APIVoid

LAST UPDATED: 06/10/2024

Overview

APIVoid provides JSON APIs useful for cyber threat analysis, threat detection and threat prevention, reducing and automating the manual work of security analysts.

D3 SOAR is providing REST operations to function with APIVoid.

APIVoid is available for use in:

D3 SOAR	V14.0.316+
Category	Threat Intelligence
Deployment Options	Option II, Option IV

Known Limitations

Command	Limits
Check IP Reputation	You need to limit requests to a maximum of 2-3 requests per second. Before starting new requests, wait until the previous ones have finished. These rules will ensure our APIs run smoothly for all users. Occasional small peaks should not cause problems, but we ask you to limit the requests on your end. We may add requests per second restrictions on APIVoid from our side in the coming months. Please note that if we notice you make too many requests per second continuously, we may restrict usage of our APIs on your account. In case our servers are handling too many requests, you may get a 502 HTTP status code.
Check URL Reputation	You need to limit requests per second to a maximum of 2-3 requests. Before starting new requests, wait until the previous ones have finished. These rules will ensure our APIs run smoothly for all users. Occasional small peaks should not cause problems, but we ask you to limit the requests on your end. We may add requests per second restrictions on APIVoid from our side in the coming months. Please note that if we notice you making too many requests per second continuously, we may restrict the usage of our APIs on your account. If our servers are handling too many requests, you may receive a 502 HTTP status code.
Check Domain Reputation	You need to limit requests per second to a maximum of 3-5 requests. Before starting new requests, wait until the previous ones have finished. These rules will ensure our APIs run smoothly for all users. Occasional small peaks should not cause problems, but we ask you to limit the requests on your end. We may add requests per second restrictions on APIVoid from our side in the coming months. Please note that if we notice you making too many requests per second continuously, we may restrict the usage of our APIs on your account. If our servers are handling too many requests, you may receive a 502 HTTP status code.
Check Email Reputation	You need to limit requests per second to a maximum of 3-5 requests. Before starting new requests, wait until the previous ones have finished. These rules will ensure our APIs run smoothly for all users. Occasional small peaks should not cause problems, but we ask you to limit the requests on your end. We may add requests per second restrictions on APIVoid from our side in the coming months. Please note that if we notice you making too many requests per second continuously, we may restrict the usage of our APIs on your account. If our servers are handling too many requests, you may receive a 502 HTTP status code.
Get Screenshot	You need to limit requests per second to a maximum of 2-3 requests. Before starting new requests, wait until the previous ones have finished. These rules will ensure our APIs run smoothly for all users. Occasional small peaks should not cause problems, but we ask you to limit the requests on your end. We may add requests per second restrictions on APIVoid from our side in the coming months. Please note that if we notice you making too many requests per second continuously, we may restrict the usage of our APIs on your account. If our servers are handling too many requests, you may receive a 502 HTTP status code.

You can check APIVoid uptime on the status page. For more information about rate limits, please refer to APIVoid Documentation for detailed information.

Connection

To connect to APIVoid from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The URL of the APIVoid server.	https://endpoint.apivoid.com
API Key	The API key used to authenticate the API connection.	2e0************************ba2
API Version	The version of the API to use for the connection.	v1

Configuring APIVoid to Work with D3 SOAR

Log into the APIVoid web interface.
Visit the Dashboard to check the remaining credits.
Having zero credit will result in the failure of all commands, including the Test Connection command.
The Test Connection command and any unsuccessful API calls will not consume credits.
Click “Buy More Credits” if you are out of credits.

Click on My API Keys, and select Add API Key.

Save the API Key.

READER NOTE

Credits are valid for one year only. You can add or modify your API keys. Ensure that the API keys in VSOC are current.

WARNING

Too many requests with an incorrect API key will trigger an ERROR, locking the IP address. Please reach out to customer support or wait approximately one hour for the lock to be lifted.

Configuring D3 SOAR to Work with APIVoid

Log in to D3 SOAR.
Find the APIVoid integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type APIVoid in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to APIVoid.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System Reputation Check: Checking one or more reputation check tick boxes will run the corresponding check reputation command(s) under this integration connection to enrich the corresponding artifacts with reputation details.
  For example, we are configuring an integration connection named “ConnectionA” with the site “Sandbox”. All IP artifacts from the “Sandbox” site will go through a reputation check using the Check IP Reputation command from that integration. The return data output from running the command will then be used to update the risk level of the artifacts which may affect the risk level of incoming events.
10. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input the Server URL. The default value is https://endpoint.apivoid.com.
  2. Copy the API Key from the APIVoid platform.
  3. Input the API Version. The default value is v1.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
12. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tick box. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

APIVoid includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the APIVoid API, please refer to the APIVoid API reference.

Check IP Reputation

Checks the risk level of Public IPv4 addresses.

Input

Input Parameter

Required/Optional

Description

Example

IPs

Required

The public IPv4 address(es) used to check IP reputation.

[

"***.***.***.***"

]

