From f4484c069aa0aabe2a2667de202738b6f098c907 Mon Sep 17 00:00:00 2001 From: JD Babac Date: Tue, 18 Aug 2026 02:44:06 +0800 Subject: [PATCH 1/3] IDEV-2524: Add filter parameters and add new indicator type. --- .../FeedDomainTools/FeedDomainTools.py | 59 ++++++- .../FeedDomainTools/FeedDomainTools_test.py | 4 +- .../test_data/feed_mock_response.py | 162 ++++++++++++++++-- 3 files changed, 205 insertions(+), 20 deletions(-) diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py index bb9ac3a3ba62..6cbfde198546 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py @@ -240,7 +240,7 @@ def build_iterator(self, feed_type: str = "nod", dt_feed_kwargs: dict = {}) -> I if feed_type in (self.IPHOTLIST, self.IPRISK): indicator = json_feed.get("ip") - indicator_type = FeedIndicatorType.IP + indicator_type = "DomainToolsFeed IP" else: indicator = json_feed.get("domain") indicator_type = FeedIndicatorType.Domain @@ -287,8 +287,27 @@ def build_iterator(self, feed_type: str = "nod", dt_feed_kwargs: dict = {}) -> I "pdns_resolutions": json_feed.get("pdns_resolutions"), "bad_pdns_resolutions": json_feed.get("bad_pdns_resolutions"), "total_domains": json_feed.get("total_domains"), - "all_threats_combined_count": json_feed.get("all_threats_combined_count"), + "zerolist_domains": json_feed.get("zerolist_domains"), + "zerolist_ip": json_feed.get("zerolist_ip"), "third_party_threats": json_feed.get("third_party_threats"), + "all_threats_combined_count": json_feed.get("all_threats_combined_count"), + "all_threats_combined_percent": json_feed.get("all_threats_combined_percent"), + "all_threats_percent": json_feed.get("all_threats_percent"), + "combined_phishing_percent": json_feed.get("combined_phishing_percent"), + "combined_malware_percent": json_feed.get("combined_malware_percent"), + "combined_spam_percent": json_feed.get("combined_spam_percent"), + "malicious_phishing": json_feed.get("malicious_phishing"), + "malicious_malware": json_feed.get("malicious_malware"), + "malicious_spam": json_feed.get("malicious_spam"), + "percent_phishing": json_feed.get("percent_phishing"), + "percent_malware": json_feed.get("percent_malware"), + "percent_spam": json_feed.get("percent_spam"), + "compromised_phishing": json_feed.get("compromised_phishing"), + "compromised_malware": json_feed.get("compromised_malware"), + "compromised_spam": json_feed.get("compromised_spam"), + "predicted_phishing": json_feed.get("predicted_phishing"), + "predicted_malware": json_feed.get("predicted_malware"), + "predicted_spam": json_feed.get("predicted_spam"), } dt_feed_data["ip_threat_data"] = ip_threat_data @@ -399,9 +418,45 @@ def fetch_indicators(client: DomainToolsClient, feed_type: str = "nod", dt_feed_ "rawJSON": raw_data, } + if timestamp_: + if type_ == "DomainToolsFeed IP": + indicator_obj["fields"]["domaintoolsfeedipfeedtimestamp"] = timestamp_ + if tlp_color_: indicator_obj["fields"]["trafficlightprotocol"] = tlp_color_ + if ip_threat_data_: + indicator_obj["fields"]["domaintoolsfeedipasn"] = ip_threat_data_.get("asn") + indicator_obj["fields"]["domaintoolsfeediporganization"] = ip_threat_data_.get("organization") + indicator_obj["fields"]["domaintoolsfeedipcity"] = ip_threat_data_.get("city") + indicator_obj["fields"]["domaintoolsfeedipcountry"] = ip_threat_data_.get("country") + indicator_obj["fields"]["domaintoolsfeediplatitude"] = ip_threat_data_.get("latitude") + indicator_obj["fields"]["domaintoolsfeediplongitude"] = ip_threat_data_.get("longitude") + indicator_obj["fields"]["domaintoolsfeedippdnsresolutions"] = ip_threat_data_.get("pdns_resolutions") + indicator_obj["fields"]["domaintoolsfeedipbadpdnsresolutions"] = ip_threat_data_.get("bad_pdns_resolutions") + indicator_obj["fields"]["domaintoolsfeediptotaldomains"] = ip_threat_data_.get("total_domains") + indicator_obj["fields"]["domaintoolsfeedipzerolistdomains"] = ip_threat_data_.get("zerolist_domains") + indicator_obj["fields"]["domaintoolsfeedipzerolistip"] = ip_threat_data_.get("zerolist_ip") + indicator_obj["fields"]["domaintoolsfeedipthirdpartythreats"] = ip_threat_data_.get("third_party_threats") + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedcount"] = ip_threat_data_.get("all_threats_combined_count") + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedpercent"] = ip_threat_data_.get("all_threats_combined_percent") + indicator_obj["fields"]["domaintoolsfeedipallthreatsperecent"] = ip_threat_data_.get("all_threats_percent") + indicator_obj["fields"]["domaintoolsfeedipcombinedphishingpercent"] = ip_threat_data_.get("combined_phishing_percent") + indicator_obj["fields"]["domaintoolsfeedipcombinedmalwarepercent"] = ip_threat_data_.get("combined_malware_percent") + indicator_obj["fields"]["domaintoolsfeedipcombinedspampercent"] = ip_threat_data_.get("combined_spam_percent") + indicator_obj["fields"]["domaintoolsfeedipmaliciousphishing"] = ip_threat_data_.get("malicious_phishing") + indicator_obj["fields"]["domaintoolsfeedipmaliciousmalware"] = ip_threat_data_.get("malicious_malware") + indicator_obj["fields"]["domaintoolsfeedipmaliciousspam"] = ip_threat_data_.get("malicious_spam") + indicator_obj["fields"]["domaintoolsfeedippercentphishing"] = ip_threat_data_.get("percent_phishing") + indicator_obj["fields"]["domaintoolsfeedippercentmalware"] = ip_threat_data_.get("percent_malware") + indicator_obj["fields"]["domaintoolsfeedippercentspam"] = ip_threat_data_.get("percent_spam") + indicator_obj["fields"]["domaintoolsfeedipcompromisedphishing"] = ip_threat_data_.get("compromised_phishing") + indicator_obj["fields"]["domaintoolsfeedipcompromisedmalware"] = ip_threat_data_.get("compromised_malware") + indicator_obj["fields"]["domaintoolsfeedipcompromisedspam"] = ip_threat_data_.get("compromised_spam") + indicator_obj["fields"]["domaintoolsfeedippredictedphishing"] = ip_threat_data_.get("predicted_phishing") + indicator_obj["fields"]["domaintoolsfeedippredictedmalware"] = ip_threat_data_.get("predicted_malware") + indicator_obj["fields"]["domaintoolsfeedippredictedspam"] = ip_threat_data_.get("predicted_spam") + if overall_risk_score_: indicator_obj["score"] = get_dbot_score(overall_risk_score=overall_risk_score_) diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py index fe3cf403656c..16bd69c95dff 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools_test.py @@ -153,7 +153,7 @@ def test_iphotlist_build_iterator(self, mocker, dt_feeds_client): assert "203.0.113.5" in ips assert len(indicators) == 3 - assert indicators[0].get("type") == FeedIndicatorType.IP + assert indicators[0].get("type") == "DomainToolsFeed IP" assert indicators[0].get("ip_threat_data", {}).get("asn") == 12345 def test_iprisk_build_iterator(self, mocker, dt_feeds_client): @@ -175,7 +175,7 @@ def test_iprisk_build_iterator(self, mocker, dt_feeds_client): assert "203.0.113.10" in ips assert len(indicators) == 2 - assert indicators[0].get("type") == FeedIndicatorType.IP + assert indicators[0].get("type") == "DomainToolsFeed IP" assert indicators[0].get("ip_threat_data", {}).get("asn") == 22222 diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py index 762d3f367293..be851eeb7a24 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/test_data/feed_mock_response.py @@ -855,19 +855,74 @@ '{"timestamp":"2025-09-06T22:02:00Z","ip":"192.0.2.100","asn":11111,"organization":"SpamCo","city":"Lagos","country":"NG","latitude":6.5244,"longitude":3.3792,"pdns_resolutions":50,"bad_pdns_resolutions":45,"total_domains":30,"all_threats_combined_count":40,"third_party_threats":2}', ] +_IP_FIELDS_NONE = { + "domaintoolsfeedipallthreatscombinedpercent": None, + "domaintoolsfeedipallthreatsperecent": None, + "domaintoolsfeedipcombinedphishingpercent": None, + "domaintoolsfeedipcombinedmalwarepercent": None, + "domaintoolsfeedipcombinedspampercent": None, + "domaintoolsfeedipmaliciousphishing": None, + "domaintoolsfeedipmaliciousmalware": None, + "domaintoolsfeedipmaliciousspam": None, + "domaintoolsfeedippercentphishing": None, + "domaintoolsfeedippercentmalware": None, + "domaintoolsfeedippercentspam": None, + "domaintoolsfeedipcompromisedphishing": None, + "domaintoolsfeedipcompromisedmalware": None, + "domaintoolsfeedipcompromisedspam": None, + "domaintoolsfeedippredictedphishing": None, + "domaintoolsfeedippredictedmalware": None, + "domaintoolsfeedippredictedspam": None, +} + +_IP_RAW_NONE = { + "all_threats_combined_percent": None, + "all_threats_percent": None, + "combined_phishing_percent": None, + "combined_malware_percent": None, + "combined_spam_percent": None, + "malicious_phishing": None, + "malicious_malware": None, + "malicious_spam": None, + "percent_phishing": None, + "percent_malware": None, + "percent_spam": None, + "compromised_phishing": None, + "compromised_malware": None, + "compromised_spam": None, + "predicted_phishing": None, + "predicted_malware": None, + "predicted_spam": None, +} + IPHOTLIST_PARSED_INDICATOR_RESPONSE = [ { "value": "203.0.113.5", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:00:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:00:00Z", + "domaintoolsfeedipasn": 12345, + "domaintoolsfeediporganization": "Evil Corp", + "domaintoolsfeedipcity": "Moscow", + "domaintoolsfeedipcountry": "RU", + "domaintoolsfeediplatitude": 55.7558, + "domaintoolsfeediplongitude": 37.6173, + "domaintoolsfeedippdnsresolutions": 150, + "domaintoolsfeedipbadpdnsresolutions": 120, + "domaintoolsfeediptotaldomains": 80, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 10, + "domaintoolsfeedipallthreatscombinedcount": 95, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "203.0.113.5", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:00:00Z", "ip_threat_data": { "asn": 