Generic reputation commands - Developer Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM supports many integrations with reputation providers, for example, VirusTotal, AlienVault OTX, and MISP. Every integration that returns a reputation about an indicator must implement the generic reputation commands and calculate a DBot Score.

When creating commands that enrich indicators, the commands should be named according to the indicator, such as !ip and !domain. This naming convention allows commands from multiple integrations to be run together to enrich an indicator. For example, running !ip ip=8.8.8.8 can trigger multiple integrations that gather information about the IP address.

The recommended way to return indicator context is using one of the classes under Common (Common.IP, Common.URL). For more information, see Return IP Reputation in Context and outputs. An example of returning indicators is the IPinfo v2 integration.

The following are available generic reputation commands.

- name: file
   arguments:
   - name: file
     default: true
     description: List of files.
     isArray: true

- name: ip
   arguments:
   - name: ip
     default: true
     description: List of IPs.
     isArray: true

- name: url
   arguments:
   - name: url
     default: true
     description: List of URLs.
     isArray: true

- name: domain
   arguments:
   - name: domain
     default: true
     description: List of domains.
     isArray: true

- name: email
   arguments:
   - name: email
     default: true
     description: List of emails.
     isArray: true

- name: cve
   arguments:
   - name: cve
     default: true
     description: List of CVEs.
     isArray: true