Output

Return Data

In check reputation commands, Return Data displays the risk score from the raw data as D3-defined Risk Scores and Risk Levels. This will be used to enrich artifacts with reputation information.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "data": {
            "report": {
                "ip": "***.***.***.***",
                "blacklists": {
                    "engines": {
                        "0": {
                            "engine": "Barracuda_Reputation_BL",
                            "detected": false,
                            "reference": "http://www.*****.com/",
                            "elapsed": "0.03"
                        },
                        "1": {
                            "engine": "BlockedServersRBL",
                            "detected": false,
                            "reference": "https://www.*****.com/",
                            "elapsed": "0.03"
                        },
                        "2": {
                            "engine": "EFnet_RBL",
                            "detected": false,
                            "reference": "https://***.*****.***/*****",
                            "elapsed": "0.03"
                        },
                        "3": {
                            "engine": "IBM_Cobion",
                            "detected": false,
                            "reference": "https://***.***.***/***/",
                            "elapsed": "0.02"
                        },
                        "4": {
                            "engine": "JustSpam_org",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.04"
                        },
                        "5": {
                            "engine": "Known Scanning Service",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "6": {
                            "engine": "RealtimeBLACKLIST",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.02"
                        },
                        "7": {
                            "engine": "S5hbl",
                            "detected": false,
                            "reference": "http://www.*****.***/*****/*****",
                            "elapsed": "0.23"
                        },
                        "8": {
                            "engine": "Anti-Attacks BL",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "9": {
                            "engine": "AntiSpam_by_CleanTalk",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "10": {
                            "engine": "APEWS-L2",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "11": {
                            "engine": "AZORult Tracker",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "12": {
                            "engine": "Backscatterer",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "13": {
                            "engine": "Blacklists_co",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "elapsed": "0.00"
                        },
                        "14": {
                            "engine": "BlockList_de",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "15": {
                            "engine": "*****.***",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "16": {
                            "engine": "BloggingFusion BL",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "17": {
                            "engine": "*****.***",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "18": {
                            "engine": "Brute Force Blocker",
                            "detected": false,
                            "reference": "https://*****.***.***/***/***/",
                            "elapsed": "0.00"
                        },
                        "19": {
                            "engine": "C-APT-ure",
                            "detected": false,
                            "reference": "http://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "20": {
                            "engine": "CERT-PA",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "21": {
                            "engine": "*****.***.***",
                            "detected": false,
                            "reference": "http://www.*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "22": {
                            "engine": "Charles Haley",
                            "detected": false,
                            "reference": "http://*****.*****.***/",
                            "elapsed": "0.00"
                        },
                        "23": {
                            "engine": "CI Army List",
                            "detected": false,
                            "reference": "http://*****.*****/*****",
                            "elapsed": "0.00"
                        },
                        "24": {
                            "engine": "CRDF",
                            "detected": false,
                            "reference": "https://*****.*****.***/*****",
                            "elapsed": "0.00"
                        },
                        "25": {
                            "engine": "CruzIT Blocklist",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "26": {
                            "engine": "CSpace Hostings IP BL",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "27": {
                            "engine": "*****.***",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "28": {
                            "engine": "*****.***",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "29": {
                            "engine": "Darren SSH Block List",
                            "detected": true,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "30": {
                            "engine": "Etnetera BL",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "31": {
                            "engine": "Feodo Tracker",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "32": {
                            "engine": "FSpamList",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "33": {
                            "engine": "GPF DNS Block List",
                            "detected": false,
                            "reference": "https://www.*****.***/***/***",
                            "elapsed": "0.00"
                        },
                        "34": {
                            "engine": "GreenSnow Blocklist",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "35": {
                            "engine": "HoneyDB",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "36": {
                            "engine": "InterServer IP List",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "37": {
                            "engine": "IPSpamList",
                            "detected": false,
                            "reference": "https://www.*****.***/***/",
                            "elapsed": "0.00"
                        },
                        "38": {
                            "engine": "IPsum",
                            "detected": false,
                            "reference": "https://*****.***/***/***",
                            "elapsed": "0.00"
                        },
                        "39": {
                            "engine": "ISX.fr DNSBL",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "40": {
                            "engine": "JamesBrine IP List",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "41": {
                            "engine": "LAPPS Grid Blacklist",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "42": {
                            "engine": "Liquid Binary",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "43": {
                            "engine": "M4lwhere Intel",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "44": {
                            "engine": "Malc0de",
                            "detected": false,
                            "reference": "http://*****.***/***.***",
                            "elapsed": "0.00"
                        },
                        "45": {
                            "engine": "Mark Smith Blocked IPs",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "46": {
                            "engine": "Megumin",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "47": {
                            "engine": "Mirai Tracker",
                            "detected": false,
                            "reference": "https://*****.***.***/******",
                            "elapsed": "0.00"
                        },
                        "48": {
                            "engine": "MKXT_NET SSH BL",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "49": {
                            "engine": "Ms-ds-violation-ips",
                            "detected": false,
                            "reference": "https://*****.***/***/***",
                            "elapsed": "0.00"
                        },
                        "50": {
                            "engine": "Myip.ms Blacklist",
                            "detected": false,
                            "reference": "https://*****.***/***/***",
                            "elapsed": "0.00"
                        },
                        "51": {
                            "engine": "NEU SSH Black list",
                            "detected": false,
                            "reference": "http://*****.***.***.***/***/",
                            "elapsed": "0.00"
                        },
                        "52": {
                            "engine": "Nginx Bad Bot Blocker",
                            "detected": false,
                            "reference": "https://*****.***/***",
                            "elapsed": "0.00"
                        },
                        "53": {
                            "engine": "NOC_RUB_DE",
                            "detected": false,
                            "reference": "https://*****.***.***/***/",
                            "elapsed": "0.00"
                        },
                        "54": {
                            "engine": "NordSpam",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "55": {
                            "engine": "NUBI Bad IPs",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "56": {
                            "engine": "Olegon Blocked IPs",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "57": {
                            "engine": "OpenPhish",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "58": {
                            "engine": "Organized Villainy Seattle Honeypot",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "59": {
                            "engine": "Peter-s NUUG IP BL",
                            "detected": false,
                            "reference": "https://*****.***.***/***/",
                            "elapsed": "0.00"
                        },
                        "60": {
                            "engine": "PhishTank",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "61": {
                            "engine": "PlonkatronixBL",
                            "detected": false,
                            "reference": "http://***.*****.***/",
                            "elapsed": "0.00"
                        },
                        "62": {
                            "engine": "PSBL",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "63": {
                            "engine": "Redactia",
                            "detected": false,
                            "reference": "http://www.*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "64": {
                            "engine": "Redstout Threat IP list",
                            "detected": false,
                            "reference": "https://www.*****.***/***",
                            "elapsed": "0.00"
                        },
                        "65": {
                            "engine": "Reuteras Scanning Lists",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "66": {
                            "engine": "Ring-u NOC",
                            "detected": false,
                            "reference": "https://*****.***.***/***/***",
                            "elapsed": "0.00"
                        },
                        "67": {
                            "engine": "RJM Blocklist",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "68": {
                            "engine": "Roquesor BL",
                            "detected": true,
                            "reference": "https://***.*****.***/***/",
                            "elapsed": "0.00"
                        },
                        "69": {
                            "engine": "Rutgers Drop List",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "70": {
                            "engine": "S.S.S.H.I.A",
                            "detected": true,
                            "reference": "https://*****.***/*****/",
                            "elapsed": "0.00"
                        },
                        "71": {
                            "engine": "Sblam",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "elapsed": "0.00"
                        },
                        "72": {
                            "engine": "Snapt NovaSense",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "elapsed": "0.00"
                        },
                        "73": {
                            "engine": "SSL Blacklist",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "74": {
                            "engine": "Talos IP Blacklist",
                            "detected": false,
                            "reference": "https://www.*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "75": {
                            "engine": "ThreatLog",
                            "detected": false,
                            "reference": "https://www.*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "76": {
                            "engine": "Threat Crowd",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "77": {
                            "engine": "Threat Sourcing",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "78": {
                            "engine": "Turris Greylist",
                            "detected": false,
                            "reference": "https://www.*****.***/***/***/***",
                            "elapsed": "0.00"
                        },
                        "79": {
                            "engine": "UCEPROTECT Level 1",
                            "detected": false,
                            "reference": "http://www.*****.***/***/***/***",
                            "elapsed": "0.00"
                        },
                        "80": {
                            "engine": "URLhaus",
                            "detected": false,
                            "reference": "https://***.***.***/",
                            "elapsed": "0.00"
                        },
                        "81": {
                            "engine": "URLVir",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "elapsed": "0.00"
                        },
                        "82": {
                            "engine": "USTC IP BL",
                            "detected": false,
                            "reference": "http://*****.***.***.***/",
                            "elapsed": "0.00"
                        },
                        "83": {
                            "engine": "ViriBack C2 Tracker",
                            "detected": false,
                            "reference": "http://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "84": {
                            "engine": "VXVault",
                            "detected": false,
                            "reference": "http://*****.***/*****",
                            "elapsed": "0.00"
                        },
                        "85": {
                            "engine": "Woody SMTP Blacklist",
                            "detected": false,
                            "reference": "http://*****.***.***/",
                            "elapsed": "0.00"
                        },
                        "86": {
                            "engine": "ZeroDot1 Bad IPs",
                            "detected": true,
                            "reference": "https://*****.***.***/*****",
                            "elapsed": "0.00"
                        },
                        "87": {
                            "engine": "ZeroDot1 Miner IPs",
                            "detected": false,
                            "reference": "https://*****.***.***/*****",
                            "elapsed": "0.00"
                        }
                    },
                    "detections": 4,
                    "engines_count": 88,
                    "detection_rate": "5%",
                    "scantime": "0.40"
                },
                "information": {
                    "reverse_dns": "",
                    "continent_code": "AS",
                    "continent_name": "Asia",
                    "country_code": "CN",
                    "country_name": "China",
                    "country_currency": "CNY",
                    "country_calling_code": "86",
                    "region_name": "Zhejiang",
                    "city_name": "Jiaojiang",
                    "latitude": 28.680280685424805,
                    "longitude": 121.44277954101562,
                    "isp": "ChinaNet Zhejiang Province Network",
                    "asn": "AS136190"
                },
                "anonymity": {
                    "is_proxy": false,
                    "is_webproxy": false,
                    "is_vpn": false,
                    "is_hosting": false,
                    "is_tor": false
                },
                "risk_score": {
                    "result": 100
                }
            }
        },
        "credits_remained": 24.52,
        "estimated_queries": "306",
        "elapsed_time": "0.93",
        "success": true
    }
]

Key Fields

Common cyber security indicators such as risk levels, risk level names, unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

For check reputation commands, D3-defined risk scores and risk levels are also included.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

