From 7447f2023a4fc864a5898f80e242a8be1774c8a0 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Thu, 2 Mar 2023 21:55:57 -0800
Subject: [PATCH 01/34] 'create generate-doc.yml file'
---
.github/workflows/generate-doc.yml | 14 ++++++++++++++
.pre-commit-config.yaml | 4 ++--
2 files changed, 16 insertions(+), 2 deletions(-)
create mode 100644 .github/workflows/generate-doc.yml
diff --git a/.github/workflows/generate-doc.yml b/.github/workflows/generate-doc.yml
new file mode 100644
index 0000000..4661718
--- /dev/null
+++ b/.github/workflows/generate-doc.yml
@@ -0,0 +1,14 @@
+name: Generate Readme Doc
+on:
+ workflow_dispatch:
+ push:
+ paths:
+ - '*.json'
+ - 'readme.html'
+jobs:
+ generate-doc:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: 'phantomcyber/dev-cicd-tools/github-actions/generate-doc@main'
+ with:
+ GITHUB_TOKEN: ${{ secrets.SOAR_APPS_TOKEN }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 88dc32a..b269de3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,11 @@
repos:
- repo: https://github.com/phantomcyber/dev-cicd-tools
- rev: v1.13
+ rev: v1.16
hooks:
- id: org-hook
- id: package-app-dependencies
- repo: https://github.com/Yelp/detect-secrets
- rev: v1.3.0
+ rev: v1.4.0
hooks:
- id: detect-secrets
args: ['--no-verify', '--exclude-files', '^threatstream.json$']
From 3f45c5b155525d4448daad578bfce2ccca5bda2f Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Mon, 6 Mar 2023 22:05:15 -0800
Subject: [PATCH 02/34] 'update generate-doc.yml file'
---
.github/workflows/generate-doc.yml | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/.github/workflows/generate-doc.yml b/.github/workflows/generate-doc.yml
index 4661718..e63a4cd 100644
--- a/.github/workflows/generate-doc.yml
+++ b/.github/workflows/generate-doc.yml
@@ -5,6 +5,11 @@ on:
paths:
- '*.json'
- 'readme.html'
+ tags-ignore:
+ - '*-beta*'
+ branches-ignore:
+ - next
+ - main
jobs:
generate-doc:
runs-on: ubuntu-latest
From cb5c21107b28965364ff372d74e4eb1a28d76d68 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Tue, 7 Mar 2023 15:14:15 -0800
Subject: [PATCH 03/34] 'update generate-doc.yml file'
---
.github/workflows/generate-doc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/generate-doc.yml b/.github/workflows/generate-doc.yml
index e63a4cd..7a3ba90 100644
--- a/.github/workflows/generate-doc.yml
+++ b/.github/workflows/generate-doc.yml
@@ -6,7 +6,7 @@ on:
- '*.json'
- 'readme.html'
tags-ignore:
- - '*-beta*'
+ - '**'
branches-ignore:
- next
- main
From 2ad2c0875f83c8267e9872850f7e1e21cf9e28d2 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Sat, 22 Apr 2023 00:38:32 -0700
Subject: [PATCH 04/34] 'update generate-doc.yml file with
manual_readme_content.md'
---
.github/workflows/generate-doc.yml | 1 +
1 file changed, 1 insertion(+)
diff --git a/.github/workflows/generate-doc.yml b/.github/workflows/generate-doc.yml
index 7a3ba90..9284f9d 100644
--- a/.github/workflows/generate-doc.yml
+++ b/.github/workflows/generate-doc.yml
@@ -5,6 +5,7 @@ on:
paths:
- '*.json'
- 'readme.html'
+ - 'manual_readme_content.md'
tags-ignore:
- '**'
branches-ignore:
From 235727b283871511e35a52ac1b77bce20758fa85 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Fri, 14 Jul 2023 14:32:11 -0700
Subject: [PATCH 05/34] Remove semgrep workflow file
---
.github/workflows/semgrep.yml | 28 ----------------------------
1 file changed, 28 deletions(-)
delete mode 100644 .github/workflows/semgrep.yml
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
deleted file mode 100644
index 712cc1b..0000000
--- a/.github/workflows/semgrep.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: Semgrep
-on:
- pull_request_target:
- branches:
- - next
- - main
- push:
- branches:
- - next
- - main
-jobs:
- semgrep:
- runs-on: ubuntu-latest
- steps:
- - if: github.event_name == 'push'
- run: |
- echo "REPOSITORY=${{ github.repository }}" >> $GITHUB_ENV
- echo "REF=${{ github.REF }}" >> $GITHUB_ENV
- - if: github.event_name == 'pull_request_target'
- run: |
- echo "REPOSITORY=${{ github.event.pull_request.head.repo.full_name }}" >> $GITHUB_ENV
- echo "REF=${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV
- - uses: 'phantomcyber/dev-cicd-tools/github-actions/semgrep@main'
- with:
- SEMGREP_DEPLOYMENT_ID: ${{ secrets.SEMGREP_DEPLOYMENT_ID }}
- SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
- REPOSITORY: ${{ github.repository }}
- REF: ${{ github.ref }}
From 9e15488c11d06f5dc3b2012c2f0f87a8e32651b2 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Tue, 1 Aug 2023 12:47:28 -0700
Subject: [PATCH 06/34] 'convert readme.html to manual_readme_content.md'
---
manual_readme_content.md | 281 +++++++++++++++++++++++++
readme.html | 440 ---------------------------------------
2 files changed, 281 insertions(+), 440 deletions(-)
create mode 100644 manual_readme_content.md
delete mode 100644 readme.html
diff --git a/manual_readme_content.md b/manual_readme_content.md
new file mode 100644
index 0000000..279d082
--- /dev/null
+++ b/manual_readme_content.md
@@ -0,0 +1,281 @@
+[comment]: # " File: README.md"
+[comment]: # " Copyright (c) 2016-2022 Splunk Inc."
+[comment]: # ""
+[comment]: # "Licensed under the Apache License, Version 2.0 (the 'License');"
+[comment]: # "you may not use this file except in compliance with the License."
