Reputation scripts - Reputation scripts for indicator enrichment. - Threat Intel Management Guide - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Reputation scripts are used to assess and assign reputation scores to indicators. These scripts integrate external threat intelligence or internal data sources to evaluate the reputation of indicators (such as IP addresses, URLs, or file hashes). Reputation scripts enable you to implement custom logic and algorithms for determining the reputation of indicators.

Reputation scripts return the verdict of an indicator as a number. The number overrides the verdict returned from the reputation command and any default settings for the indicator that relates to the verdict, but does not override a manually set verdict.

The system automatically executes the reputation script in the following cases:

The reliability of the score from a reputation script is by default A++ - Reputation script.

You can modify the reliability by navigating to Settings & Info → Settings → System → Server Settings → + Add Server Configuration and adding the server configuration enrichment.reputationScript.reliability with the desired reliability score.

You can create a new reputation script, or you can use an out-of-the-box reputation script in the Scripts page, for example:

Reputation Script input

The reputation requires a single input argument named input that accepts an indicator value.

Argument	Description
input	The indicator value.

from CommonServerPython import *


def main():
    url_list = argToList(demisto.args().get('input'))
    entry_list = []

    for url in url_list:
        entry_list.append({
            'Type': entryTypes['note'],
            'ContentsFormat': formats['json'],
            'Contents': 2,
            'EntryContext': {
                'DBotScore': {
                    'Indicator': url,
                    'Type': 'Onion URL',
                    'Score': 2,  # suspicious
                    'Vendor': 'DBot'
                }
            }
        })

    demisto.results(entry_list)


if __name__ in ('__main__', 'builtin', 'builtins'):
    main()