CODE

{
  "Hosts": ["*****.***"],
  "RiskScore": [50],
  "RiskLevel": ["Low"]
}

Results

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ip	*...*
blacklists	{'engines': {'10': {'engine': 'APEWS-L2', 'detected': False, 'reference': 'http://www.***./ ', 'elapsed': '0.00'}, '11': {'engine': 'AZORult Tracker', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '8': {'engine': 'Anti-Attacks BL', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '9': {'engine': 'AntiSpam_by_CleanTalk', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '12': {'engine': 'Backscatterer', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '0': {'engine': 'Barracuda_Reputation_BL', 'detected': False, 'reference': 'http://www.**.com/ ', 'elapsed': '0.03'}, '13': {'engine': 'Blacklists_co', 'detected': False, 'reference': 'http://*./ ', 'elapsed': '0.00'}, '14': {'engine': 'BlockList_de', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '1': {'engine': 'BlockedServersRBL', 'detected': False, 'reference': 'https://www.**.com/ ', 'elapsed': '0.03'}, '15': {'engine': 'http://*.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '16': {'engine': 'BloggingFusion BL', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '17': {'engine': 'http://**.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '18': {'engine': 'Brute Force Blocker', 'detected': False, 'reference': 'https://**../// ', 'elapsed': '0.00'}, '19': {'engine': 'C-APT-ure', 'detected': False, 'reference': 'http://*../ ', 'elapsed': '0.00'}, '20': {'engine': 'CERT-PA', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '21': {'engine': '**..', 'detected': False, 'reference': 'http://www.*../', 'elapsed': '0.00'}, '23': {'engine': 'CI Army List', 'detected': False, 'reference': 'http://*.*/* ', 'elapsed': '0.00'}, '24': {'engine': 'CRDF', 'detected': False, 'reference': 'https://*.*./** ', 'elapsed': '0.00'}, '26': {'engine': 'CSpace Hostings IP BL', 'detected': False, 'reference': 'https://*./ ', 'elapsed': '0.00'}, '22': {'engine': 'Charles Haley', 'detected': False, 'reference': 'http://**.*./ ', 'elapsed': '0.00'}, '25': {'engine': 'CruzIT Blocklist', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '27': {'engine': 'http://**.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '28': {'engine': 'http://**.* ', 'detected': False, 'reference': 'http://www.***./ ', 'elapsed': '0.00'}, '29': {'engine': 'Darren SSH Block List', 'detected': True, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '2': {'engine': 'EFnet_RBL', 'detected': False, 'reference': 'https://.*./** ', 'elapsed': '0.03'}, '30': {'engine': 'Etnetera BL', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '32': {'engine': 'FSpamList', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '31': {'engine': 'Feodo Tracker', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '33': {'engine': 'GPF DNS Block List', 'detected': False, 'reference': 'https://www.*.//* ', 'elapsed': '0.00'}, '34': {'engine': 'GreenSnow Blocklist', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '35': {'engine': 'HoneyDB', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '3': {'engine': 'IBM_Cobion', 'detected': False, 'reference': 'https://..//', 'elapsed': '0.02'}, '37': {'engine': 'IPSpamList', 'detected': False, 'reference': 'https://www.**.// ', 'elapsed': '0.00'}, '38': {'engine': 'IPsum', 'detected': False, 'reference': 'https://*.//* ', 'elapsed': '0.00'}, '39': {'engine': 'ISX.fr DNSBL', 'detected': False, 'reference': 'https://***../ ', 'elapsed': '0.00'}, '36': {'engine': 'InterServer IP List', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '40': {'engine': 'JamesBrine IP List', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '4': {'engine': 'JustSpam_org', 'detected': False, 'reference': 'http://www.*./ ', 'elapsed': '0.04'}, '5': {'engine': 'Known Scanning Service', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '41': {'engine': 'LAPPS Grid Blacklist', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '42': {'engine': 'Liquid Binary', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '43': {'engine': 'M4lwhere Intel', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '48': {'engine': 'MKXT_NET SSH BL', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '44': {'engine': 'Malc0de', 'detected': False, 'reference': 'http://**./.', 'elapsed': '0.00'}, '45': {'engine': 'Mark Smith Blocked IPs', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '46': {'engine': 'Megumin', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '47': {'engine': 'Mirai Tracker', 'detected': False, 'reference': 'https://**../** ', 'elapsed': '0.00'}, '49': {'engine': 'Ms-ds-violation-ips', 'detected': False, 'reference': 'https://*.//* ', 'elapsed': '0.00'}, '50': {'engine': 'Myip.ms Blacklist', 'detected': False, 'reference': 'https://***.//* ', 'elapsed': '0.00'}, '51': {'engine': 'NEU SSH Black list', 'detected': False, 'reference': 'http://***...//', 'elapsed': '0.00'}, '53': {'engine': 'NOC_RUB_DE', 'detected': False, 'reference': 'https://*..// ', 'elapsed': '0.00'}, '55': {'engine': 'NUBI Bad IPs', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '52': {'engine': 'Nginx Bad Bot Blocker', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '54': {'engine': 'NordSpam', 'detected': False, 'reference': 'https://www.*./ ', 'elapsed': '0.00'}, '56': {'engine': 'Olegon Blocked IPs', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '57': {'engine': 'OpenPhish', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '58': {'engine': 'Organized Villainy Honeypot', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '62': {'engine': 'PSBL', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '59': {'engine': 'Peter-s NUUG IP BL', 'detected': False, 'reference': 'https://**..// ', 'elapsed': '0.00'}, '60': {'engine': 'PhishTank', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '61': {'engine': 'PlonkatronixBL', 'detected': False, 'reference': 'http://.*./', 'elapsed': '0.00'}, '67': {'engine': 'RJM Blocklist', 'detected': False, 'reference': 'https://www.**./', 'elapsed': '0.00'}, '6': {'engine': 'RealtimeBLACKLIST', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.02'}, '63': {'engine': 'Redactia', 'detected': False, 'reference': 'http://www.**../', 'elapsed': '0.00'}, '64': {'engine': 'Redstout Threat IP list', 'detected': False, 'reference': 'https://www.*./ ', 'elapsed': '0.00'}, '65': {'engine': 'Reuteras Scanning Lists', 'detected': False, 'reference': 'https://*../', 'elapsed': '0.00'}, '66': {'engine': 'Ring-u NOC', 'detected': False, 'reference': 'https://*..// ', 'elapsed': '0.00'}, '68': {'engine': 'Roquesor BL', 'detected': True, 'reference': 'https://.**.// ', 'elapsed': '0.00'}, '69': {'engine': 'Rutgers Drop List', 'detected': False, 'reference': 'http://www.*./ ', 'elapsed': '0.00'}, '70': {'engine': 'S.S.S.H.I.A', 'detected': True, 'reference': 'https://**./**/ ', 'elapsed': '0.00'}, '7': {'engine': 'S5hbl', 'detected': False, 'reference': 'http://www.*./**/* ', 'elapsed': '0.03'}, '73': {'engine': 'SSL Blacklist', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '71': {'engine': 'Sblam', 'detected': False, 'reference': 'http://*./ ', 'elapsed': '0.00'}, '72': {'engine': 'Snapt NovaSense', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '74': {'engine': 'Talos IP Blacklist', 'detected': False, 'reference': 'https://www.**../ ', 'elapsed': '0.00'}, '76': {'engine': 'Threat Crowd', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '77': {'engine': 'Threat Sourcing', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '75': {'engine': 'ThreatLog', 'detected': False, 'reference': 'https://www.**../ ', 'elapsed': '0.00'}, '78': {'engine': 'Turris Greylist', 'detected': False, 'reference': 'https://www.*./// ', 'elapsed': '0.00'}, '79': {'engine': 'UCEPROTECT Level 1', 'detected': False, 'reference': 'http://www.*./// ', 'elapsed': '0.00'}, '81': {'engine': 'URLVir', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '80': {'engine': 'URLhaus', 'detected': False, 'reference': 'https://../ ', 'elapsed': '0.00'}, '82': {'engine': 'USTC IP BL', 'detected': False, 'reference': 'http://*.../ ', 'elapsed': '0.00'}, '84': {'engine': 'VXVault', 'detected': False, 'reference': 'http://**./** ', 'elapsed': '0.00'}, '83': {'engine': 'ViriBack C2 Tracker', 'detected': False, 'reference': 'http://*../ ', 'elapsed': '0.00'}, '85': {'engine': 'Woody SMTP Blacklist', 'detected': False, 'reference': 'http://*../', 'elapsed': '0.00'}, '86': {'engine': 'ZeroDot1 Bad IPs', 'detected': True, 'reference': 'https://*../* ', 'elapsed': '0.00'}, '87': {'engine': 'ZeroDot1 Miner IPs', 'detected': False, 'reference': 'https://*../*** ', 'elapsed': '0.00'}}, 'detections': 4, 'engines_count': 88, 'detection_rate': '5%', 'scantime': '0.20'}
information	{'reverse_dns': '', 'continent_code': 'AS', 'continent_name': 'Asia', 'country_code': 'CN', 'country_name': 'China', 'country_currency': 'CNY', 'country_calling_code': '86', 'region_name': 'Zhejiang', 'city_name': 'Jiaojiang', 'latitude': 28.680280685424805, 'longitude': 121.44277954101562, 'isp': 'ChinaNet Zhejiang Province Network', 'asn': 'AS136190'}
anonymity	{'is_proxy': False, 'is_webproxy': False, 'is_vpn': False, 'is_hosting': False, 'is_tor': False}
risk_score	{'result': 100}

