainToolsFeed IP" assert indicators[0].get("ip_threat_data", {}).get("asn") == 12345 def test_iprisk_build_iterator(self, mocker, dt_feeds_client): @@ -175,7 +175,7 @@ def test_iprisk_build_iterator(self, mocker, dt_feeds_client): assert "203.0.113.10" in ips assert len(indicators) == 2 - assert indicators[0].get("type") == FeedIndicatorType.IP + assert indicators[0].get("type") == "DomainToolsFeed IP" assert indicators[0].get("ip_threat_data", {}).get("asn") == 22222 diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py index 762d3f367293..be851eeb7a24 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py @@ -855,19 +855,74 @@ '{"timestamp":"2025-09-06T22:02:00Z","ip":"192.0.2.100","asn":11111,"organization":"SpamCo","city":"Lagos","country":"NG","latitude":6.5244,"longitude":3.3792,"pdns_resolutions":50,"bad_pdns_resolutions":45,"total_domains":30,"all_threats_combined_count":40,"third_party_threats":2}', ] +_IP_FIELDS_NONE = { + "domaintoolsfeedipallthreatscombinedpercent": None, + "domaintoolsfeedipallthreatsperecent": None, + "domaintoolsfeedipcombinedphishingpercent": None, + "domaintoolsfeedipcombinedmalwarepercent": None, + "domaintoolsfeedipcombinedspampercent": None, + "domaintoolsfeedipmaliciousphishing": None, + "domaintoolsfeedipmaliciousmalware": None, + "domaintoolsfeedipmaliciousspam": None, + "domaintoolsfeedippercentphishing": None, + "domaintoolsfeedippercentmalware": None, + "domaintoolsfeedippercentspam": None, + "domaintoolsfeedipcompromisedphishing": None, + "domaintoolsfeedipcompromisedmalware": None, + "domaintoolsfeedipcompromisedspam": None, + "domaintoolsfeedippredictedphishing": None, + "domaintoolsfeedippredictedmalware": None, + "domaintoolsfeedippredictedspam": None, +} + +_IP_RAW_NONE = { + "all_threats_combined_percent": None, + "all_threats_percent": None, + "combined_phishing_percent": None, + "combined_malware_percent": None, + "combined_spam_percent": None, + "malicious_phishing": None, + "malicious_malware": None, + "malicious_spam": None, + "percent_phishing": None, + "percent_malware": None, + "percent_spam": None, + "compromised_phishing": None, + "compromised_malware": None, + "compromised_spam": None, + "predicted_phishing": None, + "predicted_malware": None, + "predicted_spam": None, +} + IPHOTLIST_PARSED_INDICATOR_RESPONSE = [ { "value": "203.0.113.5", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:00:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:00:00Z", + "domaintoolsfeedipasn": 12345, + "domaintoolsfeediporganization": "Evil Corp", + "domaintoolsfeedipcity": "Moscow", + "domaintoolsfeedipcountry": "RU", + "domaintoolsfeediplatitude": 55.7558, + "domaintoolsfeediplongitude": 37.6173, + "domaintoolsfeedippdnsresolutions": 150, + "domaintoolsfeedipbadpdnsresolutions": 120, + "domaintoolsfeediptotaldomains": 80, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 10, + "domaintoolsfeedipallthreatscombinedcount": 95, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "203.0.113.5", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:00:00Z", "ip_threat_data": { "asn": 12345, @@ -879,23 +934,41 @@ "pdns_resolutions": 150, "bad_pdns_resolutions": 120, "total_domains": 80, - "all_threats_combined_count": 95, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 10, + "all_threats_combined_count": 95, + **_IP_RAW_NONE, }, }, }, { "value": "198.51.100.22", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:01:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:01:00Z", + "domaintoolsfeedipasn": 67890, + "domaintoolsfeediporganization": "BadNet", + "domaintoolsfeedipcity": "Beijing", + "domaintoolsfeedipcountry": "CN", + "domaintoolsfeediplatitude": 39.9042, + "domaintoolsfeediplongitude": 116.4074, + "domaintoolsfeedippdnsresolutions": 200, + "domaintoolsfeedipbadpdnsresolutions": 180, + "domaintoolsfeediptotaldomains": 60, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 5, + "domaintoolsfeedipallthreatscombinedcount": 75, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "198.51.100.22", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:01:00Z", "ip_threat_data": { "asn": 67890, @@ -907,23 +980,41 @@ "pdns_resolutions": 200, "bad_pdns_resolutions": 180, "total_domains": 60, - "all_threats_combined_count": 75, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 5, + "all_threats_combined_count": 75, + **_IP_RAW_NONE, }, }, }, { "value": "192.0.2.100", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:02:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:02:00Z", + "domaintoolsfeedipasn": 11111, + "domaintoolsfeediporganization": "SpamCo", + "domaintoolsfeedipcity": "Lagos", + "domaintoolsfeedipcountry": "NG", + "domaintoolsfeediplatitude": 6.5244, + "domaintoolsfeediplongitude": 3.3792, + "domaintoolsfeedippdnsresolutions": 50, + "domaintoolsfeedipbadpdnsresolutions": 45, + "domaintoolsfeediptotaldomains": 30, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 2, + "domaintoolsfeedipallthreatscombinedcount": 40, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "192.0.2.100", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:02:00Z", "ip_threat_data": { "asn": 