+[comment]: # "You may obtain a copy of the License at"
+[comment]: # ""
+[comment]: # " http://www.apache.org/licenses/LICENSE-2.0"
+[comment]: # ""
+[comment]: # "Unless required by applicable law or agreed to in writing, software distributed under"
+[comment]: # "the License is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,"
+[comment]: # "either express or implied. See the License for the specific language governing permissions"
+[comment]: # "and limitations under the License."
+[comment]: # ""
+**Playbook Backward Compatibility**
+
+- New action parameters have been added to the actions given below. Hence, it is requested to the
+ end-user please update their existing playbooks and provide values to these new action
+ parameters to ensure the correct functioning of the playbooks created on the earlier versions of
+ the app.
+
+
+
+ - **For version 3.4.X :**
+
+
+
+ - Import domain observable - **source** parameter has been added
+ - Import URL observable - **source, allow_unresolved** parameters have been added
+ - Import IP observable - **source** parameter has been added
+ - Import file observable - **source** parameter has been added
+ - Import email observable - **source** parameter has been added
+ - Detonate file - **use_premium_sandbox, use_vmray_sandbox, vmray_max_jobs, fields**
+ parameters have been added
+ - Detonate URL - **use_premium_sandbox, use_vmray_sandbox, vmray_max_jobs, fields**
+ parameters have been added
+
+ - **For version 3.0.X :**
+
+
+
+ - Import domain observable - **with_approval, allow_unresolved** parameters have been
+ added
+ - Import URL observable - **with_approval** parameter has been added
+ - Import IP observable - **with_approval** parameter has been added
+ - Import file observable - **with_approval** parameter has been added
+ - Import email observable - **with_approval** parameter has been added
+ - Import observables - **with_approval, allow_unresolved** parameters have been added
+ - List threat models - **publication_status** parameter has been added
+
+ - **For version 2.0.9 :**
+
+
+
+ - Create Incident - **create_on_cloud** parameter has been added
+ - Import domain observable - **create_on_cloud** parameter has been added
+ - Import URL observable - **create_on_cloud** parameter has been added
+ - Import IP observable - **create_on_cloud** parameter has been added
+ - Import file observable - **create_on_cloud** parameter has been added
+ - Import email observable - **create_on_cloud** parameter has been added
+ - Import observables - **create_on_cloud** parameter has been added
+
+**Asset Configuration Parameters**
+
+- **is_cloud_instance** - This boolean parameter is used to indicate whether the Anomali
+ Threatstream instance is on the cloud. If the parameter is left unchecked, the app and its
+ functionalities will internally consider it as an on-prem instance.
+
+**Prerequisite for \[Delete Incident / Delete Actor / Delete Vulnerability / Delete Rule / Delete
+Threat Bulletin\] actions**
+
+- The authenticated user in the app should have appropriate permissions (Organization Admin) for
+ deleting the incidents/actors/vulnerabilities/rules/threat-bulletins on the Anomali Threatstream
+ instance for these actions to be executed successfully.
+
+**Behavior for \[Whois IP\] action**
+
+- If the action can fetch additional whois data for the provided IP then, the action will pass
+ successfully with that additional data.
+- If the action is unable to fetch additional whois data for the provided IP then, the action will
+ pass successfully without that additional data but with an appropriate message.
+
+**Behavior for Domain Reputation**
+
+- The action will try to find an intelligence with the same name provided in the \[domain\]
+ parameter in the Anomali ThreatStream instance. If it is not found, then 'None' will be
+ displayed under the corresponding columns in the output view.
+- If the provided domain is not found as intelligence in the Anomali ThreatStream instance, then
+ the user needs to import a domain observable with the provided domain as input and then try to
+ re-run the \[domain reputation\] action.
+
+**On Poll Functionality**
+
+- It fetches the incidents (belonging to the configured organization ID in the configuration
+ parameters) and their intelligence data to ingest them as containers and artifacts.
+
+- Approaches for fetching incidents based on the **Ingest only incidents marked published**
+ configuration parameter
+
+
+
+ - Parameter kept unchecked: Ingesting all the incidents irrespective of their publication
+ status
+ - Parameter kept checked: Ingesting the incidents which are only in the published state
+
+- Types of polling
+
+
+
+ - Manual Polling
+
+
+
+ - All the incidents are fetched, controlled by the count mentioned in the container_count
+ parameter in the oldest first order based on the **modified_ts** value of the incidents
+ irrespective of the incidents fetched in the last run. If the user tries to run the
+ manual polling again with a value less than the already ingested incidents, then, again
+ the same incidents will be fetched starting from the oldest first and will be marked as
+ duplicates. It is recommended to run manual polling using a relatively greater value in
+ the container_count parameter to ensure all the incidents are ingested.
+ - The **modified_ts** time of the last fetched incident is not considered for consequent
+ runs of the manual polling.
+
+ - Scheduled | Interval Polling
+
+
+
+ - Same functionality as manual polling along with the additional points mentioned below:
+
+
+
+ - **The maximum number of incidents to poll in the first run of the scheduled
+ polling** configuration parameter governs the number of incidents fetched in the
+ first run.
+ - The **modified_ts** time of the last fetched incident is stored in the
+ **last_incident_time** key of the state file.
+ - For the consecutive runs, the incidents are fetched starting from the time stored in
+ the **last_incident_time** key of the state file.
+ - Please provide a larger value in the **Maximum number of incidents to poll in the
+ first run of the scheduled polling** configuration parameter to fetch all the
+ existing (older) incidents in the first run itself. From the consecutive runs, the
+ newly created or the modified incidents will be automatically ingested.
+
+**Behavior for \[Create vulnerability / Update vulnerability / Create actor / Update Actor / Create
+threat bulletin / Update threat bulletin\] actions**
+
+- Trusted circles are not available locally on On-prem (Hybrid) instance.
+
+**Behavior for \[Create vulnerability / Update vulnerability / Create actor / Update Actor / Create
+threat bulletin / Update threat bulletin / Create incident / Update incident\] actions**
+
+- The action uses different API endpoints for creating / updating an entity and associating
+ intelligence, attachments, import sessions or comments to the entity.
+- If the action fails to associate the intelligence, attachments, import sessions or comments
+ while creating an entity, the user can associate them by running the Update action with valid
+ inputs.