D3-defined Risk Scores and Risk Levels

The table below lists the possible output Risk Scores and their corresponding Risk Levels:

Risk Scores	Risk Levels
1	High
2	Medium
3	Low
4	Default
5	ZeroRisk

Error Handling

An Error tab will appear in the Test Result window if the command fails to run.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check IP Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: API key is not valid.

Error Sample Data

Check IP Reputation failed.

Status Code: 200.

Message: API key is not valid.

Check URL Reputation

Checks the risk level of URL(s).

Input

Input Parameter	Required/Optional	Description	Example
URLs	Required	The URL(s) checked for their reputation.	[ "https://www.***.*" ]

Output

Return Data

In check reputation commands, Return Data displays the risk score from the raw data as D3-defined Risk Scores and Risk Levels. This will be used to enrich artifacts with reputation information.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "data": {
            "report": {
                "dns_records": {
                    "ns": {
                        "records": [
                            {
                                "target": "*****.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "NL",
                                "country_name": "Netherlands",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "TW",
                                "country_name": "Taiwan (Province of China)",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "NL",
                                "country_name": "Netherlands",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            }
                        ]
                    },
                    "mx": {
                        "records": [
                            {
                                "target": "*****.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.***.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.***.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.*****.***.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            },
                            {
                                "target": "*****.*****.***.***.***",
                                "ip": "***.***.***.***",
                                "country_code": "US",
                                "country_name": "United States of America",
                                "isp": "Google LLC"
                            }
                        ]
                    }
                },
                "domain_blacklist": {
                    "engines": [
                        {
                            "name": "ThreatLog",
                            "reference": "https://www.*****.***.***/",
                            "detected": false
                        },
                        {
                            "name": "OpenPhish",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "PhishTank",
                            "reference": "https://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "Phishing.Database",
                            "reference": "https://*****.*****/*****",
                            "detected": false
                        },
                        {
                            "name": "PhishStats",
                            "reference": "https://*****.*****/",
                            "detected": false
                        },
                        {
                            "name": "URLVir",
                            "reference": "https://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "URLhaus",
                            "reference": "https://***.***.***/",
                            "detected": false
                        },
                        {
                            "name": "RPiList Not Serious",
                            "reference": "https://*****.***/*****",
                            "detected": false
                        },
                        {
                            "name": "AntiSocial Blacklist",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "PhishFeed",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "NABP Not Recommended Sites",
                            "reference": "https://*****.***/*****/",
                            "detected": false
                        },
                        {
                            "name": "Spam404",
                            "reference": "https://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "CRDF",
                            "reference": "https://*****.*****.***/*****",
                            "detected": false
                        },
                        {
                            "name": "Artists Against 419",
                            "reference": "http://*****.***/*****",
                            "detected": false
                        },
                        {
                            "name": "CERT Polska",
                            "reference": "https://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "*****.*****",
                            "reference": "https://*****.*****/",
                            "detected": false
                        },
                        {
                            "name": "PetScams",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "Suspicious Hosting IP",
                            "reference": "https://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "Phishunt",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "TR-PhishingList",
                            "reference": "https://*****.***/*****",
                            "detected": false
                        },
                        {
                            "name": "CoinBlockerLists",
                            "reference": "https://*****.***/*****/",
                            "detected": false
                        },
                        {
                            "name": "MetaMask EthPhishing",
                            "reference": "https://*****.***/*****/",
                            "detected": false
                        },
                        {
                            "name": "EtherScamDB",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "EtherAddressLookup",
                            "reference": "https://*****.***/*****/",
                            "detected": false
                        },
                        {
                            "name": "ViriBack C2 Tracker",
                            "reference": "http://*****.***.***/",
                            "detected": false
                        },
                        {
                            "name": "Bambenek Consulting",
                            "reference": "http://www.*****.***/",
                            "detected": false
                        },
                        {
                            "name": "Badbitcoin",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "SecureReload Phishing List",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "PhishingReel",
                            "reference": "https://*****.***/",
                            "detected": false
                        },
                        {
                            "name": "Fake Website Buster",
                            "reference": "https://*****.***/",
                            "detected": false
                        }
                    ],
                    "detections": 0
                },
                "file_type": {
                    "signature": "",
                    "extension": "",
                    "headers": "HTML"
                },
                "geo_location": {
                    "countries": [
                        "NL",
                        "TW",
                        "US"
                    ]
                },
                "html_forms": {
                    "number_of_total_forms": 1,
                    "number_of_total_input_fields": 8,
                    "two_text_inputs_in_a_form": false,
                    "credit_card_field_present": false,
                    "password_field_present": false,
                    "email_field_present": false
                },
                "redirection": {
                    "found": false,
                    "external": false,
                    "url": null
                },
                "response_headers": {
                    "code": 200,
                    "status": "HTTP/2 200",
                    "date": "Tue, 04 Jan 2022 22:16:29 GMT",
                    "expires": "-1",
                    "cache-control": "private, max-age=0",
                    "content-type": "text/html; charset=UTF-8",
                    "strict-transport-security": "max-age=31536000",
                    "p3p": "CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\"",
                    "content-encoding": "gzip",
                    "server": "gws",
                    "content-length": "37563",
                    "x-xss-protection": "0",
                    "x-frame-options": "SAMEORIGIN",
                    "set-cookie": "1P_JAR=2022-01-04-22; expires=Thu, 03-Feb-2022 22:16:29 GMT; path=/; domain=.*****.***; Secure; SameSite=none NID=511=*****; expires=Wed, 06-Jul-2022 22:16:29 GMT; path=/; domain=.*****.***; Secure; HttpOnly; SameSite=none",
                    "alt-svc": "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\""
                },
                "risk_score": {
                    "result": 0
                },
                "security_checks": {
                    "is_host_an_ipv4": false,
                    "is_uncommon_host_length": false,
                    "is_uncommon_dash_char_count": false,
                    "is_uncommon_dot_char_count": false,
                    "is_suspicious_url_pattern": false,
                    "is_suspicious_file_extension": false,
                    "is_robots_noindex": false,
                    "is_suspended_page": false,
                    "is_most_abused_tld": false,
                    "is_uncommon_clickable_url": false,
                    "is_phishing_heuristic": false,
                    "is_possible_emotet": false,
                    "is_redirect_to_search_engine": false,
                    "is_http_status_error": false,
                    "is_http_server_error": false,
                    "is_http_client_error": false,
                    "is_suspicious_content": false,
                    "is_url_accessible": true,
                    "is_empty_page_title": false,
                    "is_empty_page_content": false,
                    "is_domain_ipv4_assigned": true,
                    "is_domain_ipv4_private": false,
                    "is_domain_ipv4_loopback": false,
                    "is_domain_ipv4_reserved": false,
                    "is_domain_ipv4_valid": true,
                    "is_domain_blacklisted": false,
                    "is_suspicious_domain": false,
                    "is_sinkholed_domain": false,
                    "is_defaced_heuristic": false,
                    "is_masked_file": false,
                    "is_risky_geo_location": false,
                    "is_china_country": false,
                    "is_nigeria_country": false,
                    "is_non_standard_port": false,
                    "is_email_address_on_url_query": false,
                    "is_directory_listing": false,
                    "is_exe_on_directory_listing": false,
                    "is_zip_on_directory_listing": false,
                    "is_php_on_directory_listing": false,
                    "is_doc_on_directory_listing": false,
                    "is_pdf_on_directory_listing": false,
                    "is_apk_on_directory_listing": false,
                    "is_linux_elf_file": false,
                    "is_linux_elf_file_on_free_dynamic_dns": false,
                    "is_linux_elf_file_on_free_hosting": false,
                    "is_linux_elf_file_on_ipv4": false,
                    "is_masked_linux_elf_file": false,
                    "is_masked_windows_exe_file": false,
                    "is_ms_office_file": false,
                    "is_windows_exe_file_on_free_dynamic_dns": false,
                    "is_windows_exe_file_on_free_hosting": false,
                    "is_windows_exe_file_on_ipv4": false,
                    "is_windows_exe_file": false,
                    "is_android_apk_file_on_free_dynamic_dns": false,
                    "is_android_apk_file_on_free_hosting": false,
                    "is_android_apk_file_on_ipv4": false,
                    "is_android_apk_file": false,
                    "is_external_redirect": false,
                    "is_risky_category": false,
                    "is_domain_recent": "no",
                    "is_domain_very_recent": "no",
                    "is_credit_card_field": false,
                    "is_password_field": false,
                    "is_valid_https": true
                },
                "server_details": {
                    "ip": "172.253.123.147",
                    "hostname": "ug-in-f147.1e100.net",
                    "continent_code": "NA",
                    "continent_name": "North America",
                    "country_code": "US",
                    "country_name": "United States of America",
                    "region_name": "California",
                    "city_name": "Mountain View",
                    "latitude": 37.40599060058594,
                    "longitude": -122.0785140991211,
                    "isp": "Google LLC",
                    "asn": "AS15169"
                },
                "site_category": {
                    "is_torrent": false,
                    "is_vpn_provider": false,
                    "is_free_hosting": false,
                    "is_anonymizer": false,
                    "is_url_shortener": false,
                    "is_free_dynamic_dns": false,
                    "is_code_sandbox": false,
                    "is_form_builder": false,
                    "is_free_file_sharing": false,
                    "is_pastebin": false
                },
                "url_parts": {
                    "scheme": "https",
                    "host": "www.*****.***",
                    "host_nowww": "*****.***",
                    "port": null,
                    "path": null,
                    "query": null
                },
                "web_page": {
                    "title": "Google",
                    "description": "",
                    "keywords": ""
                }
            }
        },
        "credits_remained": 21.56,
        "estimated_queries": "43",
        "elapsed_time": "0.91",
        "success": true
    }
]