12345, @@ -879,23 +934,41 @@ "pdns_resolutions": 150, "bad_pdns_resolutions": 120, "total_domains": 80, - "all_threats_combined_count": 95, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 10, + "all_threats_combined_count": 95, + **_IP_RAW_NONE, }, }, }, { "value": "198.51.100.22", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:01:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:01:00Z", + "domaintoolsfeedipasn": 67890, + "domaintoolsfeediporganization": "BadNet", + "domaintoolsfeedipcity": "Beijing", + "domaintoolsfeedipcountry": "CN", + "domaintoolsfeediplatitude": 39.9042, + "domaintoolsfeediplongitude": 116.4074, + "domaintoolsfeedippdnsresolutions": 200, + "domaintoolsfeedipbadpdnsresolutions": 180, + "domaintoolsfeediptotaldomains": 60, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 5, + "domaintoolsfeedipallthreatscombinedcount": 75, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "198.51.100.22", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:01:00Z", "ip_threat_data": { "asn": 67890, @@ -907,23 +980,41 @@ "pdns_resolutions": 200, "bad_pdns_resolutions": 180, "total_domains": 60, - "all_threats_combined_count": 75, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 5, + "all_threats_combined_count": 75, + **_IP_RAW_NONE, }, }, }, { "value": "192.0.2.100", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iphotlist", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:02:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:02:00Z", + "domaintoolsfeedipasn": 11111, + "domaintoolsfeediporganization": "SpamCo", + "domaintoolsfeedipcity": "Lagos", + "domaintoolsfeedipcountry": "NG", + "domaintoolsfeediplatitude": 6.5244, + "domaintoolsfeediplongitude": 3.3792, + "domaintoolsfeedippdnsresolutions": 50, + "domaintoolsfeedipbadpdnsresolutions": 45, + "domaintoolsfeediptotaldomains": 30, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 2, + "domaintoolsfeedipallthreatscombinedcount": 40, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "192.0.2.100", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:02:00Z", "ip_threat_data": { "asn": 11111, @@ -935,8 +1026,11 @@ "pdns_resolutions": 50, "bad_pdns_resolutions": 45, "total_domains": 30, - "all_threats_combined_count": 40, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 2, + "all_threats_combined_count": 40, + **_IP_RAW_NONE, }, }, }, @@ -950,16 +1044,31 @@ IPRISK_PARSED_INDICATOR_RESPONSE = [ { "value": "203.0.113.10", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iprisk", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:10:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:10:00Z", + "domaintoolsfeedipasn": 22222, + "domaintoolsfeediporganization": "RiskNet", + "domaintoolsfeedipcity": "Tehran", + "domaintoolsfeedipcountry": "IR", + "domaintoolsfeediplatitude": 35.6892, + "domaintoolsfeediplongitude": 51.389, + "domaintoolsfeedippdnsresolutions": 300, + "domaintoolsfeedipbadpdnsresolutions": 250, + "domaintoolsfeediptotaldomains": 90, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 15, + "domaintoolsfeedipallthreatscombinedcount": 110, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "203.0.113.10", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:10:00Z", "ip_threat_data": { "asn": 22222, @@ -967,27 +1076,45 @@ "city": "Tehran", "country": "IR", "latitude": 35.6892, - "longitude": 51.3890, + "longitude": 51.389, "pdns_resolutions": 300, "bad_pdns_resolutions": 250, "total_domains": 90, - "all_threats_combined_count": 110, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 15, + "all_threats_combined_count": 110, + **_IP_RAW_NONE, }, }, }, { "value": "198.51.100.50", - "type": "IP", + "type": "DomainToolsFeed IP", "fields": { "tags": "DomainToolsFeeds,iprisk", "service": "DomainTools Feeds", "firstseenbysource": "2025-09-06T22:11:00Z", "sourcebrands": "FeedDomainTools", + "domaintoolsfeedipfeedtimestamp": "2025-09-06T22:11:00Z", + "domaintoolsfeedipasn": 33333, + "domaintoolsfeediporganization": "MalHost", + "domaintoolsfeedipcity": "Pyongyang", + "domaintoolsfeedipcountry": "KP", + "domaintoolsfeediplatitude": 39.0194, + "domaintoolsfeediplongitude": 125.7381, + "domaintoolsfeedippdnsresolutions": 180, + "domaintoolsfeedipbadpdnsresolutions": 160, + "domaintoolsfeediptotaldomains": 55, + "domaintoolsfeedipzerolistdomains": None, + "domaintoolsfeedipzerolistip": None, + "domaintoolsfeedipthirdpartythreats": 8, + "domaintoolsfeedipallthreatscombinedcount": 85, + **_IP_FIELDS_NONE, }, "rawJSON": { "value": "198.51.100.50", - "type": "IP", + "type": "DomainToolsFeed IP", "timestamp": "2025-09-06T22:11:00Z", "ip_threat_data": { "asn": 33333, @@ -999,8 +1126,11 @@ "pdns_resolutions": 180, "bad_pdns_resolutions": 160, "total_domains": 55, - "all_threats_combined_count": 85, + "zerolist_domains": None, + "zerolist_ip": None, "third_party_threats": 8, + "all_threats_combined_count": 85, + **_IP_RAW_NONE, }, }, }, From 7e49bb3ca91d7136c65b6e555147913c076a0bdd Mon Sep 17 00:00:00 2001 From: JD Babac Date: Tue, 18 Aug 2026 02:45:08 +0800 Subject: [PATCH 2/3] IDEV-2524: Add confgi for new indicator fields, indicator type and layout. --- ...aintoolsfeedipallthreatscombinedcount.json | 28 + ...ntoolsfeedipallthreatscombinedpercent.json | 28 + ...domaintoolsfeedipallthreatspercentmin.json | 28 + .../indicatorfield-domaintoolsfeedipasn.json | 28 + ...d-domaintoolsfeedipbadpdnsresolutions.json | 28 + .../indicatorfield-domaintoolsfeedipcity.json | 28 + ...maintoolsfeedipcombinedmalwarepercent.json | 28 + ...aintoolsfeedipcombinedphishingpercent.json | 28 + ...-domaintoolsfeedipcombinedspampercent.json | 28 + ...d-domaintoolsfeedipcompromisedmalware.json | 28 + ...-domaintoolsfeedipcompromisedphishing.json | 28 + ...ield-domaintoolsfeedipcompromisedspam.json | 28 + ...dicatorfield-domaintoolsfeedipcountry.json | 28 + ...rfield-domaintoolsfeedipfeedtimestamp.json | 28 + ...icatorfield-domaintoolsfeediplatitude.json | 28 + ...catorfield-domaintoolsfeediplongitude.json | 28 + ...eld-domaintoolsfeedipmaliciousmalware.json | 28 + ...ld-domaintoolsfeedipmaliciousphishing.json | 28 + ...rfield-domaintoolsfeedipmaliciousspam.json | 28 + ...orfield-domaintoolsfeediporganization.json | 28 + ...ield-domaintoolsfeedippdnsresolutions.json | 28 + ...field-domaintoolsfeedippercentmalware.json | 28 + ...ield-domaintoolsfeedippercentphishing.json | 28 + ...torfield-domaintoolsfeedippercentspam.json | 28 + ...eld-domaintoolsfeedippredictedmalware.json | 28 + ...ld-domaintoolsfeedippredictedphishing.json | 28 + ...rfield-domaintoolsfeedippredictedspam.json | 28 + ...ld-domaintoolsfeedipthirdpartythreats.json | 28 + ...orfield-domaintoolsfeediptotaldomains.json | 28 + ...ield-domaintoolsfeedipzerolistdomains.json | 28 + ...atorfield-domaintoolsfeedipzerolistip.json | 28 + .../indicatortype-DomainToolsFeed_IP.json | 25 + ...ontainer-DomainToolsFeed_IP_Indicator.json | 1024 +++++++++++++++++ 33 files changed, 1917 insertions(+) create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json create mode 100644 Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json create mode 100644 Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json create mode 100644 Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json new file mode 100644 index 000000000000..6fbe88958aa6 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedcount.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatscombinedcount", + "version": -1, + "name": "DomainToolsFeed IP All Threats Combined Count", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatscombinedcount", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json new file mode 100644 index 000000000000..9e44a1101880 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatscombinedpercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatscombinedpercent", + "version": -1, + "name": "DomainToolsFeed IP All Threats Combined Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatscombinedpercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json new file mode 100644 index 000000000000..7e04e8107a0a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipallthreatspercentmin.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipallthreatsperecent", + "version": -1, + "name": "DomainToolsFeed IP All Threats Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipallthreatsperecent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json new file mode 100644 index 000000000000..222ddbd71c8a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipasn.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipasn", + "version": -1, + "name": "DomainToolsFeed IP ASN", + "ownerOnly": false, + "cliName": "domaintoolsfeedipasn", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json new file mode 100644 index 000000000000..95f8c909eb5f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipbadpdnsresolutions.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipbadpdnsresolutions", + "version": -1, + "name": "DomainToolsFeed IP Bad PDNS Resolutions", + "ownerOnly": false, + "cliName": "domaintoolsfeedipbadpdnsresolutions", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json new file mode 100644 index 000000000000..86369d40e949 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcity.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcity", + "version": -1, + "name": "DomainToolsFeed IP City", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcity", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json new file mode 100644 index 000000000000..1121545d72c5 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedmalwarepercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedmalwarepercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Malware Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedmalwarepercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json new file mode 100644 index 000000000000..151cacf0222f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedphishingpercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedphishingpercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Phishing Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedphishingpercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json new file mode 100644 index 000000000000..e218b79ab38b --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcombinedspampercent.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcombinedspampercent", + "version": -1, + "name": "DomainToolsFeed IP Combined Spam Percent", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcombinedspampercent", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json new file mode 100644 index 000000000000..c4467ee619e2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedmalware", + "version": -1, + "name": "DomainToolsFeed IP Compromised Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json new file mode 100644 index 000000000000..a0817094d3b0 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedphishing", + "version": -1, + "name": "DomainToolsFeed IP Compromised Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json new file mode 100644 index 000000000000..ba8c7a27640e --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcompromisedspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcompromisedspam", + "version": -1, + "name": "DomainToolsFeed IP Compromised Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcompromisedspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json new file mode 100644 index 000000000000..ca81f7231429 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipcountry.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipcountry", + "version": -1, + "name": "DomainToolsFeed IP Country", + "ownerOnly": false, + "cliName": "domaintoolsfeedipcountry", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json new file mode 100644 index 000000000000..0371221eba42 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipfeedtimestamp", + "version": -1, + "name": "DomainToolsFeed IP Feed Timestamp", + "ownerOnly": false, + "cliName": "domaintoolsfeedipfeedtimestamp", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json new file mode 100644 index 000000000000..47347920aa33 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplatitude.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediplatitude", + "version": -1, + "name": "DomainToolsFeed IP Latitude", + "ownerOnly": false, + "cliName": "domaintoolsfeediplatitude", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json new file mode 100644 index 000000000000..358e8ee29bb2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediplongitude.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediplongitude", + "version": -1, + "name": "DomainToolsFeed IP Longitude", + "ownerOnly": false, + "cliName": "domaintoolsfeediplongitude", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json new file mode 100644 index 000000000000..ade37db0b9eb --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousmalware", + "version": -1, + "name": "DomainToolsFeed IP Malicious Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json new file mode 100644 index 000000000000..daf33efecc7c --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousphishing", + "version": -1, + "name": "DomainToolsFeed IP Malicious Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json new file mode 100644 index 000000000000..10ca1925985d --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipmaliciousspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipmaliciousspam", + "version": -1, + "name": "DomainToolsFeed IP Malicious Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedipmaliciousspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json new file mode 100644 index 000000000000..ae5ec2f9aee2 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediporganization.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediporganization", + "version": -1, + "name": "DomainToolsFeed IP Organization", + "ownerOnly": false, + "cliName": "domaintoolsfeediporganization", + "type": "shortText", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json new file mode 100644 index 000000000000..b6b0934f2d71 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippdnsresolutions.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippdnsresolutions", + "version": -1, + "name": "DomainToolsFeed IP PDNS Resolutions", + "ownerOnly": false, + "cliName": "domaintoolsfeedippdnsresolutions", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json new file mode 100644 index 000000000000..f427f71dc820 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentmalware", + "version": -1, + "name": "DomainToolsFeed IP Percent Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json new file mode 100644 index 000000000000..223da246d416 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentphishing", + "version": -1, + "name": "DomainToolsFeed IP Percent Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json new file mode 100644 index 000000000000..164126c946dd --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippercentspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippercentspam", + "version": -1, + "name": "DomainToolsFeed IP Percent Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedippercentspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json new file mode 100644 index 000000000000..c4d8f9d6d2be --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedmalware.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedmalware", + "version": -1, + "name": "DomainToolsFeed IP Predicted Malware", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedmalware", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json new file mode 100644 index 000000000000..0bfa0172089f --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedphishing.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedphishing", + "version": -1, + "name": "DomainToolsFeed IP Predicted Phishing", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedphishing", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json new file mode 100644 index 000000000000..c5feb6a2cc0e --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedippredictedspam.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedippredictedspam", + "version": -1, + "name": "DomainToolsFeed IP Predicted Spam", + "ownerOnly": false, + "cliName": "domaintoolsfeedippredictedspam", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json new file mode 100644 index 000000000000..628c66841584 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipthirdpartythreats.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipthirdpartythreats", + "version": -1, + "name": "DomainToolsFeed IP Third Party Threats", + "ownerOnly": false, + "cliName": "domaintoolsfeedipthirdpartythreats", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json new file mode 100644 index 000000000000..7caccbf08447 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeediptotaldomains.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeediptotaldomains", + "version": -1, + "name": "DomainToolsFeed IP Total Domains", + "ownerOnly": false, + "cliName": "domaintoolsfeediptotaldomains", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json new file mode 100644 index 000000000000..3f06e9b3c451 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistdomains.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipzerolistdomains", + "version": -1, + "name": "DomainToolsFeed IP Zerolist Domains", + "ownerOnly": false, + "cliName": "domaintoolsfeedipzerolistdomains", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json new file mode 100644 index 000000000000..3b1d3780636a --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipzerolistip.json @@ -0,0 +1,28 @@ +{ + "id": "indicator_domaintoolsfeedipzerolistip", + "version": -1, + "name": "DomainToolsFeed IP Zerolist IP", + "ownerOnly": false, + "cliName": "domaintoolsfeedipzerolistip", + "type": "number", + "closeForm": false, + "editForm": true, + "required": false, + "neverSetAsRequired": false, + "isReadOnly": false, + "locked": false, + "system": false, + "content": true, + "group": 2, + "hidden": false, + "associatedTypes": [ + "DomainToolsFeed IP" + ], + "associatedToAll": false, + "unmapped": false, + "unsearchable": false, + "caseInsensitive": true, + "sla": 0, + "threshold": 72, + "fromVersion": "5.5.0" +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json new file mode 100644 index 000000000000..8c3b6de48182 --- /dev/null +++ b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json @@ -0,0 +1,25 @@ +{ + "id": "DomainToolsFeed IP", + "version": -1, + "fromVersion": "6.0.0", + "regex": "\\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\\[\\.