+
+**Confidence action parameter for import observable related actions**
+
+- For \[import file observable\] and \[import email observable\] actions user has to provide the
+ confidence value in \[confidence\] action parameter.
+
+- For \[import domain observable\], \[import ip observable\], and \[import url observable\]
+ actions ThreatStream automatically gives the confidence value based on some internal logical
+ operations | processes as per the API documentation.
+
+- For \[import observable\] action user can provide confidence value in 'fields' parameter as
+ {"confidence": \}.
+
+
+
+ - For hash and email type of observable, the value of the confidence will be reflected.
+ - For domain, IP, and URL type of observable, the value of the confidence will be ignored.
+
+**Behavior of import\_\\_observable and the import_observables actions**
+
+- The action run just sends a request for importing the observable value to the Anomali server.
+
+- The action run is a success if a response of **202 Accepted** is returned by the Anomali API.
+ The action does not wait for the observable to reflect on the Anomali UI.
+
+- The successful run of the actions does not guarantee the successful import of the observable on
+ the Anomali server
+
+
+
+ - If the provided parameters and their expected combinations are correct, then the observable
+ will be successfully imported after an indefinite interval of time (based on the Anomali
+ server).
+ - If the provided parameters and their combinations are incorrect, then the action run would
+ be a success (because the API does not return an error response for this and accepts the
+ request) though the observable is not imported on the Anomali server.
+
+- It is recommended to add a required time delay between the action blocks which are dependent on
+ the successful import of an observable.
+
+- To check if the observable was successfully imported, the user can run and check the **List
+ Observables** action which fetches the observables in the latest first order (based on
+ **created_ts** time).
+
+**List of indicator types (itype) for the import\_\\_observable and the
+import_observables actions (To be given as input when with_approval parameter is set to False)**
+
+| actor_ip | actor_ipv6 | adware_domain | adware_registry_key |
+|-------------------------|----------------------|-------------------------|-----------------------------|
+| anon_proxy | anon_proxy_ipv6 | anon_vpn | anon_vpn_ipv6 |
+| apt_domain | apt_email | apt_file_name | apt_file_path |
+| apt_ip | apt_ipv6 | apt_md5 | apt_mta |
+| apt_mutex | apt_registry_key | apt_service_description | apt_service_displayname |
+| apt_service_name | apt_ssdeep | apt_subject | apt_ua |
+| apt_url | bot_ip | bot_ipv6 | brute_ip |
+| brute_ipv6 | c2_domain | c2_ip | c2_ipv6 |
+| c2_url | comm_proxy_domain | comm_proxy_ip | compromised_domain |
+| compromised_email | compromised_ip | compromised_ipv6 | compromised_service_account |
+| compromised_url | crypto_hash | crypto_ip | crypto_pool |
+| crypto_url | crypto_wallet | ddos_ip | ddos_ipv6 |
+| disposable_email_domain | dyn_dns | exfil_domain | exfil_ip |
+| exfil_ipv6 | exfil_url | exploit_domain | exploit_ip |
+| exploit_ipv6 | exploit_url | fraud_domain | fraud_ip |
+| fraud_md5 | fraud_email | fraud_url | free_email_domain |
+| geolocation_url | hack_tool | i2p_ip | i2p_ipv6 |
+| ipcheck_url | mal_domain | mal_email | mal_file_name |
+| mal_file_path | mal_ip | mal_ipv6 | mal_md5 |
+| mal_mutex | mal_registry_key | mal_service_description | mal_service_displayname |
+| mal_service_name | mal_ssdeep | mal_sslcert_sh1 | mal_ua |
+| mal_url | p2pcnc | p2pcnc_ipv6 | parked_domain |
+| parked_ip | parked_ipv6 | parked_url | pastesite_url |
+| phish_domain | phish_email | phish_ip | phish_ipv6 |
+| phish_md5 | phish_url | proxy_ip | proxy_ipv6 |
+| scan_ip | scan_ipv6 | sinkhole_domain | sinkhole_ip |
+| sinkhole_ipv6 | social_media_url | spam_domain | spam_email |
+| spam_ip | spam_ipv6 | spam_mta | spam_url |
+| speedtest_url | ssh_ip | ssh_ipv6 | ssl_cert_serial_number |
+| suppress | suspicious_domain | suspicious_email | suspicious_ip |
+| suspicious_reg_email | suspicious_url | tor_ip | tor_ipv6 |
+| torrent_tracker_url | vpn_domain | vps_ip | vps_ipv6 |
+| whois_bulk_reg_email | whois_privacy_domain | whois_privacy_email | |
+
+**NOTE:** If the input contains any indicator_type value except the ones listed above, the action
+will behave according to the API behavior.
+
+**List of threat types (threat_type) for the import\_\\_observable and the
+import_observables actions (To be given as input when with_approval parameter is set to True)**
+
+| adware | anomalous | anonymization | apt |
+|--------|---------------|---------------|-------------|
+| bot | brute | c2 | compromised |
+| crypto | data_leakage | ddos | dyn_dns |
+| exfil | exploit | fraud | hack_tool |
+| i2p | informational | malware | p2p |
+| parked | phish | scan | sinkhole |
+| spam | suppress | suspicious | tor |
+| vps | | | |
+
+**NOTE:** If the input contains any threat_type value except the ones listed above, the action will
+behave according to the API behavior.
+
+## Port Information
+
+The app uses HTTP/HTTPS protocol for communicating with the ThreatStream Server. Below are the
+default ports used by Splunk SOAR.
+
+| Service Name | Transport Protocol | Port |
+|--------------|--------------------|------|
+| http | tcp | 80 |
+| https | tcp | 443 |
+
+## ipwhois
+
+This app uses the ipwhois module, which is licensed under the BSD License, Copyright (c) 2013-2019
+Philip Hane.
+
+## wizard-whois
+
+This app uses the wizard-whois module, which is licensed under the MIT License, Copyright (c)
+Michael Ramsey.