Key Fields

Common cyber security indicators such as risk levels, risk level names, unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

For check reputation commands, D3-defined risk scores and risk levels are also included.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
  "Urls": ["www.*****.***"],
  "RiskScore": [0],
  "RiskLevel": ["ZeroRisk"]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

ip	*...*
blacklists	{'engines': {'10': {'engine': 'APEWS-L2', 'detected': False, 'reference': 'http://www.***./ ', 'elapsed': '0.00'}, '11': {'engine': 'AZORult Tracker', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '8': {'engine': 'Anti-Attacks BL', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '9': {'engine': 'AntiSpam_by_CleanTalk', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '12': {'engine': 'Backscatterer', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '0': {'engine': 'Barracuda_Reputation_BL', 'detected': False, 'reference': 'http://www.**.com/ ', 'elapsed': '0.03'}, '13': {'engine': 'Blacklists_co', 'detected': False, 'reference': 'http://*./ ', 'elapsed': '0.00'}, '14': {'engine': 'BlockList_de', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '1': {'engine': 'BlockedServersRBL', 'detected': False, 'reference': 'https://www.**.com/ ', 'elapsed': '0.03'}, '15': {'engine': 'http://*.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '16': {'engine': 'BloggingFusion BL', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '17': {'engine': 'http://**.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '18': {'engine': 'Brute Force Blocker', 'detected': False, 'reference': 'https://**../// ', 'elapsed': '0.00'}, '19': {'engine': 'C-APT-ure', 'detected': False, 'reference': 'http://*../ ', 'elapsed': '0.00'}, '20': {'engine': 'CERT-PA', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '21': {'engine': '**..', 'detected': False, 'reference': 'http://www.*../', 'elapsed': '0.00'}, '23': {'engine': 'CI Army List', 'detected': False, 'reference': 'http://*.*/* ', 'elapsed': '0.00'}, '24': {'engine': 'CRDF', 'detected': False, 'reference': 'https://*.*./** ', 'elapsed': '0.00'}, '26': {'engine': 'CSpace Hostings IP BL', 'detected': False, 'reference': 'https://*./ ', 'elapsed': '0.00'}, '22': {'engine': 'Charles Haley', 'detected': False, 'reference': 'http://**.*./ ', 'elapsed': '0.00'}, '25': {'engine': 'CruzIT Blocklist', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '27': {'engine': 'http://**.* ', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '28': {'engine': 'http://**.* ', 'detected': False, 'reference': 'http://www.***./ ', 'elapsed': '0.00'}, '29': {'engine': 'Darren SSH Block List', 'detected': True, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '2': {'engine': 'EFnet_RBL', 'detected': False, 'reference': 'https://.*./** ', 'elapsed': '0.03'}, '30': {'engine': 'Etnetera BL', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '32': {'engine': 'FSpamList', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '31': {'engine': 'Feodo Tracker', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '33': {'engine': 'GPF DNS Block List', 'detected': False, 'reference': 'https://www.*.//* ', 'elapsed': '0.00'}, '34': {'engine': 'GreenSnow Blocklist', 'detected': False, 'reference': 'https://***./ ', 'elapsed': '0.00'}, '35': {'engine': 'HoneyDB', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '3': {'engine': 'IBM_Cobion', 'detected': False, 'reference': 'https://..//', 'elapsed': '0.02'}, '37': {'engine': 'IPSpamList', 'detected': False, 'reference': 'https://www.**.// ', 'elapsed': '0.00'}, '38': {'engine': 'IPsum', 'detected': False, 'reference': 'https://*.//* ', 'elapsed': '0.00'}, '39': {'engine': 'ISX.fr DNSBL', 'detected': False, 'reference': 'https://***../ ', 'elapsed': '0.00'}, '36': {'engine': 'InterServer IP List', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '40': {'engine': 'JamesBrine IP List', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '4': {'engine': 'JustSpam_org', 'detected': False, 'reference': 'http://www.*./ ', 'elapsed': '0.04'}, '5': {'engine': 'Known Scanning Service', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '41': {'engine': 'LAPPS Grid Blacklist', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '42': {'engine': 'Liquid Binary', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '43': {'engine': 'M4lwhere Intel', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '48': {'engine': 'MKXT_NET SSH BL', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '44': {'engine': 'Malc0de', 'detected': False, 'reference': 'http://**./.', 'elapsed': '0.00'}, '45': {'engine': 'Mark Smith Blocked IPs', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '46': {'engine': 'Megumin', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '47': {'engine': 'Mirai Tracker', 'detected': False, 'reference': 'https://**../** ', 'elapsed': '0.00'}, '49': {'engine': 'Ms-ds-violation-ips', 'detected': False, 'reference': 'https://*.//* ', 'elapsed': '0.00'}, '50': {'engine': 'Myip.ms Blacklist', 'detected': False, 'reference': 'https://***.//* ', 'elapsed': '0.00'}, '51': {'engine': 'NEU SSH Black list', 'detected': False, 'reference': 'http://***...//', 'elapsed': '0.00'}, '53': {'engine': 'NOC_RUB_DE', 'detected': False, 'reference': 'https://*..// ', 'elapsed': '0.00'}, '55': {'engine': 'NUBI Bad IPs', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '52': {'engine': 'Nginx Bad Bot Blocker', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '54': {'engine': 'NordSpam', 'detected': False, 'reference': 'https://www.*./ ', 'elapsed': '0.00'}, '56': {'engine': 'Olegon Blocked IPs', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '57': {'engine': 'OpenPhish', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '58': {'engine': 'Organized Villainy Honeypot', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '62': {'engine': 'PSBL', 'detected': False, 'reference': 'https://**./ ', 'elapsed': '0.00'}, '59': {'engine': 'Peter-s NUUG IP BL', 'detected': False, 'reference': 'https://**..// ', 'elapsed': '0.00'}, '60': {'engine': 'PhishTank', 'detected': False, 'reference': 'http://www.**./ ', 'elapsed': '0.00'}, '61': {'engine': 'PlonkatronixBL', 'detected': False, 'reference': 'http://.*./', 'elapsed': '0.00'}, '67': {'engine': 'RJM Blocklist', 'detected': False, 'reference': 'https://www.**./', 'elapsed': '0.00'}, '6': {'engine': 'RealtimeBLACKLIST', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.02'}, '63': {'engine': 'Redactia', 'detected': False, 'reference': 'http://www.**../', 'elapsed': '0.00'}, '64': {'engine': 'Redstout Threat IP list', 'detected': False, 'reference': 'https://www.*./ ', 'elapsed': '0.00'}, '65': {'engine': 'Reuteras Scanning Lists', 'detected': False, 'reference': 'https://*../', 'elapsed': '0.00'}, '66': {'engine': 'Ring-u NOC', 'detected': False, 'reference': 'https://*..// ', 'elapsed': '0.00'}, '68': {'engine': 'Roquesor BL', 'detected': True, 'reference': 'https://.**.// ', 'elapsed': '0.00'}, '69': {'engine': 'Rutgers Drop List', 'detected': False, 'reference': 'http://www.*./ ', 'elapsed': '0.00'}, '70': {'engine': 'S.S.S.H.I.A', 'detected': True, 'reference': 'https://**./**/ ', 'elapsed': '0.00'}, '7': {'engine': 'S5hbl', 'detected': False, 'reference': 'http://www.*./**/* ', 'elapsed': '0.03'}, '73': {'engine': 'SSL Blacklist', 'detected': False, 'reference': 'https://*../ ', 'elapsed': '0.00'}, '71': {'engine': 'Sblam', 'detected': False, 'reference': 'http://*./ ', 'elapsed': '0.00'}, '72': {'engine': 'Snapt NovaSense', 'detected': False, 'reference': 'https://**./', 'elapsed': '0.00'}, '74': {'engine': 'Talos IP Blacklist', 'detected': False, 'reference': 'https://www.**../ ', 'elapsed': '0.00'}, '76': {'engine': 'Threat Crowd', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '77': {'engine': 'Threat Sourcing', 'detected': False, 'reference': 'https://www.**./ ', 'elapsed': '0.00'}, '75': {'engine': 'ThreatLog', 'detected': False, 'reference': 'https://www.**../ ', 'elapsed': '0.00'}, '78': {'engine': 'Turris Greylist', 'detected': False, 'reference': 'https://www.*./// ', 'elapsed': '0.00'}, '79': {'engine': 'UCEPROTECT Level 1', 'detected': False, 'reference': 'http://www.*./// ', 'elapsed': '0.00'}, '81': {'engine': 'URLVir', 'detected': False, 'reference': 'https://www.*./', 'elapsed': '0.00'}, '80': {'engine': 'URLhaus', 'detected': False, 'reference': 'https://../ ', 'elapsed': '0.00'}, '82': {'engine': 'USTC IP BL', 'detected': False, 'reference': 'http://*.../ ', 'elapsed': '0.00'}, '84': {'engine': 'VXVault', 'detected': False, 'reference': 'http://**./** ', 'elapsed': '0.00'}, '83': {'engine': 'ViriBack C2 Tracker', 'detected': False, 'reference': 'http://*../ ', 'elapsed': '0.00'}, '85': {'engine': 'Woody SMTP Blacklist', 'detected': False, 'reference': 'http://*../', 'elapsed': '0.00'}, '86': {'engine': 'ZeroDot1 Bad IPs', 'detected': True, 'reference': 'https://*../* ', 'elapsed': '0.00'}, '87': {'engine': 'ZeroDot1 Miner IPs', 'detected': False, 'reference': 'https://*../*** ', 'elapsed': '0.00'}}, 'detections': 4, 'engines_count': 88, 'detection_rate': '5%', 'scantime': '0.20'}
information	{'reverse_dns': '', 'continent_code': 'AS', 'continent_name': 'Asia', 'country_code': 'CN', 'country_name': 'China', 'country_currency': 'CNY', 'country_calling_code': '86', 'region_name': 'Zhejiang', 'city_name': 'Jiaojiang', 'latitude': 28.680280685424805, 'longitude': 121.44277954101562, 'isp': 'ChinaNet Zhejiang Province Network', 'asn': 'AS136190'}
anonymity	{'is_proxy': False, 'is_webproxy': False, 'is_vpn': False, 'is_hosting': False, 'is_tor': False}
risk_score	{'result': 100}