\\]|\\.)){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\b", + "details": "DomainToolsFeed IP", + "reputationScriptName": "", + "reputationCommand": "ip", + "enhancementScriptNames": [], + "system": false, + "locked": false, + "disabled": false, + "file": false, + "updateAfter": 0, + "mergeContext": false, + "formatScript": "", + "contextPath": "IP(val.Address && val.Address === obj.Address)", + "contextValue": "Address", + "excludedBrands": [], + "expiration": 10080, + "defaultMapping": {}, + "manualMapping": null, + "fileHashesPriority": null, + "layout": "DomainToolsFeed IP Indicator" +} diff --git a/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json new file mode 100644 index 000000000000..1f1355f6632f --- /dev/null +++ b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json @@ -0,0 +1,1024 @@ +{ + "cacheVersn": 0, + "close": null, + "definitionId": "", + "description": "DomainToolsFeed IP Indicator Layout", + "detached": false, + "details": null, + "detailsV2": { + "TypeName": "DomainToolsFeed IP", + "tabs": [ + { + "id": "default-main", + "name": "DomainTools", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "moved": false, + "name": "Expiration Status", + "static": false, + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "moved": false, + "name": "Verdict Status", + "static": false, + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "displayType": "ROW", + "h": 2, + "i": "domaintools-ip-geo", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipasn", + "height": 22, + "id": "dt-asn", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediporganization", + "height": 22, + "id": "dt-organization", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcity", + "height": 22, + "id": "dt-city", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcountry", + "height": 22, + "id": "dt-country", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplatitude", + "height": 22, + "id": "dt-latitude", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplongitude", + "height": 22, + "id": "dt-longitude", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipfeedtimestamp", + "height": 22, + "id": "dt-feed-timestamp", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "IP Geolocation", + "static": false, + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "i": "domaintools-ip-dns", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedippdnsresolutions", + "height": 22, + "id": "dt-pdns", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipbadpdnsresolutions", + "height": 22, + "id": "dt-bad-pdns", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediptotaldomains", + "height": 22, + "id": "dt-total-domains", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistdomains", + "height": 22, + "id": "dt-zerolist-domains", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistip", + "height": 22, + "id": "dt-zerolist-ip", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipthirdpartythreats", + "height": 22, + "id": "dt-third-party", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "DNS \u0026 Domain Stats", + "static": false, + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "domaintools-ip-threats", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedcount", + "height": 22, + "id": "dt-all-threats-count", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedpercent", + "height": 22, + "id": "dt-all-threats-combined-pct", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatsperecent", + "height": 22, + "id": "dt-all-threats-pct", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedphishingpercent", + "height": 22, + "id": "dt-combined-phishing", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedmalwarepercent", + "height": 22, + "id": "dt-combined-malware", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedspampercent", + "height": 22, + "id": "dt-combined-spam", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousphishing", + "height": 22, + "id": "dt-mal-phishing", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousmalware", + "height": 22, + "id": "dt-mal-malware", + "index": 7, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousspam", + "height": 22, + "id": "dt-mal-spam", + "index": 8, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentphishing", + "height": 22, + "id": "dt-pct-phishing", + "index": 9, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentmalware", + "height": 22, + "id": "dt-pct-malware", + "index": 10, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentspam", + "height": 22, + "id": "dt-pct-spam", + "index": 11, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedphishing", + "height": 22, + "id": "dt-comp-phishing", + "index": 12, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedmalware", + "height": 22, + "id": "dt-comp-malware", + "index": 13, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedspam", + "height": 22, + "id": "dt-comp-spam", + "index": 14, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedphishing", + "height": 22, + "id": "dt-pred-phishing", + "index": 15, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedmalware", + "height": 22, + "id": "dt-pred-malware", + "index": 16, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedspam", + "height": 22, + "id": "dt-pred-spam", + "index": 17, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "Threat Intelligence", + "static": false, + "w": 2, + "x": 0, + "y": 4 + }, + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "moved": false, + "name": "Relationships", + "static": false, + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 8 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "moved": false, + "name": "Related Incidents", + "static": false, + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 10 + } + ], + "type": "custom" + } + ] + }, + "edit": { + "sections": [ + { + "description": "", + "fields": [ + { + "fieldId": "indicator_value", + "isVisible": true + }, + { + "fieldId": "indicator_indicatortype", + "isVisible": true + }, + { + "fieldId": "indicator_score", + "isVisible": true + }, + { + "fieldId": "indicator_expiration", + "isVisible": true + }, + { + "fieldId": "indicator_comment", + "isVisible": true + }, + { + "fieldId": "indicator_investigationids", + "isVisible": true + } + ], + "isVisible": true, + "name": "Basic Information", + "query": null, + "queryType": "", + "readOnly": false, + "type": "basicInformationSection" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipasn", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplatitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplongitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcountry", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcity", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediporganization", + "isVisible": true + } + ], + "isVisible": true, + "name": "IP Geolocation", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedippdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipbadpdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediptotaldomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistdomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistip", + "isVisible": true + } + ], + "isVisible": true, + "name": "DNS \u0026 Domain Stats", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedcount", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatsperecent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedmalwarepercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedphishingpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedspampercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipthirdpartythreats", + "isVisible": true + } + ], + "isVisible": true, + "name": "Threat Intelligence", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_blocked", + "isVisible": true + }, + { + "fieldId": "indicator_communitynotes", + "isVisible": true + }, + { + "fieldId": "indicator_description", + "isVisible": true + }, + { + "fieldId": "indicator_firstseenbysource", + "isVisible": true + }, + { + "fieldId": "indicator_stixid", + "isVisible": true + }, + { + "fieldId": "indicator_tags", + "isVisible": true + }, + { + "fieldId": "indicator_targets", + "isVisible": true + }, + { + "fieldId": "indicator_trafficlightprotocol", + "isVisible": true + }, + { + "fieldId": "indicator_updateddate", + "isVisible": true + }, + { + "fieldId": "indicator_userid", + "isVisible": true + }, + { + "fieldId": "indicator_vendor", + "isVisible": true + }, + { + "fieldId": "indicator_version", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetectionnames", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetections", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginevendors", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerabilities", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerableproducts", + "isVisible": true + }, + { + "fieldId": "indicator_whoisrecords", + "isVisible": true + } + ], + "isVisible": true, + "name": "Custom Fields", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + } + ] + }, + "fromServerVersion": "0.0.0", + "group": "indicator", + "id": "DomainToolsFeed IP Indicator", + "indicatorsDetails": { + "TypeName": "", + "tabs": [ + { + "id": "default-main", + "name": "Info", + "sections": [ + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "name": "Relationships", + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 2 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 2 + }, + { + "displayType": "ROW", + "h": 2, + "i": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a", + "items": [ + { + "endCol": 2, + "fieldId": "indicatortype", + "height": 26, + "id": "indicator-type", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "modified", + "height": 26, + "id": "indicator-modified", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "expiration", + "height": 