+
+## dnspython
+
+This app uses the dns module, which is licensed under the Freeware (BSD-like) License, Copyright (c)
+2018 Bob Halley.
diff --git a/readme.html b/readme.html
deleted file mode 100644
index 7bcc055..0000000
--- a/readme.html
+++ /dev/null
@@ -1,440 +0,0 @@
-
-
-Playbook Backward Compatibility
-
- - New action parameters have been added to the actions given below. Hence, it is requested to the end-user please update their existing playbooks and provide values to these new action parameters to ensure the correct functioning of the playbooks created on the earlier versions of the app.
-
- - For version 3.4.X :
-
- - Import domain observable - source parameter has been added
- - Import URL observable - source, allow_unresolved parameters have been added
- - Import IP observable - source parameter has been added
- - Import file observable - source parameter has been added
- - Import email observable - source parameter has been added
- - Detonate file - use_premium_sandbox, use_vmray_sandbox, vmray_max_jobs, fields parameters have been added
- - Detonate URL - use_premium_sandbox, use_vmray_sandbox, vmray_max_jobs, fields parameters have been added
-
- - For version 3.0.X :
-
- - Import domain observable - with_approval, allow_unresolved parameters have been added
- - Import URL observable - with_approval parameter has been added
- - Import IP observable - with_approval parameter has been added
- - Import file observable - with_approval parameter has been added
- - Import email observable - with_approval parameter has been added
- - Import observables - with_approval, allow_unresolved parameters have been added
- - List threat models - publication_status parameter has been added
-
- - For version 2.0.9 :
-
- - Create Incident - create_on_cloud parameter has been added
- - Import domain observable - create_on_cloud parameter has been added
- - Import URL observable - create_on_cloud parameter has been added
- - Import IP observable - create_on_cloud parameter has been added
- - Import file observable - create_on_cloud parameter has been added
- - Import email observable - create_on_cloud parameter has been added
- - Import observables - create_on_cloud parameter has been added
-
-
-
-
-
-Asset Configuration Parameters
-
- - is_cloud_instance - This boolean parameter is used to indicate whether the Anomali Threatstream instance is on the cloud. If the parameter is left unchecked, the app and its functionalities will internally consider it as an on-prem instance.
-
-
-
-Prerequisite for [Delete Incident / Delete Actor / Delete Vulnerability / Delete Rule / Delete Threat Bulletin] actions
-
- - The authenticated user in the app should have appropriate permissions (Organization Admin) for deleting the incidents/actors/vulnerabilities/rules/threat-bulletins on the Anomali Threatstream instance for these actions to be executed successfully.
-
-
-
-Behavior for [Whois IP] action
-
- - If the action can fetch additional whois data for the provided IP then, the action will pass successfully with that additional data.
- - If the action is unable to fetch additional whois data for the provided IP then, the action will pass successfully without that additional data but with an appropriate message.
-
-
-
-Behavior for Domain Reputation
-
- - The action will try to find an intelligence with the same name provided in the [domain] parameter in the Anomali ThreatStream instance. If it is not found, then 'None' will be displayed under the corresponding columns in the output view.
- - If the provided domain is not found as intelligence in the Anomali ThreatStream instance, then the user needs to import a domain observable with the provided domain as input and then try to re-run the [domain reputation] action.
-
-
-
-On Poll Functionality
-
- - It fetches the incidents (belonging to the configured organization ID in the configuration parameters) and their intelligence data to ingest them as containers and artifacts.
- - Approaches for fetching incidents based on the Ingest only incidents marked published configuration parameter
-
- - Parameter kept unchecked: Ingesting all the incidents irrespective of their publication status
- - Parameter kept checked: Ingesting the incidents which are only in the published state
-
- - Types of polling
-
- - Manual Polling
-
- - All the incidents are fetched, controlled by the count mentioned in the container_count parameter in the oldest first order based on the modified_ts value of the incidents irrespective of the incidents fetched in the last run. If the user tries to run the manual polling again with a value less than the already ingested incidents, then, again the same incidents will be fetched starting from the oldest first and will be marked as duplicates. It is recommended to run manual polling using a relatively greater value in the container_count parameter to ensure all the incidents are ingested.
- - The modified_ts time of the last fetched incident is not considered for consequent runs of the manual polling.
-
-
- - Scheduled | Interval Polling
-
- - Same functionality as manual polling along with the additional points mentioned below:
-
- - The maximum number of incidents to poll in the first run of the scheduled polling configuration parameter governs the number of incidents fetched in the first run.
- - The modified_ts time of the last fetched incident is stored in the last_incident_time key of the state file.
- - For the consecutive runs, the incidents are fetched starting from the time stored in the last_incident_time key of the state file.
- - Please provide a larger value in the Maximum number of incidents to poll in the first run of the scheduled polling configuration parameter to fetch all the existing (older) incidents in the first run itself. From the consecutive runs, the newly created or the modified incidents will be automatically ingested.
-
-
-
-
-
-
-Behavior for [Create vulnerability / Update vulnerability / Create actor / Update Actor / Create threat bulletin / Update threat bulletin] actions
-
- - Trusted circles are not available locally on On-prem (Hybrid) instance.
-
-
-
-Behavior for [Create vulnerability / Update vulnerability / Create actor / Update Actor / Create threat bulletin / Update threat bulletin / Create incident / Update incident] actions
-
- - The action uses different API endpoints for creating / updating an entity and associating intelligence, attachments, import sessions or comments to the entity.
- - If the action fails to associate the intelligence, attachments, import sessions or comments while creating an entity, the user can associate them by running the Update action with valid inputs.
-
-
-
-Confidence action parameter for import observable related actions
-
- - For [import file observable] and [import email observable] actions user has to provide the confidence value in [confidence] action parameter.
- - For [import domain observable], [import ip observable], and [import url observable] actions ThreatStream automatically gives the confidence value based on some internal logical operations | processes as per the API documentation.
- - For [import observable] action user can provide confidence value in 'fields' parameter as {"confidence": <confidence_value>}.
-
- - For hash and email type of observable, the value of the confidence will be reflected.
- - For domain, IP, and URL type of observable, the value of the confidence will be ignored.
-
-
-
-
-Behavior of import_<indicator_type>_observable and the import_observables actions
-
- - The action run just sends a request for importing the observable value to the Anomali server.
- - The action run is a success if a response of 202 Accepted is returned by the Anomali API. The action does not wait for the observable to reflect on the Anomali UI.