11111, @@ -935,8 +1026,11 @@ "pdns_resolutions": 50, "bad_pdns_resolutions": 45, "total_domains": 30, - "all_threats_combined_count": 40, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 2, + "all_threats_combined_count": 40, + **_IP_RAW_NONE, }, }, }, @@ -950,16 +1044,31 @@ IPRISK_PARSED_INDICATOR_RESPONSE = [ { "value": "203.0.113.10", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iprisk", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:10:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:10:00Z", + "domaintoolsfeedipasn": 22222, + "domaintoolsfeediporganization": "RiskNet", + "domaintoolsfeedipcity": "Tehran", + "domaintoolsfeedipcountry": "IR", + "domaintoolsfeediplatitude": 35.6892, + "domaintoolsfeediplongitude": 51.389, + "domaintoolsfeedippdnsresolutions": 300, + "domaintoolsfeedipbadpdnsresolutions": 250, + "domaintoolsfeediptotaldomains": 90, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 15, + "domaintoolsfeedipallthreatscombinedcount": 110, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "203.0.113.10", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:10:00Z", "ip_threat_data": { "asn": 22222, @@ -967,27 +1076,45 @@ "city": "Tehran", "country": "IR", "latitude": 35.6892, - "longitude": 51.3890, + "longitude": 51.389, "pdns_resolutions": 300, "bad_pdns_resolutions": 250, "total_domains": 90, - "all_threats_combined_count": 110, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 15, + "all_threats_combined_count": 110, + **_IP_RAW_NONE, }, }, }, { "value": "198.51.100.50", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iprisk", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:11:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:11:00Z", + "domaintoolsfeedipasn": 33333, + "domaintoolsfeediporganization": "MalHost", + "domaintoolsfeedipcity": "Pyongyang", + "domaintoolsfeedipcountry": "KP", + "domaintoolsfeediplatitude": 39.0194, + "domaintoolsfeediplongitude": 125.7381, + "domaintoolsfeedippdnsresolutions": 180, + "domaintoolsfeedipbadpdnsresolutions": 160, + "domaintoolsfeediptotaldomains": 55, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 8, + "domaintoolsfeedipallthreatscombinedcount": 85, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "198.51.100.50", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:11:00Z", "ip_threat_data": { "asn": 33333, @@ -999,8 +1126,11 @@ "pdns_resolutions": 180, "bad_pdns_resolutions": 160, "total_domains": 55, - "all_threats_combined_count": 85, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 8, + "all_threats_combined_count": 85, + **_IP_RAW_NONE, }, }, }, diff --git a/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json new file mode 100644 index 000000000000..f34f0d420d51 --- /dev/null +++ b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json @@ -0,0 +1,1004 @@ +{ + "description": "DomainToolsFeed IP Indicator Layout", + "detailsV2": { + "tabs": [ + { + "id": "default-main", + "name": "DomainTools", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "moved": false, + "name": "Expiration Status", + "static": false, + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "moved": false, + "name": "Verdict Status", + "static": false, + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "displayType": "ROW", + "h": 2, + "i": "domaintools-ip-geo", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipasn", + "height": 22, + "id": "dt-asn", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediporganization", + "height": 22, + "id": "dt-organization", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcity", + "height": 22, + "id": "dt-city", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcountry", + "height": 22, + "id": "dt-country", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplatitude", + "height": 22, + "id": "dt-latitude", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplongitude", + "height": 22, + "id": "dt-longitude", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipfeedtimestamp", + "height": 22, + "id": "dt-feed-timestamp", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "IP Geolocation", + "static": false, + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "i": "domaintools-ip-dns", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedippdnsresolutions", + "height": 22, + "id": "dt-pdns", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipbadpdnsresolutions", + "height": 22, + "id": "dt-bad-pdns", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediptotaldomains", + "height": 22, + "id": "dt-total-domains", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistdomains", + "height": 22, + "id": "dt-zerolist-domains", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistip", + "height": 22, + "id": "dt-zerolist-ip", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipthirdpartythreats", + "height": 22, + "id": "dt-third-party", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "DNS \u0026 Domain