26, + "id": "indicator-expiration", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "timestamp", + "height": 26, + "id": "indicator-timestamp", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "name": "Basic Information", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 1, + "hideName": false, + "i": "default-main-actions", + "items": [ + { + "args": {}, + "endCol": 1, + "height": 44, + "index": 0, + "name": "Enrich indicator", + "scriptId": "Builtin|||enrichIndicators", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "height": 44, + "index": 1, + "name": "Expire indicator", + "scriptId": "Builtin|||expireIndicators", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Actions", + "type": "actions", + "w": 1, + "x": 2, + "y": 0 + }, + { + "displayType": "CARD", + "h": 2, + "i": "default-main-tagsAndTLP", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 53, + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "dropEffect": "move", + "endCol": 1, + "height": 53, + "index": 1, + "name": "Add tags", + "scriptId": "Builtin|||appendIndicatorField", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "trafficlightprotocol", + "height": 53, + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "endCol": 2, + "height": 53, + "index": 1, + "name": "Remove tags", + "scriptId": "Builtin|||removeIndicatorField", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags and TLP", + "type": "tagsAndTLP", + "w": 1, + "x": 2, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "default-main-indicatorTimeline", + "maxW": 3, + "name": "Timeline", + "type": "indicatorTimeline", + "w": 1, + "x": 2, + "y": 3 + }, + { + "h": 3, + "i": "default-main-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 2, + "y": 5 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "name": "Verdict Status", + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "default-main-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "hideName": false, + "i": "default-main-publications", + "items": [ + { + "endCol": 4, + "fieldId": "communitynotes", + "height": 106, + "id": "indicator-communitynotes-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 4, + "fieldId": "publications", + "height": 106, + "id": "indicator-publications-field", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Publications", + "type": "publications", + "w": 2, + "x": 0, + "y": 9 + } + ], + "type": "custom" + }, + { + "id": "canvas", + "name": "Canvas", + "type": "canvas" + } + ] + }, + "indicatorsQuickView": { + "TypeName": "", + "tabs": [ + { + "id": "indicator-quick-view-info", + "name": "Info", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "indicator-quick-view-info-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "indicator-quick-view-info-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 2, + "hideItemTitleOnlyOne": true, + "i": "indicator-quick-view-info-tags-section", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 22, + "id": "indicator-quick-view-info-tags-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags", + "w": 1, + "x": 0, + "y": 3 + }, + { + "h": 2, + "i": "indicator-quick-view-info-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 1, + "x": 0, + "y": 5 + }, + { + "h": 2, + "i": "indicator-quick-view-info-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 0, + "y": 7 + } + ], + "type": "custom" + } + ] + }, + "isOverridable": false, + "itemVersion": "", + "locked": false, + "mobile": null, + "name": "DomainToolsFeed IP Indicator", + "packID": "", + "packName": "", + "propagationLabels": [ + "all" + ], + "quickView": null, + "quickViewV2": null, + "system": false, + "toServerVersion": "99.99.99", + "version": -1 +} \ No newline at end of file From dc696292e4f72d4fa2193bcd364c8cbc35aae3d6 Mon Sep 17 00:00:00 2001 From: JD Babac Date: Tue, 18 Aug 2026 19:05:48 +0800 Subject: [PATCH 3/3] IDEV-2524: Fix pre-commit errors. --- ...rfield-domaintoolsfeedipfeedtimestamp.json | 2 +- .../indicatortype-DomainToolsFeed_IP.json | 11 +- .../FeedDomainTools/FeedDomainTools.py | 21 +- ...ontainer-DomainToolsFeed_IP_Indicator.json | 2024 ++++++++--------- 4 files changed, 1019 insertions(+), 1039 deletions(-) diff --git a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json index 0371221eba42..293769403f83 100644 --- a/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json +++ b/Packs/FeedDomainTools/IndicatorFields/indicatorfield-domaintoolsfeedipfeedtimestamp.json @@ -25,4 +25,4 @@ "sla": 0, "threshold": 72, "fromVersion": "5.5.0" -} +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json index 8c3b6de48182..9f57f067d6a6 100644 --- a/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json +++ b/Packs/FeedDomainTools/IndicatorTypes/indicatortype-DomainToolsFeed_IP.json @@ -4,22 +4,15 @@ "fromVersion": "6.0.0", "regex": "\\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(?:\\[\\.\\]|\\.)){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\\b", "details": "DomainToolsFeed IP", - "reputationScriptName": "", "reputationCommand": "ip", - "enhancementScriptNames": [], "system": false, "locked": false, "disabled": false, "file": false, "updateAfter": 0, "mergeContext": false, - "formatScript": "", - "contextPath": "IP(val.Address && val.Address === obj.Address)", + "contextPath": "IP(val.Address \u0026\u0026 val.Address === obj.Address)", "contextValue": "Address", - "excludedBrands": [], "expiration": 10080, - "defaultMapping": {}, - "manualMapping": null, - "fileHashesPriority": null, "layout": "DomainToolsFeed IP Indicator" -} +} \ No newline at end of file diff --git a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py index 6cbfde198546..a586b80e5b0f 100644 --- a/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py +++ b/Packs/FeedDomainTools/Integrations/FeedDomainTools/FeedDomainTools.py @@ -418,9 +418,8 @@ def fetch_indicators(client: DomainToolsClient, feed_type: str = "nod", dt_feed_ "rawJSON": raw_data, } - if timestamp_: - if type_ == "DomainToolsFeed IP": - indicator_obj["fields"]["domaintoolsfeedipfeedtimestamp"] = timestamp_ + if timestamp_ and type_ == "DomainToolsFeed IP": + indicator_obj["fields"]["domaintoolsfeedipfeedtimestamp"] = timestamp_ if tlp_color_: indicator_obj["fields"]["trafficlightprotocol"] = tlp_color_ @@ -438,11 +437,19 @@ def fetch_indicators(client: DomainToolsClient, feed_type: str = "nod", dt_feed_ indicator_obj["fields"]["domaintoolsfeedipzerolistdomains"] = ip_threat_data_.get("zerolist_domains") indicator_obj["fields"]["domaintoolsfeedipzerolistip"] = ip_threat_data_.get("zerolist_ip") indicator_obj["fields"]["domaintoolsfeedipthirdpartythreats"] = ip_threat_data_.get("third_party_threats") - indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedcount"] = ip_threat_data_.get("all_threats_combined_count") - indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedpercent"] = ip_threat_data_.get("all_threats_combined_percent") + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedcount"] = ip_threat_data_.get( + "all_threats_combined_count" + ) + indicator_obj["fields"]["domaintoolsfeedipallthreatscombinedpercent"] = ip_threat_data_.get( + "all_threats_combined_percent" + ) indicator_obj["fields"]["domaintoolsfeedipallthreatsperecent"] = ip_threat_data_.get("all_threats_percent") - indicator_obj["fields"]["domaintoolsfeedipcombinedphishingpercent"] = ip_threat_data_.get("combined_phishing_percent") - indicator_obj["fields"]["domaintoolsfeedipcombinedmalwarepercent"] = ip_threat_data_.get("combined_malware_percent") + indicator_obj["fields"]["domaintoolsfeedipcombinedphishingpercent"] = ip_threat_data_.get( + "combined_phishing_percent" + ) + indicator_obj["fields"]["domaintoolsfeedipcombinedmalwarepercent"] = ip_threat_data_.get( + "combined_malware_percent" + ) indicator_obj["fields"]["domaintoolsfeedipcombinedspampercent"] = ip_threat_data_.get("combined_spam_percent") indicator_obj["fields"]["domaintoolsfeedipmaliciousphishing"] = ip_threat_data_.get("malicious_phishing") indicator_obj["fields"]["domaintoolsfeedipmaliciousmalware"] = ip_threat_data_.get("malicious_malware") diff --git a/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json index 1f1355f6632f..f34f0d420d51 100644 --- a/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json +++ b/Packs/FeedDomainTools/Layouts/layoutscontainer-DomainToolsFeed_IP_Indicator.json @@ -1,1024 +1,1004 @@ { - "cacheVersn": 0, - "close": null, - "definitionId": "", - "description": "DomainToolsFeed IP Indicator Layout", - "detached": false, - "details": null, - "detailsV2": { - "TypeName": "DomainToolsFeed IP", - "tabs": [ - { - "id": "default-main", - "name": "DomainTools", - "sections": [ - { - "h": 1, - "hideName": true, - "i": "default-main-expirationStatus", - "maxW": 3, - "moved": false, - "name": "Expiration Status", - "static": false, - "type": "expirationStatus", - "w": 1, - "x": 0, - "y": 0 - }, - { - "h": 1, - "hideName": true, - "i": "default-main-reputationStatus", - "maxW": 3, - "moved": false, - "name": "Verdict Status", - "static": false, - "type": "reputationStatus", - "w": 1, - "x": 1, - "y": 0 - }, - { - "displayType": "ROW", - "h": 2, - "i": "domaintools-ip-geo", - "items": [ - { - "endCol": 2, - "fieldId": "domaintoolsfeedipasn", - "height": 22, - "id": "dt-asn", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeediporganization", - "height": 22, - "id": "dt-organization", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcity", - "height": 22, - "id": "dt-city", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcountry", - "height": 22, - "id": "dt-country", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeediplatitude", - "height": 