- - The successful run of the actions does not guarantee the successful import of the observable on the Anomali server
-
- - If the provided parameters and their expected combinations are correct, then the observable will be successfully imported after an indefinite interval of time (based on the Anomali server).
- - If the provided parameters and their combinations are incorrect, then the action run would be a success (because the API does not return an error response for this and accepts the request) though the observable is not imported on the Anomali server.
-
- - It is recommended to add a required time delay between the action blocks which are dependent on the successful import of an observable.
- - To check if the observable was successfully imported, the user can run and check the List Observables action which fetches the observables in the latest first order (based on created_ts time).
-
-
-
-
- List of indicator types (itype) for the import_<indicator_type>_observable and the import_observables
- actions (To be given as input when with_approval parameter is set to False)
-
-
- actor_ip |
- actor_ipv6 |
- adware_domain |
- adware_registry_key |
-
-
- anon_proxy |
- anon_proxy_ipv6 |
- anon_vpn |
- anon_vpn_ipv6 |
-
-
- apt_domain |
- apt_email |
- apt_file_name |
- apt_file_path |
-
-
- apt_ip |
- apt_ipv6 |
- apt_md5 |
- apt_mta |
-
-
- apt_mutex |
- apt_registry_key |
- apt_service_description |
- apt_service_displayname |
-
-
- apt_service_name |
- apt_ssdeep |
- apt_subject |
- apt_ua |
-
-
- apt_url |
- bot_ip |
- bot_ipv6 |
- brute_ip |
-
-
- brute_ipv6 |
- c2_domain |
- c2_ip |
- c2_ipv6 |
-
-
- c2_url |
- comm_proxy_domain |
- comm_proxy_ip |
- compromised_domain |
-
-
- compromised_email |
- compromised_ip |
- compromised_ipv6 |
- compromised_service_account |
-
-
- compromised_url |
- crypto_hash |
- crypto_ip |
- crypto_pool |
-
-
- crypto_url |
- crypto_wallet |
- ddos_ip |
- ddos_ipv6 |
-
-
- disposable_email_domain |
- dyn_dns |
- exfil_domain |
- exfil_ip |
-
-
- exfil_ipv6 |
- exfil_url |
- exploit_domain |
- exploit_ip |
-
-
- exploit_ipv6 |
- exploit_url |
- fraud_domain |
- fraud_ip |
-
-
- fraud_md5 |
- fraud_email |
- fraud_url |
- free_email_domain |
-
-
- geolocation_url |
- hack_tool |
- i2p_ip |
- i2p_ipv6 |
-
-
- ipcheck_url |
- mal_domain |
- mal_email |
- mal_file_name |
-
-
- mal_file_path |
- mal_ip |
- mal_ipv6 |
- mal_md5 |
-
-
- mal_mutex |
- mal_registry_key |
- mal_service_description |
- mal_service_displayname |
-
-
- mal_service_name |
- mal_ssdeep |
- mal_sslcert_sh1 |
- mal_ua |
-
-
- mal_url |
- p2pcnc |
- p2pcnc_ipv6 |
- parked_domain |
-
-
- parked_ip |
- parked_ipv6 |
- parked_url |
- pastesite_url |
-
-
- phish_domain |
- phish_email |
- phish_ip |
- phish_ipv6 |
-
-
- phish_md5 |
- phish_url |
- proxy_ip |
- proxy_ipv6 |
-
-
- scan_ip |
- scan_ipv6 |
- sinkhole_domain |
- sinkhole_ip |
-
-
- sinkhole_ipv6 |
- social_media_url |
- spam_domain |
- spam_email |
-
-
- spam_ip |
- spam_ipv6 |
- spam_mta |
- spam_url |
-
-
- speedtest_url |
- ssh_ip |
- ssh_ipv6 |
- ssl_cert_serial_number |
-
-
- suppress |
- suspicious_domain |
- suspicious_email |
- suspicious_ip |
-
-
- suspicious_reg_email |
- suspicious_url |
- tor_ip |
- tor_ipv6 |
-
-
- torrent_tracker_url |
- vpn_domain |
- vps_ip |
- vps_ipv6 |
-
-
- whois_bulk_reg_email |
- whois_privacy_domain |
- whois_privacy_email |
- |
-
-
-NOTE: If the input contains any indicator_type value except the ones listed above, the action will behave according to the API behavior.
-
-
-
- List of threat types (threat_type) for the import_<indicator_type>_observable and the import_observables actions (To be given as input when with_approval parameter is set to True)
-
-
- adware |
- anomalous |
- anonymization |
- apt |
-
-
- bot |
- brute |
- c2 |
- compromised |
-
-
- crypto |
- data_leakage |
- ddos |
- dyn_dns |
-
-
- exfil |
- exploit |
- fraud |
- hack_tool |
-
-
- i2p |
- informational |
- malware |
- p2p |
-
-
- parked |
- phish |
- scan |
- sinkhole |
-
-
- spam |
- suppress |
- suspicious |
- tor |
-
-
- vps |
-
-
- NOTE: If the input contains any threat_type value except the ones listed above, the action will behave according to the API behavior.
-
-
-Port Information
-
- The app uses HTTP/HTTPS protocol for communicating with the ThreatStream Server. Below are the default ports used by Splunk SOAR.
-
-
- Service Name |
- Transport Protocol |
- Port |
-
-
- http |
- tcp |
- 80 |
-
-
- https |
- tcp |
- 443 |
-
-
-
-
-
-
ipwhois
- This app uses the ipwhois module, which is licensed under the BSD License, Copyright (c) 2013-2019 Philip Hane.
-
-
-
wizard-whois
- This app uses the wizard-whois module, which is licensed under the MIT License, Copyright (c) Michael Ramsey.
-
-
-
dnspython
- This app uses the dns module, which is licensed under the Freeware (BSD-like) License, Copyright (c) 2018 Bob Halley.