Stats", + "static": false, + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "domaintools-ip-threats", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedcount", + "height": 22, + "id": "dt-all-threats-count", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedpercent", + "height": 22, + "id": "dt-all-threats-combined-pct", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatsperecent", + "height": 22, + "id": "dt-all-threats-pct", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedphishingpercent", + "height": 22, + "id": "dt-combined-phishing", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedmalwarepercent", + "height": 22, + "id": "dt-combined-malware", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedspampercent", + "height": 22, + "id": "dt-combined-spam", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousphishing", + "height": 22, + "id": "dt-mal-phishing", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousmalware", + "height": 22, + "id": "dt-mal-malware", + "index": 7, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousspam", + "height": 22, + "id": "dt-mal-spam", + "index": 8, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentphishing", + "height": 22, + "id": "dt-pct-phishing", + "index": 9, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentmalware", + "height": 22, + "id": "dt-pct-malware", + "index": 10, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentspam", + "height": 22, + "id": "dt-pct-spam", + "index": 11, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedphishing", + "height": 22, + "id": "dt-comp-phishing", + "index": 12, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedmalware", + "height": 22, + "id": "dt-comp-malware", + "index": 13, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedspam", + "height": 22, + "id": "dt-comp-spam", + "index": 14, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedphishing", + "height": 22, + "id": "dt-pred-phishing", + "index": 15, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedmalware", + "height": 22, + "id": "dt-pred-malware", + "index": 16, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedspam", + "height": 22, + "id": "dt-pred-spam", + "index": 17, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "Threat Intelligence", + "static": false, + "w": 2, + "x": 0, + "y": 4 + }, + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "moved": false, + "name": "Relationships", + "static": false, + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 8 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "moved": false, + "name": "Related Incidents", + "static": false, + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 10 + } + ], + "type": "custom" + } + ] + }, + "edit": { + "sections": [ + { + "description": "", + "fields": [ + { + "fieldId": "indicator_value", + "isVisible": true + }, + { + "fieldId": "indicator_indicatortype", + "isVisible": true + }, + { + "fieldId": "indicator_score", + "isVisible": true + }, + { + "fieldId": "indicator_expiration", + "isVisible": true + }, + { + "fieldId": "indicator_comment", + "isVisible": true + }, + { + "fieldId": "indicator_investigationids", + "isVisible": true + } + ], + "isVisible": true, + "name": "Basic Information", + "query": null, + "queryType": "", + "readOnly": false, + "type": "basicInformationSection" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipasn", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplatitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplongitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcountry", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcity", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediporganization", + "isVisible": true + } + ], + "isVisible": true, + "name": "IP Geolocation", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedippdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipbadpdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediptotaldomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistdomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistip", + "isVisible": true + } + ], + "isVisible": true, + "name": "DNS \u0026 Domain Stats", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedcount", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatsperecent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedmalwarepercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedphishingpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedspampercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipthirdpartythreats", + "isVisible": true + } + ], + "isVisible": true, + "name": "Threat Intelligence", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_blocked", + "isVisible": true + }, + { + "fieldId": "indicator_communitynotes", + "isVisible": true + }, + { + "fieldId": "indicator_description", + "isVisible": true + }, + { + "fieldId": "indicator_firstseenbysource", + "isVisible": true + }, + { + "fieldId": "indicator_stixid", + "isVisible": true + }, + { + "fieldId": "indicator_tags", + "isVisible": true + }, + { + "fieldId": "indicator_targets", + "isVisible": true + }, + { + "fieldId": "indicator_trafficlightprotocol", + "isVisible": true + }, + { + "fieldId": "indicator_updateddate", + "isVisible": true + }, + { + "fieldId": "indicator_userid", + "isVisible": true + }, + { + "fieldId": "indicator_vendor", + "isVisible": true + }, + { + "fieldId": "indicator_version", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetectionnames", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetections", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginevendors", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerabilities", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerableproducts", + "isVisible": true + }, + { + "fieldId": "indicator_whoisrecords", + "isVisible": true + } + ], + "isVisible": true, + "name": "Custom Fields", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + } + ] + }, + "group": "indicator", + "id": "DomainToolsFeed IP Indicator", + "indicatorsDetails": { + "tabs": [ + { + "id": "default-main", + "name": "Info", + "sections": [ + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "name": "Relationships", + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 2 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 2 + }, + { + "displayType": "ROW", + "h": 2, + "i": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a", + "items": [ + { + "endCol": 2, + "fieldId": "indicatortype", + "height": 26, + "id": "indicator-type", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "modified", + "height": 26, + "id": "indicator-modified", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "expiration", + "height": 26, + "id": "indicator-expiration", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "timestamp", + "height": 26, + "id": "indicator-timestamp", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "name": "Basic Information", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 1, + "hideName": false, + "i": "default-main-actions", + "items": [ + { + "args": {}, + "endCol": 1, + "height": 44, + "index": 0, + "name": "Enrich indicator", + "scriptId": "Builtin|||enrichIndicators", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "height": 44, + "index": 1, + "name": "Expire indicator", + "scriptId": "Builtin|||expireIndicators", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Actions", + "type": "actions", + "w": 1, + "x": 2, + "y": 0 + }, + { + "displayType": "CARD", + "h": 2, + "i": "default-main-tagsAndTLP", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 53, + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "dropEffect": "move", + "endCol": 1, + "height": 53, + "index": 1, + "name": "Add tags", + "scriptId": "Builtin|||appendIndicatorField", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "trafficlightprotocol", + "height": 53, + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "endCol": 2, + "height": 53, + "index": 1, + "name": "Remove tags", + "scriptId": "Builtin|||removeIndicatorField", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags and TLP", + "type": "tagsAndTLP", + "w": 1, + "x": 2, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "default-main-indicatorTimeline", + "maxW": 3, + "name": "Timeline", + "type": "indicatorTimeline", + "w": 1, + "x": 2, + "y": 3 + }, + { + "h": 3, + "i": "default-main-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 2, + "y": 5 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "name": "Verdict Status", + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "default-main-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "hideName": false, + "i": "default-main-publications", + "items": [ + { + "endCol": 4, + "fieldId": "communitynotes", + "height": 106, + "id": "indicator-communitynotes-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 4, + "fieldId": "publications", + "height": 106, + "id": "indicator-publications-field", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Publications", + "type": "publications", + "w": 2, + "x": 0, + "y": 9 + } + ], + "type": "custom" + }, + { + "id": "canvas", + "name": "Canvas", + "type": "canvas" + } + ] + }, + "indicatorsQuickView": { + "tabs": [ + { + "id": "indicator-quick-view-info", + "name": "Info", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "indicator-quick-view-info-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "indicator-quick-view-info-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 2, + "hideItemTitleOnlyOne": true, + "i": "indicator-quick-view-info-tags-section", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 22, + "id": "indicator-quick-view-info-tags-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags", + "w": 1, + "x": 0, + "y": 3 + }, + { + "h": 2, + "i": "indicator-quick-view-info-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 1, + "x": 0, + "y": 5 + }, + { + "h": 2, + "i": "indicator-quick-view-info-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 0, + "y": 7 + } + ], + "type": "custom" + } + ] + }, + "name": "DomainToolsFeed IP Indicator", + "system": false, + "version": -1, + "fromVersion": "0.0.0" +} \ No newline at end of file