22, - "id": "dt-latitude", - "index": 4, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeediplongitude", - "height": 22, - "id": "dt-longitude", - "index": 5, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipfeedtimestamp", - "height": 22, - "id": "dt-feed-timestamp", - "index": 6, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "moved": false, - "name": "IP Geolocation", - "static": false, - "w": 1, - "x": 0, - "y": 1 - }, - { - "displayType": "ROW", - "h": 3, - "i": "domaintools-ip-dns", - "items": [ - { - "endCol": 2, - "fieldId": "domaintoolsfeedippdnsresolutions", - "height": 22, - "id": "dt-pdns", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipbadpdnsresolutions", - "height": 22, - "id": "dt-bad-pdns", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeediptotaldomains", - "height": 22, - "id": "dt-total-domains", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipzerolistdomains", - "height": 22, - "id": "dt-zerolist-domains", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipzerolistip", - "height": 22, - "id": "dt-zerolist-ip", - "index": 4, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipthirdpartythreats", - "height": 22, - "id": "dt-third-party", - "index": 5, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "moved": false, - "name": "DNS \u0026 Domain Stats", - "static": false, - "w": 1, - "x": 1, - "y": 1 - }, - { - "displayType": "ROW", - "h": 4, - "i": "domaintools-ip-threats", - "items": [ - { - "endCol": 2, - "fieldId": "domaintoolsfeedipallthreatscombinedcount", - "height": 22, - "id": "dt-all-threats-count", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipallthreatscombinedpercent", - "height": 22, - "id": "dt-all-threats-combined-pct", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipallthreatsperecent", - "height": 22, - "id": "dt-all-threats-pct", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcombinedphishingpercent", - "height": 22, - "id": "dt-combined-phishing", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcombinedmalwarepercent", - "height": 22, - "id": "dt-combined-malware", - "index": 4, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcombinedspampercent", - "height": 22, - "id": "dt-combined-spam", - "index": 5, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipmaliciousphishing", - "height": 22, - "id": "dt-mal-phishing", - "index": 6, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipmaliciousmalware", - "height": 22, - "id": "dt-mal-malware", - "index": 7, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipmaliciousspam", - "height": 22, - "id": "dt-mal-spam", - "index": 8, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippercentphishing", - "height": 22, - "id": "dt-pct-phishing", - "index": 9, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippercentmalware", - "height": 22, - "id": "dt-pct-malware", - "index": 10, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippercentspam", - "height": 22, - "id": "dt-pct-spam", - "index": 11, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcompromisedphishing", - "height": 22, - "id": "dt-comp-phishing", - "index": 12, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcompromisedmalware", - "height": 22, - "id": "dt-comp-malware", - "index": 13, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedipcompromisedspam", - "height": 22, - "id": "dt-comp-spam", - "index": 14, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippredictedphishing", - "height": 22, - "id": "dt-pred-phishing", - "index": 15, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippredictedmalware", - "height": 22, - "id": "dt-pred-malware", - "index": 16, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "domaintoolsfeedippredictedspam", - "height": 22, - "id": "dt-pred-spam", - "index": 17, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "moved": false, - "name": "Threat Intelligence", - "static": false, - "w": 2, - "x": 0, - "y": 4 - }, - { - "h": 2, - "i": "default-main-relationshipsTable", - "maxW": 3, - "moved": false, - "name": "Relationships", - "static": false, - "type": "relationshipsTable", - "w": 2, - "x": 0, - "y": 8 - }, - { - "h": 2, - "i": "default-main-relatedIncidents", - "maxW": 3, - "moved": false, - "name": "Related Incidents", - "static": false, - "type": "relatedIncidents", - "w": 2, - "x": 0, - "y": 10 - } - ], - "type": "custom" - } - ] - }, - "edit": { - "sections": [ - { - "description": "", - "fields": [ - { - "fieldId": "indicator_value", - "isVisible": true - }, - { - "fieldId": "indicator_indicatortype", - "isVisible": true - }, - { - "fieldId": "indicator_score", - "isVisible": true - }, - { - "fieldId": "indicator_expiration", - "isVisible": true - }, - { - "fieldId": "indicator_comment", - "isVisible": true - }, - { - "fieldId": "indicator_investigationids", - "isVisible": true - } - ], - "isVisible": true, - "name": "Basic Information", - "query": null, - "queryType": "", - "readOnly": false, - "type": "basicInformationSection" - }, - { - "description": "", - "fields": [ - { - "fieldId": "indicator_domaintoolsfeedipasn", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeediplatitude", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeediplongitude", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcountry", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcity", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeediporganization", - "isVisible": true - } - ], - "isVisible": true, - "name": "IP Geolocation", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - }, - { - "description": "", - "fields": [ - { - "fieldId": "indicator_domaintoolsfeedippdnsresolutions", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipbadpdnsresolutions", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeediptotaldomains", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipzerolistdomains", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipzerolistip", - "isVisible": true - } - ], - "isVisible": true, - "name": "DNS \u0026 Domain Stats", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - }, - { - "description": "", - "fields": [ - { - "fieldId": "indicator_domaintoolsfeedipallthreatscombinedcount", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipallthreatscombinedpercent", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipallthreatsperecent", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcombinedmalwarepercent", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcombinedphishingpercent", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcombinedspampercent", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcompromisedmalware", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcompromisedphishing", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipcompromisedspam", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipmaliciousmalware", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipmaliciousphishing", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipmaliciousspam", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippercentmalware", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippercentphishing", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippercentspam", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippredictedmalware", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippredictedphishing", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedippredictedspam", - "isVisible": true - }, - { - "fieldId": "indicator_domaintoolsfeedipthirdpartythreats", - "isVisible": true - } - ], - "isVisible": true, - "name": "Threat Intelligence", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - }, - { - "description": "", - "fields": [ - { - "fieldId": "indicator_blocked", - "isVisible": true - }, - { - "fieldId": "indicator_communitynotes", - "isVisible": true - }, - { - "fieldId": "indicator_description", - "isVisible": true - }, - { - "fieldId": "indicator_firstseenbysource", - "isVisible": true - }, - { - "fieldId": "indicator_stixid", - "isVisible": true - }, - { - "fieldId": "indicator_tags", - "isVisible": true - }, - { - "fieldId": "indicator_targets", - "isVisible": true - }, - { - "fieldId": "indicator_trafficlightprotocol", - "isVisible": true - }, - { - "fieldId": "indicator_updateddate", - "isVisible": true - }, - { - "fieldId": "indicator_userid", - "isVisible": true - }, - { - "fieldId": "indicator_vendor", - "isVisible": true - }, - { - "fieldId": "indicator_version", - "isVisible": true - }, - { - "fieldId": "indicator_vtenginedetectionnames", - "isVisible": true - }, - { - "fieldId": "indicator_vtenginedetections", - "isVisible": true - }, - { - "fieldId": "indicator_vtenginevendors", - "isVisible": true - }, - { - "fieldId": "indicator_vulnerabilities", - "isVisible": true - }, - { - "fieldId": "indicator_vulnerableproducts", - "isVisible": true - }, - { - "fieldId": "indicator_whoisrecords", - "isVisible": true - } - ], - "isVisible": true, - "name": "Custom Fields", - "query": null, - "queryType": "", - "readOnly": false, - "type": "" - } - ] - }, - "fromServerVersion": "0.0.0", - "group": "indicator", - "id": "DomainToolsFeed IP Indicator", - "indicatorsDetails": { - "TypeName": "", - "tabs": [ - { - "id": "default-main", - "name": "Info", - "sections": [ - { - "h": 2, - "i": "default-main-relationshipsTable", - "maxW": 3, - "name": "Relationships", - "type": "relationshipsTable", - "w": 2, - "x": 0, - "y": 2 - }, - { - "h": 2, - "i": "default-main-relatedIncidents", - "maxW": 3, - "name": "Related Incidents", - "type": "relatedIncidents", - "w": 