-
From 67e6c404ca05dc562c33b5e74f1345414b58dc1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 09:04:52 +0100
Subject: [PATCH 07/34] removed validation for supporting custom types,
mentioning default types in action description
---
threatstream.json | 34 +++++++----
threatstream_connector.py | 122 +++++++++++++++++++-------------------
threatstream_consts.py | 1 -
3 files changed, 84 insertions(+), 73 deletions(-)
diff --git a/threatstream.json b/threatstream.json
index 99967fd..6e608cc 100644
--- a/threatstream.json
+++ b/threatstream.json
@@ -131,6 +131,22 @@
"data_type": "boolean",
"order": 4,
"description": "Verify server certificate"
+ },
+ "custom_types_str": {
+ "data_type": "string",
+ "order": 0,
+ "description": "Specify additional types"
+ },
+ "custom_types": {
+ "data_type": "array",
+ "order": 0,
+ "items": [
+ {
+ "data_type": "string",
+ "description": "type"
+ }
+ ],
+ "description": "Specify additional types"
}
},
"actions": [
@@ -8251,17 +8267,10 @@
"read_only": false,
"parameters": {
"observable_type": {
- "description": "Type of observable to import",
+ "description": "Type of observable to import, default types: [ip, domain, url, email, hash]. Custom types can be provided if they are available on ThreatStream instance",
"data_type": "string",
"order": 0,
- "required": true,
- "value_list": [
- "ip",
- "domain",
- "url",
- "email",
- "hash"
- ]
+ "required": true
},
"value": {
"description": "Observable value",
@@ -8309,6 +8318,11 @@
"description": "Unresolved domains will be imported if set to true",
"data_type": "boolean",
"order": 6
+ },
+ "allow_custom_type": {
+ "description": "Allows upload of custom observable_type",
+ "data_type": "boolean",
+ "order": 6
}
},
"output": [
@@ -27232,4 +27246,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/threatstream_connector.py b/threatstream_connector.py
index b05131f..76d58ba 100644
--- a/threatstream_connector.py
+++ b/threatstream_connector.py
@@ -131,6 +131,9 @@ def __init__(self):
self._is_cloud_instance = None
self._first_run_limit = None
self._data_dict = {} # Blank dict to contain data from all API calls
+
+ def _save_action_handler_progress(self):
+ self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
def initialize(self):
config = self.get_config()
@@ -631,7 +634,7 @@ def _test_connectivity(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "")
def _file_reputation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_HASH]
@@ -658,7 +661,7 @@ def _file_reputation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved information on File")
def _domain_reputation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_DOMAIN]
@@ -678,7 +681,7 @@ def _domain_reputation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved information on Domain")
def _ip_reputation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_IP]
@@ -694,7 +697,7 @@ def _ip_reputation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved information on IP")
def _url_reputation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_URL]
@@ -717,7 +720,7 @@ def _url_reputation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved information on URL")
def _email_reputation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -742,7 +745,7 @@ def _email_reputation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved information on Email")
def _whois_domain(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_DOMAIN]
@@ -752,7 +755,7 @@ def _whois_domain(self, param):
return action_result.get_status()
def _whois_ip(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
value = param[THREATSTREAM_JSON_IP]
@@ -792,7 +795,7 @@ def _paginator(self, endpoint, action_result, payload=None, offset=0, limit=None
return items_list
def _handle_list_observables(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, limit = self._validate_integer(action_result, param.get("limit", 1000), THREATSTREAM_LIMIT)
@@ -816,7 +819,7 @@ def _handle_list_observables(self, param):
return action_result.set_status(phantom.APP_SUCCESS)
def _handle_list_vulnerabilities(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, limit = self._validate_integer(action_result, param.get("limit", 1000), THREATSTREAM_LIMIT)
@@ -838,7 +841,7 @@ def _handle_list_vulnerabilities(self, param):
return action_result.set_status(phantom.APP_SUCCESS)
def _handle_list_incidents(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, limit = self._validate_integer(action_result, param.get("limit", 1000), THREATSTREAM_LIMIT)
@@ -941,7 +944,7 @@ def _get_threat_model_support(self, action_result, endpoint):
return phantom.APP_SUCCESS, resp_json
def _handle_get_incident(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, resp_json = self._get_incident_support(action_result, param)
@@ -953,7 +956,7 @@ def _handle_get_incident(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved incident")
def _handle_get_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, intelligence_id = self._validate_integer(action_result, param["intelligence_id"], THREATSTREAM_INTELLIGENCE_ID)
@@ -974,7 +977,7 @@ def _handle_get_observable(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved observable")
def _handle_get_vulnerability(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, vulnerability_id = self._validate_integer(action_result, param["vulnerability_id"], THREATSTREAM_VULNERABILITY_ID)
@@ -1000,7 +1003,7 @@ def _handle_get_vulnerability(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved vulnerability")
def _handle_delete_incident(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, incident_id = self._validate_integer(action_result, param["incident_id"], THREATSTREAM_INCIDENT_ID)
@@ -1029,7 +1032,7 @@ def _handle_delete_incident(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted incident")
def _handle_create_incident(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
create_on_cloud = param.get("create_on_cloud", False)
@@ -1169,7 +1172,7 @@ def _handle_create_incident(self, param):
return action_result.set_status(phantom.APP_SUCCESS, message)
def _handle_update_incident(self, param): # noqa
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
message = None
@@ -1418,7 +1421,7 @@ def _create_intelligence(self, action_result, intelligence):
return intel
def _handle_run_query(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
payload = self._generate_payload()
@@ -1506,11 +1509,6 @@ def import_support(self, param, action_result): # noqa
)
if not with_approval:
observable_type = param["observable_type"]
- if observable_type not in THREATSTREAM_OBSERVABLE_TYPE:
- return action_result.set_status(
- phantom.APP_ERROR,
- THREATSTREAM_INVALID_SELECTION.format("observable type", ", ".join(THREATSTREAM_OBSERVABLE_TYPE))
- )
key = "itype"
endpoint = ENDPOINT_IMPORT_IOC
method = "patch"
@@ -1712,7 +1710,7 @@ def import_support(self, param, action_result): # noqa
return action_result.set_status(phantom.APP_SUCCESS, "Successfully sent the request for importing the observable")
def _handle_import_email_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the email observables")
@@ -1720,7 +1718,7 @@ def _handle_import_email_observable(self, param):