D3-defined Risk Scores and Risk Levels

The table below lists the possible output Risk Scores and their corresponding Risk Levels:

Risk Scores	Risk Levels
1	High
2	Medium
3	Low
4	Default
5	ZeroRisk

Error Handling

An Error tab will appear in the Test Result window if the command fails to run.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check URL Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Url is not valid.

Error Sample Data

Check URL Reputation failed.

Status Code: 200.

Message: Url is not valid.

Check Domain Reputation

Checks the risk level of the domain(s).

Input

Input Parameter

Required/Optional

Description

Example

Host

Required

The host(s) to submit.

[

"*****.***"

]

Output

Return Data

In check reputation commands, Return Data displays the risk score from the raw data as D3-defined Risk Scores and Risk Levels. This will be used to enrich artifacts with reputation information.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "data": {
            "report": {
                "host": "*****.***",
                "blacklists": {
                    "engines": {
                        "0": {
                            "engine": "Phishing Test",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "low",
                            "elapsed": "0.00"
                        },
                        "1": {
                            "engine": "Scam Test",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "low",
                            "elapsed": "0.00"
                        },
                        "2": {
                            "engine": "Sinkholed Domain",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "low",
                            "elapsed": "0.00"
                        },
                        "3": {
                            "engine": "Suspicious Hosting IP",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "low",
                            "elapsed": "0.00"
                        },
                        "4": {
                            "engine": "AntiSocial Blacklist",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "5": {
                            "engine": "Artists Against 419",
                            "detected": false,
                            "reference": "http://*****.***/*****",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "6": {
                            "engine": "AZORult Tracker",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "7": {
                            "engine": "Badbitcoin",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "8": {
                            "engine": "Bambenek Consulting",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "9": {
                            "engine": "C_APT_ure",
                            "detected": false,
                            "reference": "http://*****.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "10": {
                            "engine": "CERT-GIB",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "11": {
                            "engine": "CERT-PA",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "12": {
                            "engine": "CERT Polska",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "13": {
                            "engine": "Chong Lua Dao",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "14": {
                            "engine": "CoinBlockerLists",
                            "detected": false,
                            "reference": "https://*****.***/*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "15": {
                            "engine": "CRDF",
                            "detected": true,
                            "reference": "https://*****.*****.***/*****",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "16": {
                            "engine": "CyberCrime",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "17": {
                            "engine": "Cyber Threat Coalition",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "18": {
                            "engine": "EtherAddressLookup",
                            "detected": false,
                            "reference": "https://*****.***/*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "19": {
                            "engine": "EtherScamDB",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "20": {
                            "engine": "Fake Website Buster",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "21": {
                            "engine": "Fumik0 Malware Tracker",
                            "detected": false,
                            "reference": "https://*****.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "22": {
                            "engine": "HijackedUrls",
                            "detected": false,
                            "reference": "https://www.*****.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "23": {
                            "engine": "Joewein Domain BL",
                            "detected": false,
                            "reference": "http://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "24": {
                            "engine": "Malc0de",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "25": {
                            "engine": "MetaMask EthPhishing",
                            "detected": false,
                            "reference": "https://*****.***/*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "26": {
                            "engine": "NABP Not Recommended Sites",
                            "detected": false,
                            "reference": "https://*****.***/*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "27": {
                            "engine": "Netlab360",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "28": {
                            "engine": "OpenPhish",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "29": {
                            "engine": "PetScams",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "30": {
                            "engine": "Phishing.Database",
                            "detected": false,
                            "reference": "https://*****.*****/*****",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "31": {
                            "engine": "PhishFeed",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "32": {
                            "engine": "PhishingReel",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "33": {
                            "engine": "PhishStats",
                            "detected": false,
                            "reference": "https://*****.*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "34": {
                            "engine": "PhishTank",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "35": {
                            "engine": "Phishunt",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "36": {
                            "engine": "Quttera",
                            "detected": false,
                            "reference": "https://*****.***/*****",
                            "confidence": "low",
                            "elapsed": "0.00"
                        },
                        "37": {
                            "engine": "RPiList Not Serious",
                            "detected": false,
                            "reference": "https://*****.***/*****",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "38": {
                            "engine": "*****.*****",
                            "detected": false,
                            "reference": "https://*****.*****/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "39": {
                            "engine": "SecureReload Phishing List",
                            "detected": false,
                            "reference": "https://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "40": {
                            "engine": "Spam404",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "41": {
                            "engine": "ThreatCrowd",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "42": {
                            "engine": "ThreatLog",
                            "detected": false,
                            "reference": "https://www.*****.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "43": {
                            "engine": "Threat Sourcing",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "44": {
                            "engine": "TR-PhishingList",
                            "detected": false,
                            "reference": "https://*****.***/*****",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "45": {
                            "engine": "URLhaus",
                            "detected": false,
                            "reference": "https://***.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "46": {
                            "engine": "URLVir",
                            "detected": false,
                            "reference": "https://www.*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "47": {
                            "engine": "ViriBack C2 Tracker",
                            "detected": false,
                            "reference": "http://*****.***.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        },
                        "48": {
                            "engine": "VXVault",
                            "detected": false,
                            "reference": "http://*****.***/",
                            "confidence": "high",