2, - "x": 0, - "y": 2 - }, - { - "displayType": "ROW", - "h": 2, - "i": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a", - "items": [ - { - "endCol": 2, - "fieldId": "indicatortype", - "height": 26, - "id": "indicator-type", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "modified", - "height": 26, - "id": "indicator-modified", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "expiration", - "height": 26, - "id": "indicator-expiration", - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "timestamp", - "height": 26, - "id": "indicator-timestamp", - "index": 3, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "name": "Basic Information", - "w": 1, - "x": 0, - "y": 1 - }, - { - "displayType": "ROW", - "h": 1, - "hideName": false, - "i": "default-main-actions", - "items": [ - { - "args": {}, - "endCol": 1, - "height": 44, - "index": 0, - "name": "Enrich indicator", - "scriptId": "Builtin|||enrichIndicators", - "sectionItemType": "button", - "startCol": 0 - }, - { - "endCol": 2, - "height": 44, - "index": 1, - "name": "Expire indicator", - "scriptId": "Builtin|||expireIndicators", - "sectionItemType": "button", - "startCol": 1 - } - ], - "maxW": 3, - "minH": 1, - "name": "Actions", - "type": "actions", - "w": 1, - "x": 2, - "y": 0 - }, - { - "displayType": "CARD", - "h": 2, - "i": "default-main-tagsAndTLP", - "items": [ - { - "endCol": 2, - "fieldId": "tags", - "height": 53, - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "args": { - "field": { - "simple": "tags" - } - }, - "dropEffect": "move", - "endCol": 1, - "height": 53, - "index": 1, - "name": "Add tags", - "scriptId": "Builtin|||appendIndicatorField", - "sectionItemType": "button", - "startCol": 0 - }, - { - "endCol": 2, - "fieldId": "trafficlightprotocol", - "height": 53, - "index": 2, - "sectionItemType": "field", - "startCol": 0 - }, - { - "args": { - "field": { - "simple": "tags" - } - }, - "endCol": 2, - "height": 53, - "index": 1, - "name": "Remove tags", - "scriptId": "Builtin|||removeIndicatorField", - "sectionItemType": "button", - "startCol": 1 - } - ], - "maxW": 3, - "minH": 1, - "name": "Tags and TLP", - "type": "tagsAndTLP", - "w": 1, - "x": 2, - "y": 1 - }, - { - "displayType": "ROW", - "h": 4, - "i": "default-main-indicatorTimeline", - "maxW": 3, - "name": "Timeline", - "type": "indicatorTimeline", - "w": 1, - "x": 2, - "y": 3 - }, - { - "h": 3, - "i": "default-main-comments", - "maxW": 3, - "name": "Comments", - "type": "comments", - "w": 1, - "x": 2, - "y": 5 - }, - { - "h": 1, - "hideName": true, - "i": "default-main-reputationStatus", - "maxW": 3, - "name": "Verdict Status", - "type": "reputationStatus", - "w": 1, - "x": 1, - "y": 0 - }, - { - "h": 1, - "hideName": true, - "i": "default-main-expirationStatus", - "maxW": 3, - "name": "Expiration Status", - "type": "expirationStatus", - "w": 1, - "x": 0, - "y": 0 - }, - { - "h": 2, - "i": "default-main-reputationSources", - "maxW": 3, - "name": "Verdict", - "type": "reputationSources", - "w": 1, - "x": 1, - "y": 1 - }, - { - "displayType": "ROW", - "h": 3, - "hideName": false, - "i": "default-main-publications", - "items": [ - { - "endCol": 4, - "fieldId": "communitynotes", - "height": 106, - "id": "indicator-communitynotes-field", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - }, - { - "endCol": 4, - "fieldId": "publications", - "height": 106, - "id": "indicator-publications-field", - "index": 1, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "name": "Publications", - "type": "publications", - "w": 2, - "x": 0, - "y": 9 - } - ], - "type": "custom" - }, - { - "id": "canvas", - "name": "Canvas", - "type": "canvas" - } - ] - }, - "indicatorsQuickView": { - "TypeName": "", - "tabs": [ - { - "id": "indicator-quick-view-info", - "name": "Info", - "sections": [ - { - "h": 1, - "hideName": true, - "i": "indicator-quick-view-info-expirationStatus", - "maxW": 3, - "name": "Expiration Status", - "type": "expirationStatus", - "w": 1, - "x": 0, - "y": 0 - }, - { - "h": 2, - "i": "indicator-quick-view-info-reputationSources", - "maxW": 3, - "name": "Verdict", - "type": "reputationSources", - "w": 1, - "x": 0, - "y": 1 - }, - { - "displayType": "ROW", - "h": 2, - "hideItemTitleOnlyOne": true, - "i": "indicator-quick-view-info-tags-section", - "items": [ - { - "endCol": 2, - "fieldId": "tags", - "height": 22, - "id": "indicator-quick-view-info-tags-field", - "index": 0, - "sectionItemType": "field", - "startCol": 0 - } - ], - "maxW": 3, - "minH": 1, - "name": "Tags", - "w": 1, - "x": 0, - "y": 3 - }, - { - "h": 2, - "i": "indicator-quick-view-info-relatedIncidents", - "maxW": 3, - "name": "Related Incidents", - "type": "relatedIncidents", - "w": 1, - "x": 0, - "y": 5 - }, - { - "h": 2, - "i": "indicator-quick-view-info-comments", - "maxW": 3, - "name": "Comments", - "type": "comments", - "w": 1, - "x": 0, - "y": 7 - } - ], - "type": "custom" - } - ] - }, - "isOverridable": false, - "itemVersion": "", - "locked": false, - "mobile": null, - "name": "DomainToolsFeed IP Indicator", - "packID": "", - "packName": "", - "propagationLabels": [ - "all" - ], - "quickView": null, - "quickViewV2": null, - "system": false, - "toServerVersion": "99.99.99", - "version": -1 + "description": "DomainToolsFeed IP Indicator Layout", + "detailsV2": { + "tabs": [ + { + "id": "default-main", + "name": "DomainTools", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "moved": false, + "name": "Expiration Status", + "static": false, + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "moved": false, + "name": "Verdict Status", + "static": false, + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "displayType": "ROW", + "h": 2, + "i": "domaintools-ip-geo", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipasn", + "height": 22, + "id": "dt-asn", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediporganization", + "height": 22, + "id": "dt-organization", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcity", + "height": 22, + "id": "dt-city", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcountry", + "height": 22, + "id": "dt-country", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplatitude", + "height": 22, + "id": "dt-latitude", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediplongitude", + "height": 22, + "id": "dt-longitude", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipfeedtimestamp", + "height": 22, + "id": "dt-feed-timestamp", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "IP Geolocation", + "static": false, + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "i": "domaintools-ip-dns", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedippdnsresolutions", + "height": 22, + "id": "dt-pdns", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipbadpdnsresolutions", + "height": 22, + "id": "dt-bad-pdns", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeediptotaldomains", + "height": 22, + "id": "dt-total-domains", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistdomains", + "height": 22, + "id": "dt-zerolist-domains", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipzerolistip", + "height": 22, + "id": "dt-zerolist-ip", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipthirdpartythreats", + "height": 22, + "id": "dt-third-party", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "DNS \u0026 Domain Stats", + "static": false, + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "domaintools-ip-threats", + "items": [ + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedcount", + "height": 22, + "id": "dt-all-threats-count", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatscombinedpercent", + "height": 22, + "id": "dt-all-threats-combined-pct", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipallthreatsperecent", + "height": 22, + "id": "dt-all-threats-pct", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedphishingpercent", + "height": 22, + "id": "dt-combined-phishing", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedmalwarepercent", + "height": 22, + "id": "dt-combined-malware", + "index": 4, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcombinedspampercent", + "height": 22, + "id": "dt-combined-spam", + "index": 5, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousphishing", + "height": 22, + "id": "dt-mal-phishing", + "index": 6, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousmalware", + "height": 22, + "id": "dt-mal-malware", + "index": 7, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipmaliciousspam", + "height": 22, + "id": "dt-mal-spam", + "index": 8, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentphishing", + "height": 22, + "id": "dt-pct-phishing", + "index": 9, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentmalware", + "height": 22, + "id": "dt-pct-malware", + "index": 10, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippercentspam", + "height": 22, + "id": "dt-pct-spam", + "index": 11, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedphishing", + "height": 22, + "id": "dt-comp-phishing", + "index": 12, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedmalware", + "height": 22, + "id": "dt-comp-malware", + "index": 13, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedipcompromisedspam", + "height": 22, + "id": "dt-comp-spam", + "index": 14, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedphishing", + "height": 22, + "id": "dt-pred-phishing", + "index": 15, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedmalware", + "height": 22, + "id": "dt-pred-malware", + "index": 16, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "domaintoolsfeedippredictedspam", + "height": 