return action_result.get_status()
def _handle_import_file_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the file observables")
@@ -1728,7 +1726,7 @@ def _handle_import_file_observable(self, param):
return action_result.get_status()
def _handle_import_ip_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the IP observables")
@@ -1736,7 +1734,7 @@ def _handle_import_ip_observable(self, param):
return action_result.get_status()
def _handle_import_url_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the URL observables")
@@ -1744,7 +1742,7 @@ def _handle_import_url_observable(self, param):
return action_result.get_status()
def _handle_import_domain_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the domain observables")
@@ -1752,7 +1750,7 @@ def _handle_import_domain_observable(self, param):
return action_result.get_status()
def _handle_import_observables(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
self.debug_print("Calling generic method import_support to import the IOC observables")
@@ -1760,7 +1758,7 @@ def _handle_import_observables(self, param):
return action_result.get_status()
def _handle_tag_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
config = self.get_config()
@@ -1815,7 +1813,7 @@ def _handle_tag_observable(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully tagged observable")
def _handle_get_status(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
payload = self._generate_payload()
@@ -1829,7 +1827,7 @@ def _handle_get_status(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved detonation status")
def _handle_get_report(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
payload = self._generate_payload()
@@ -1868,7 +1866,7 @@ def _build_data_detonate_actions(self, action_result, data, param):
return data
def _handle_detonate_file(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -1953,7 +1951,7 @@ def _handle_detonate_file(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully detonated file")
def _handle_detonate_url(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -2011,7 +2009,7 @@ def _handle_detonate_url(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully detonated URL")
def _handle_get_pcap(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -2340,7 +2338,7 @@ def _handle_on_poll(self, param): # noqa
return action_result.set_status(phantom.APP_SUCCESS, "Successfully retrieved and ingested the list of incidents")
def _handle_import_session_search(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -2378,7 +2376,7 @@ def _handle_import_session_search(self, param):
return phantom.APP_SUCCESS
def _handle_import_session_update(self, param): # noqa
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -2548,7 +2546,7 @@ def _handle_import_session_update(self, param): # noqa
return action_result.set_status(phantom.APP_SUCCESS, ". ".join(messages))
def _handle_threat_model_search(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
ret_val, limit = self._validate_integer(action_result, param.get("limit", 1000), THREATSTREAM_LIMIT)
@@ -2642,7 +2640,7 @@ def _build_threatbulletin_data(self, param, data):
return data
def _handle_create_threat_bulletin(self, param): # noqa
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
comments = param.get('comments')
@@ -2835,7 +2833,7 @@ def _handle_create_threat_bulletin(self, param): # noqa
return action_result.set_status(phantom.APP_SUCCESS, message)
def _handle_update_threat_bulletin(self, param): # noqa
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3064,7 +3062,7 @@ def _handle_update_threat_bulletin(self, param): # noqa
return action_result.set_status(phantom.APP_SUCCESS, "Successfully updated threat bulletin")
def _handle_delete_threat_bulletin(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3097,7 +3095,7 @@ def _handle_delete_threat_bulletin(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted threat bulletin")
def _handle_list_threat_bulletins(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3144,7 +3142,7 @@ def _handle_list_threat_bulletins(self, param):
return action_result.set_status(phantom.APP_SUCCESS)
def _handle_list_associations(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3315,13 +3313,13 @@ def _handle_association(self, param, endpoint): # noqa
return action_result.set_status(phantom.APP_SUCCESS, "Successfully updated associations")
def _handle_add_association(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
endpoint = ENDPOINT_ADD_ASSOCIATION
return self._handle_association(param, endpoint)
def _handle_remove_association(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
endpoint = ENDPOINT_REMOVE_ASSOCIATION
return self._handle_association(param, endpoint)
@@ -3427,7 +3425,7 @@ def _get_rule_support(self, action_result, param=None, payload=None, rule_id=Non
return phantom.APP_SUCCESS, resp_json
def _handle_create_rule(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
create_on_cloud = param.get("create_on_cloud", False)
@@ -3486,7 +3484,7 @@ def _handle_create_rule(self, param):
return action_result.set_status(phantom.APP_SUCCESS, message)
def _handle_update_rule(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3528,7 +3526,7 @@ def _handle_update_rule(self, param):
return action_result.set_status(phantom.APP_SUCCESS, message)
def _handle_list_rules(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3552,7 +3550,7 @@ def _handle_list_rules(self, param):
return action_result.set_status(phantom.APP_SUCCESS)
def _handle_delete_rule(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3585,7 +3583,7 @@ def _handle_delete_rule(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted rule")
def _handle_list_actors(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3607,7 +3605,7 @@ def _handle_list_actors(self, param):
summary['actors_returned'] = action_result.get_data_size()
def _handle_delete_actor(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -3640,7 +3638,7 @@ def _handle_delete_actor(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted actor")
def _handle_list_imports(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4221,7 +4219,7 @@ def _update_threat_model(self, action_result, param, endpoint, entity_type, enti
return action_result.set_status(phantom.APP_SUCCESS, "Successfully updated {}".format(entity_type))
def _handle_create_vulnerability(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4229,7 +4227,7 @@ def _handle_create_vulnerability(self, param):
return action_result.get_status()
def _handle_update_vulnerability(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4242,7 +4240,7 @@ def _handle_update_vulnerability(self, param):
return action_result.get_status()
def _handle_delete_vulnerability(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4278,7 +4276,7 @@ def _handle_delete_vulnerability(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted vulnerability")
def _handle_create_actor(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4286,7 +4284,7 @@ def _handle_create_actor(self, param):
return action_result.get_status()
def _handle_update_actor(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4298,7 +4296,7 @@ def _handle_update_actor(self, param):