                            "elapsed": "0.00"
                        }
                    },
                    "detections": 1,
                    "engines_count": 49,
                    "detection_rate": "2%",
                    "scantime": "0.85"
                },
                "server": {
                    "ip": "***.***.***.***",
                    "reverse_dns": "",
                    "continent_code": "AS",
                    "continent_name": "Asia",
                    "country_code": "CN",
                    "country_name": "China",
                    "region_name": "Jiangsu",
                    "city_name": "Yancheng",
                    "latitude": 33.38555908203125,
                    "longitude": 120.12528228759766,
                    "isp": "ChinaNet Jiangsu Province Network",
                    "asn": "AS4134"
                },
                "site_category": {
                    "is_free_hosting": false
                },
                "category": {
                    "is_anonymizer": false,
                    "is_url_shortener": false,
                    "is_free_dynamic_dns": false,
                    "is_code_sandbox": false,
                    "is_form_builder": false,
                    "is_free_file_sharing": false,
                    "is_pastebin": false
                },
                "security_checks": {
                    "is_most_abused_tld": false,
                    "is_domain_ipv4_assigned": true,
                    "is_domain_ipv4_private": false,
                    "is_domain_ipv4_loopback": false,
                    "is_domain_ipv4_reserved": false,
                    "is_domain_ipv4_valid": true,
                    "is_domain_blacklisted": true,
                    "is_uncommon_host_length": false,
                    "is_uncommon_dash_char_count": false,
                    "is_uncommon_dot_char_count": false,
                    "website_popularity": "low",
                    "is_uncommon_clickable_domain": false,
                    "is_risky_category": false
                },
                "risk_score": {
                    "result": 50
                }
            }
        },
        "credits_remained": 24.6,
        "estimated_queries": "307",
        "elapsed_time": "1.05",
        "success": true
    }
]

Key Fields

Common cyber security indicators such as risk levels, risk level names, unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

For check reputation commands, D3-defined risk scores and risk levels are also included.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
  "Hosts": ["*****.***"],
  "RiskScore": [50],
  "RiskLevel": ["Low"]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

host	***.*
blacklists	{'engines': {'6': {'engine': 'AZORult Tracker', 'detected': False, 'reference': 'https://***./ ', 'confidence': 'high', 'elapsed': '0.00'}, '4': {'engine': 'AntiSocial Blacklist', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '5': {'engine': 'Artists Against 419', 'detected': False, 'reference': 'http://**./** ', 'confidence': 'high', 'elapsed': '0.00'}, '7': {'engine': 'Badbitcoin', 'detected': False, 'reference': 'https://*./ ', 'confidence': 'high', 'elapsed': '0.00'}, '8': {'engine': 'Bambenek Consulting', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '12': {'engine': 'CERT Polska', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '10': {'engine': 'CERT-GIB', 'detected': False, 'reference': 'http://www.**./', 'confidence': 'high', 'elapsed': '0.00'}, '11': {'engine': 'CERT-PA', 'detected': False, 'reference': 'https://www.**./', 'confidence': 'high', 'elapsed': '0.00'}, '15': {'engine': 'CRDF', 'detected': True, 'reference': 'https://**.*./** ', 'confidence': 'high', 'elapsed': '0.00'}, '9': {'engine': 'C_APT_ure', 'detected': False, 'reference': 'http://*../ ', 'confidence': 'high', 'elapsed': '0.00'}, '13': {'engine': 'Chong Lua Dao', 'detected': False, 'reference': 'https://*./ ', 'confidence': 'high', 'elapsed': '0.00'}, '14': {'engine': 'CoinBlockerLists', 'detected': False, 'reference': 'https://**./**/ ', 'confidence': 'high', 'elapsed': '0.00'}, '17': {'engine': 'Cyber Threat Coalition', 'detected': False, 'reference': 'https://www.*./', 'confidence': 'high', 'elapsed': '0.00'}, '16': {'engine': 'CyberCrime', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '18': {'engine': 'EtherAddressLookup', 'detected': False, 'reference': 'https://**./**/ ', 'confidence': 'high', 'elapsed': '0.00'}, '19': {'engine': 'EtherScamDB', 'detected': False, 'reference': 'https://*./', 'confidence': 'high', 'elapsed': '0.00'}, '20': {'engine': 'Fake Website Buster', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '21': {'engine': 'Fumik0 Malware Tracker', 'detected': False, 'reference': 'https://**../', 'confidence': 'high', 'elapsed': '0.00'}, '22': {'engine': 'HijackedUrls', 'detected': False, 'reference': 'https://www.*../', 'confidence': 'high', 'elapsed': '0.00'}, '23': {'engine': 'Joewein Domain BL', 'detected': False, 'reference': 'http://www.*./ ', 'confidence': 'high', 'elapsed': '0.00'}, '24': {'engine': 'Malc0de', 'detected': False, 'reference': 'http://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '25': {'engine': 'MetaMask EthPhishing', 'detected': False, 'reference': 'https://**./**/ ', 'confidence': 'high', 'elapsed': '0.00'}, '26': {'engine': 'NABP Not Recommended Sites', 'detected': False, 'reference': 'https://*./**/ ', 'confidence': 'high', 'elapsed': '0.00'}, '27': {'engine': 'Netlab360', 'detected': False, 'reference': 'http://*./', 'confidence': 'high', 'elapsed': '0.00'}, '28': {'engine': 'OpenPhish', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '29': {'engine': 'PetScams', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '31': {'engine': 'PhishFeed', 'detected': False, 'reference': 'https://**./', 'confidence': 'high', 'elapsed': '0.00'}, '33': {'engine': 'PhishStats', 'detected': False, 'reference': 'https://**.*/ ', 'confidence': 'high', 'elapsed': '0.00'}, '34': {'engine': 'PhishTank', 'detected': False, 'reference': 'https://www.*./', 'confidence': 'high', 'elapsed': '0.00'}, '0': {'engine': 'Phishing Test', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'low', 'elapsed': '0.00'}, '30': {'engine': 'Phishing.Database', 'detected': False, 'reference': 'https://**.*/* ', 'confidence': 'high', 'elapsed': '0.00'}, '32': {'engine': 'PhishingReel', 'detected': False, 'reference': 'https://*./', 'confidence': 'high', 'elapsed': '0.00'}, '35': {'engine': 'Phishunt', 'detected': False, 'reference': 'https://**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '36': {'engine': 'Quttera', 'detected': False, 'reference': 'https://**./** ', 'confidence': 'low', 'elapsed': '0.00'}, '37': {'engine': 'RPiList Not Serious', 'detected': False, 'reference': 'https://*./** ', 'confidence': 'high', 'elapsed': '0.00'}, '1': {'engine': 'Scam Test', 'detected': False, 'reference': 'https://www.*./ ', 'confidence': 'low', 'elapsed': '0.00'}, '38': {'engine': '**.*', 'detected': False, 'reference': 'https://*.*/ ', 'confidence': 'high', 'elapsed': '0.00'}, '39': {'engine': 'SecureReload Phishing List', 'detected': False, 'reference': 'https://*./', 'confidence': 'high', 'elapsed': '0.00'}, '2': {'engine': 'Sinkholed Domain', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'low', 'elapsed': '0.00'}, '40': {'engine': 'Spam404', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'high', 'elapsed': '0.00'}, '3': {'engine': 'Suspicious Hosting IP', 'detected': False, 'reference': 'https://www.**./ ', 'confidence': 'low', 'elapsed': '0.00'}, '44': {'engine': 'TR-PhishingList', 'detected': False, 'reference': 'https://**./** ', 'confidence': 'high', 'elapsed': '0.00'}, '43': {'engine': 'Threat Sourcing', 'detected': False, 'reference': 'https://www.*./ ', 'confidence': 'high', 'elapsed': '0.00'}, '41': {'engine': 'ThreatCrowd', 'detected': False, 'reference': 'https://www.**./', 'confidence': 'high', 'elapsed': '0.00'}, '42': {'engine': 'ThreatLog', 'detected': False, 'reference': 'https://www.**../ ', 'confidence': 'high', 'elapsed': '0.00'}, '46': {'engine': 'URLVir', 'detected': False, 'reference': 'https://www.*./', 'confidence': 'high', 'elapsed': '0.00'}, '45': {'engine': 'URLhaus', 'detected': False, 'reference': 'https://../ ', 'confidence': 'high', 'elapsed': '0.00'}, '48': {'engine': 'VXVault', 'detected': False, 'reference': 'http://*./ ', 'confidence': 'high', 'elapsed': '0.00'}, '47': {'engine': 'ViriBack C2 Tracker', 'detected': False, 'reference': 'http://**..**/ ', 'confidence': 'high', 'elapsed': '0.00'}}, 'detections': 1, 'engines_count': 49, 'detection_rate': '2%', 'scantime': '0.54'}
server	{'ip': '*...*', 'reverse_dns': '', 'continent_code': 'AS', 'continent_name': 'Asia', 'country_code': 'CN', 'country_name': 'China', 'region_name': 'Jiangsu', 'city_name': 'Yancheng', 'latitude': 33.38555908203125, 'longitude': 120.12528228759766, 'isp': 'ChinaNet Jiangsu Province Network', 'asn': 'AS4134'}
category	{'is_free_hosting': False, 'is_anonymizer': False, 'is_url_shortener': False, 'is_free_dynamic_dns': False, 'is_code_sandbox': False, 'is_form_builder': False, 'is_free_file_sharing': False, 'is_pastebin': False}
security_checks	{'is_most_abused_tld': False, 'is_domain_ipv4_assigned': True, 'is_domain_ipv4_private': False, 'is_domain_ipv4_loopback': False, 'is_domain_ipv4_reserved': False, 'is_domain_ipv4_valid': True, 'is_domain_blacklisted': True, 'is_uncommon_host_length': False, 'is_uncommon_dash_char_count': False, 'is_uncommon_dot_char_count': False, 'website_popularity': 'low', 'is_uncommon_clickable_domain': False, 'is_risky_category': False}
risk_score	{'result': 50}