22, + "id": "dt-pred-spam", + "index": 17, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "moved": false, + "name": "Threat Intelligence", + "static": false, + "w": 2, + "x": 0, + "y": 4 + }, + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "moved": false, + "name": "Relationships", + "static": false, + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 8 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "moved": false, + "name": "Related Incidents", + "static": false, + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 10 + } + ], + "type": "custom" + } + ] + }, + "edit": { + "sections": [ + { + "description": "", + "fields": [ + { + "fieldId": "indicator_value", + "isVisible": true + }, + { + "fieldId": "indicator_indicatortype", + "isVisible": true + }, + { + "fieldId": "indicator_score", + "isVisible": true + }, + { + "fieldId": "indicator_expiration", + "isVisible": true + }, + { + "fieldId": "indicator_comment", + "isVisible": true + }, + { + "fieldId": "indicator_investigationids", + "isVisible": true + } + ], + "isVisible": true, + "name": "Basic Information", + "query": null, + "queryType": "", + "readOnly": false, + "type": "basicInformationSection" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipasn", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplatitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediplongitude", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcountry", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcity", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediporganization", + "isVisible": true + } + ], + "isVisible": true, + "name": "IP Geolocation", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedippdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipbadpdnsresolutions", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeediptotaldomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistdomains", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipzerolistip", + "isVisible": true + } + ], + "isVisible": true, + "name": "DNS \u0026 Domain Stats", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedcount", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatscombinedpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipallthreatsperecent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedmalwarepercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedphishingpercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcombinedspampercent", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipcompromisedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipmaliciousspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippercentspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedmalware", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedphishing", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedippredictedspam", + "isVisible": true + }, + { + "fieldId": "indicator_domaintoolsfeedipthirdpartythreats", + "isVisible": true + } + ], + "isVisible": true, + "name": "Threat Intelligence", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + }, + { + "description": "", + "fields": [ + { + "fieldId": "indicator_blocked", + "isVisible": true + }, + { + "fieldId": "indicator_communitynotes", + "isVisible": true + }, + { + "fieldId": "indicator_description", + "isVisible": true + }, + { + "fieldId": "indicator_firstseenbysource", + "isVisible": true + }, + { + "fieldId": "indicator_stixid", + "isVisible": true + }, + { + "fieldId": "indicator_tags", + "isVisible": true + }, + { + "fieldId": "indicator_targets", + "isVisible": true + }, + { + "fieldId": "indicator_trafficlightprotocol", + "isVisible": true + }, + { + "fieldId": "indicator_updateddate", + "isVisible": true + }, + { + "fieldId": "indicator_userid", + "isVisible": true + }, + { + "fieldId": "indicator_vendor", + "isVisible": true + }, + { + "fieldId": "indicator_version", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetectionnames", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginedetections", + "isVisible": true + }, + { + "fieldId": "indicator_vtenginevendors", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerabilities", + "isVisible": true + }, + { + "fieldId": "indicator_vulnerableproducts", + "isVisible": true + }, + { + "fieldId": "indicator_whoisrecords", + "isVisible": true + } + ], + "isVisible": true, + "name": "Custom Fields", + "query": null, + "queryType": "", + "readOnly": false, + "type": "" + } + ] + }, + "group": "indicator", + "id": "DomainToolsFeed IP Indicator", + "indicatorsDetails": { + "tabs": [ + { + "id": "default-main", + "name": "Info", + "sections": [ + { + "h": 2, + "i": "default-main-relationshipsTable", + "maxW": 3, + "name": "Relationships", + "type": "relationshipsTable", + "w": 2, + "x": 0, + "y": 2 + }, + { + "h": 2, + "i": "default-main-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 2, + "x": 0, + "y": 2 + }, + { + "displayType": "ROW", + "h": 2, + "i": "default-main-e2c8c970-a09d-11e9-8956-390f602b039a", + "items": [ + { + "endCol": 2, + "fieldId": "indicatortype", + "height": 26, + "id": "indicator-type", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "modified", + "height": 26, + "id": "indicator-modified", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "expiration", + "height": 26, + "id": "indicator-expiration", + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "timestamp", + "height": 26, + "id": "indicator-timestamp", + "index": 3, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "name": "Basic Information", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 1, + "hideName": false, + "i": "default-main-actions", + "items": [ + { + "args": {}, + "endCol": 1, + "height": 44, + "index": 0, + "name": "Enrich indicator", + "scriptId": "Builtin|||enrichIndicators", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "height": 44, + "index": 1, + "name": "Expire indicator", + "scriptId": "Builtin|||expireIndicators", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Actions", + "type": "actions", + "w": 1, + "x": 2, + "y": 0 + }, + { + "displayType": "CARD", + "h": 2, + "i": "default-main-tagsAndTLP", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 53, + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "dropEffect": "move", + "endCol": 1, + "height": 53, + "index": 1, + "name": "Add tags", + "scriptId": "Builtin|||appendIndicatorField", + "sectionItemType": "button", + "startCol": 0 + }, + { + "endCol": 2, + "fieldId": "trafficlightprotocol", + "height": 53, + "index": 2, + "sectionItemType": "field", + "startCol": 0 + }, + { + "args": { + "field": { + "simple": "tags" + } + }, + "endCol": 2, + "height": 53, + "index": 1, + "name": "Remove tags", + "scriptId": "Builtin|||removeIndicatorField", + "sectionItemType": "button", + "startCol": 1 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags and TLP", + "type": "tagsAndTLP", + "w": 1, + "x": 2, + "y": 1 + }, + { + "displayType": "ROW", + "h": 4, + "i": "default-main-indicatorTimeline", + "maxW": 3, + "name": "Timeline", + "type": "indicatorTimeline", + "w": 1, + "x": 2, + "y": 3 + }, + { + "h": 3, + "i": "default-main-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 2, + "y": 5 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-reputationStatus", + "maxW": 3, + "name": "Verdict Status", + "type": "reputationStatus", + "w": 1, + "x": 1, + "y": 0 + }, + { + "h": 1, + "hideName": true, + "i": "default-main-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "default-main-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 1, + "y": 1 + }, + { + "displayType": "ROW", + "h": 3, + "hideName": false, + "i": "default-main-publications", + "items": [ + { + "endCol": 4, + "fieldId": "communitynotes", + "height": 106, + "id": "indicator-communitynotes-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + }, + { + "endCol": 4, + "fieldId": "publications", + "height": 106, + "id": "indicator-publications-field", + "index": 1, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Publications", + "type": "publications", + "w": 2, + "x": 0, + "y": 9 + } + ], + "type": "custom" + }, + { + "id": "canvas", + "name": "Canvas", + "type": "canvas" + } + ] + }, + "indicatorsQuickView": { + "tabs": [ + { + "id": "indicator-quick-view-info", + "name": "Info", + "sections": [ + { + "h": 1, + "hideName": true, + "i": "indicator-quick-view-info-expirationStatus", + "maxW": 3, + "name": "Expiration Status", + "type": "expirationStatus", + "w": 1, + "x": 0, + "y": 0 + }, + { + "h": 2, + "i": "indicator-quick-view-info-reputationSources", + "maxW": 3, + "name": "Verdict", + "type": "reputationSources", + "w": 1, + "x": 0, + "y": 1 + }, + { + "displayType": "ROW", + "h": 2, + "hideItemTitleOnlyOne": true, + "i": "indicator-quick-view-info-tags-section", + "items": [ + { + "endCol": 2, + "fieldId": "tags", + "height": 22, + "id": "indicator-quick-view-info-tags-field", + "index": 0, + "sectionItemType": "field", + "startCol": 0 + } + ], + "maxW": 3, + "minH": 1, + "name": "Tags", + "w": 1, + "x": 0, + "y": 3 + }, + { + "h": 2, + "i": "indicator-quick-view-info-relatedIncidents", + "maxW": 3, + "name": "Related Incidents", + "type": "relatedIncidents", + "w": 1, + "x": 0, + "y": 5 + }, + { + "h": 2, + "i": "indicator-quick-view-info-comments", + "maxW": 3, + "name": "Comments", + "type": "comments", + "w": 1, + "x": 0, + "y": 7 + } + ], + "type": "custom" + } + ] + }, + "name": "DomainToolsFeed IP Indicator", + "system": false, + "version": -1, + "fromVersion": "0.0.0" } \ No newline at end of file