D3-defined Risk Scores and Risk Levels

The table below lists the possible output Risk Scores and their corresponding Risk Levels:

Risk Scores	Risk Levels
1	High
2	Medium
3	Low
4	Default
5	ZeroRisk

Error Handling

An Error tab will appear in the Test Result window if the command fails to run.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check Domain Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Host is not valid.

Error Sample Data

Check Domain Reputation failed.

Status Code: 200.

Message: Host is not valid.

Check Email Reputation

Checks the risk level of email(s).

Input

Input Parameter	Required/Optional	Description	Example
Emails	Required	The emails checked for their reputation.	[ "***@*.*" ]

Output

Return Data

In check reputation commands, Return Data displays the risk score from the raw data as D3-defined Risk Scores and Risk Levels. This will be used to enrich artifacts with reputation information.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "data": {
            "email": "*****@*****.***",
            "valid_format": true,
            "username": "abcd",
            "role_address": false,
            "suspicious_username": false,
            "dirty_words_username": false,
            "suspicious_email": false,
            "domain": "*****.***",
            "valid_tld": true,
            "disposable": true,
            "has_a_records": true,
            "has_mx_records": true,
            "has_spf_records": true,
            "is_spoofable": false,
            "dmarc_configured": false,
            "dmarc_enforced": false,
            "free_email": false,
            "russian_free_email": false,
            "china_free_email": false,
            "did_you_mean": "",
            "suspicious_domain": false,
            "dirty_words_domain": false,
            "domain_popular": true,
            "risky_tld": false,
            "police_domain": false,
            "government_domain": false,
            "educational_domain": false,
            "should_block": true,
            "score": 0
        },
        "credits_remained": 23.46,
        "estimated_queries": "391",
        "elapsed_time": "0.64",
        "success": true
    }
]

Key Fields

Common cyber security indicators such as risk levels, risk level names, unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

For check reputation commands, D3-defined risk scores and risk levels are also included.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
  "Emails": ["*****@*****.***"],
  "RiskScore": [0],
  "RiskLevel": ["ZeroRisk"]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

email	***@*.*
valid_format	TRUE
username	abcd
role_address	FALSE
suspicious_username	FALSE
dirty_words_username	FALSE
suspicious_email	FALSE
domain	http://***.*
valid_tld	TRUE
disposable	TRUE
has_a_records	TRUE
has_mx_records	TRUE
has_spf_records	TRUE
is_spoofable	FALSE
dmarc_configured	FALSE
dmarc_enforced	FALSE
free_email	FALSE
russian_free_email	FALSE
china_free_email	FALSE
did_you_mean
suspicious_domain	FALSE
dirty_words_domain	FALSE
domain_popular	TRUE
risky_tld	FALSE
police_domain	FALSE
government_domain	FALSE
educational_domain	FALSE
should_block	TRUE
score	0

D3-defined Risk Scores and Risk Levels

The table below lists the possible output Risk Scores and their corresponding Risk Levels:

Risk Scores	Risk Levels
1	High
2	Medium
3	Low
4	Default
5	ZeroRisk

Error Handling

An Error tab will appear in the Test Result window if the command fails to run.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Check Email Reputation failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: API key is not valid

Error Sample Data

Check Email Reputation failed.

Status Code: 200.

Message: API key is not valid

Get Screenshot

Retrieves the screenshot from a URL.

Input

Input Parameter	Required/Optional	Description	Example
URL	Required	The URL used to retrieve the screenshot.	https://www.***.*

Output

Return Data

Indicates one of the possible command execution states: Successful, or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "data": {
        "format": "PNG",
        "base64_file": "*****",
        "image_width": 1024,
        "image_height": 768,
        "file_size_readable": "152.8KB",
        "file_size_bytes": 156416,
        "file_md5_hash": "*****",
        "elapsed": "1.40"
    },
    "credits_remained": 20.28,
    "estimated_queries": "28",
    "elapsed_time": "2.04",
    "success": true
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
  "Urls": ["www.*****.***"],
  "MD5": ["*****"]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Screenshot failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Url is not valid.

Error Sample Data

Get Screenshot failed.

Status Code: 200.

Message: Url is not valid.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. The API always returns a 200 HTTP status code. Refer to the APIVoid Status Code for details.	Status Code: 200.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: API key is not valid.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 200.

Message: API key is not valid