return action_result.get_status()
def _handle_update_observable(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4376,7 +4374,7 @@ def _handle_update_observable(self, param):
return action_result.set_status(phantom.APP_SUCCESS, "Successfully updated observable")
def _handle_create_investigation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4421,7 +4419,7 @@ def _handle_create_investigation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, 'Successfully created investigation')
def _handle_list_investigations(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4444,7 +4442,7 @@ def _handle_list_investigations(self, param):
return action_result.set_status(phantom.APP_SUCCESS)
def _handle_get_investigation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
payload = self._generate_payload()
@@ -4473,7 +4471,7 @@ def _handle_get_investigation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, 'Successfully retrieved investigation')
def _handle_update_investigation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
@@ -4512,7 +4510,7 @@ def _handle_update_investigation(self, param):
return action_result.set_status(phantom.APP_SUCCESS, 'Successfully updated investigation')
def _handle_delete_investigation(self, param):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self._save_action_handler_progress()
action_result = self.add_action_result(ActionResult(dict(param)))
diff --git a/threatstream_consts.py b/threatstream_consts.py
index c7f57d5..6ea0134 100644
--- a/threatstream_consts.py
+++ b/threatstream_consts.py
@@ -79,7 +79,6 @@
THREATSTREAM_BODY_CONTENT_TYPE = ["markdown", "richtext"]
THREATSTREAM_STATUS = ["Approved", "Ready To Review", "Errors", "Rejected", "Processing"]
THREATSTREAM_PRIORITY = ["very low", "low", "medium", "high", "very high"]
-THREATSTREAM_OBSERVABLE_TYPE = ["ip", "domain", "url", "email", "hash"]
# Error and status messages
THREATSTREAM_INVALID_SELECTION = "Invalid '{0}' entered. Must be one of: {1}"
From 35e1ed015ed0680067482854c264be53c40f0b6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 09:05:45 +0100
Subject: [PATCH 08/34] Updated version and licesning
---
threatstream.json | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/threatstream.json b/threatstream.json
index 6e608cc..ca38461 100644
--- a/threatstream.json
+++ b/threatstream.json
@@ -5,7 +5,7 @@
"publisher": "Splunk",
"type": "threat intel",
"main_module": "threatstream_connector.py",
- "app_version": "3.5.0",
+ "app_version": "3.5.1",
"latest_tested_versions": [
"On-premise v4.0 RED",
"Cloud, 26 September 2022"
@@ -20,7 +20,7 @@
"python_version": "3",
"min_phantom_version": "5.3.3",
"fips_compliant": true,
- "license": "Copyright (c) 2016-2022 Splunk Inc.",
+ "license": "Copyright (c) 2016-2023 Splunk Inc.",
"pip_dependencies": {
"wheel": [
{
From 58cabeee12cdcde4b2264d44eacb2ae2200e42ef Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Fri, 1 Dec 2023 08:06:31 +0000
Subject: [PATCH 09/34] Update README.md
---
README.md | 7662 +++++++++++++++++++++++++++--------------------------
1 file changed, 3926 insertions(+), 3736 deletions(-)
diff --git a/README.md b/README.md
index de33554..2d99357 100644
--- a/README.md
+++ b/README.md
@@ -2,11 +2,11 @@
# ThreatStream
Publisher: Splunk
-Connector Version: 3\.5\.0
+Connector Version: 3.5.1
Product Vendor: Anomali
Product Name: ThreatStream
-Product Version Supported (regex): "\.\*"
-Minimum Product Version: 5\.3\.3
+Product Version Supported (regex): ".\*"
+Minimum Product Version: 5.3.3
Integrates a variety of generic, reputation, and investigative actions from the Anomali ThreatStream threat intelligence platform
@@ -133,7 +133,7 @@ Threat Bulletin\] actions**
- The **modified_ts** time of the last fetched incident is not considered for consequent
runs of the manual polling.
- - Scheduled \| Interval Polling
+ - Scheduled | Interval Polling
@@ -174,7 +174,7 @@ threat bulletin / Update threat bulletin / Create incident / Update incident\] a
- For \[import domain observable\], \[import ip observable\], and \[import url observable\]
actions ThreatStream automatically gives the confidence value based on some internal logical
- operations \| processes as per the API documentation.
+ operations | processes as per the API documentation.
- For \[import observable\] action user can provide confidence value in 'fields' parameter as
{"confidence": \}.
@@ -299,13 +299,15 @@ The below configuration variables are required for this Connector to operate. T
VARIABLE | REQUIRED | TYPE | DESCRIPTION
-------- | -------- | ---- | -----------
**hostname** | required | string | Host Name
-**organization\_id** | optional | numeric | Organization ID for filtering incidents when polling
+**organization_id** | optional | numeric | Organization ID for filtering incidents when polling
**username** | required | string | User name
-**api\_key** | required | password | API Key
-**first\_run\_containers** | optional | numeric | Maximum number of incidents to poll in the first run of the scheduled polling
-**ingest\_only\_published\_incidents** | optional | boolean | Ingest only incidents marked as published
-**is\_cloud\_instance** | optional | boolean | Is the provided instance in hostname parameter cloud?
-**verify\_server\_cert** | optional | boolean | Verify server certificate
+**api_key** | required | password | API Key
+**first_run_containers** | optional | numeric | Maximum number of incidents to poll in the first run of the scheduled polling
+**ingest_only_published_incidents** | optional | boolean | Ingest only incidents marked as published
+**is_cloud_instance** | optional | boolean | Is the provided instance in hostname parameter cloud?
+**verify_server_cert** | optional | boolean | Verify server certificate
+**custom_types_str** | optional | string | Specify additional types
+**custom_types** | optional | array | Specify additional types
### Supported Actions
[test connectivity](#action-test-connectivity) - Test connectivity to ThreatStream by querying the intelligence endpoint
@@ -337,7 +339,7 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
[detonate url](#action-detonate-url) - Detonate URL in ThreatStream
[get status](#action-get-status) - Retrieve detonation status present in Threatstream
[get report](#action-get-report) - Retrieve detonation report present in Threatstream
-[on poll](#action-on-poll) - Callback action for the on\_poll ingest functionality
+[on poll](#action-on-poll) - Callback action for the on_poll ingest functionality
[run query](#action-run-query) - Run observables query in ThreatStream
[list import sessions](#action-list-import-sessions) - List all the import sessions
[update import session](#action-update-import-session) - This action updates the fields of the provided item id
@@ -386,70 +388,70 @@ Get information about a file
Type: **investigate**
Read only: **True**
-If nothing is found, this is because ThreatStream has no information on that file\. If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+If nothing is found, this is because ThreatStream has no information on that file. If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**hash** | required | Hash of file | string | `sha1` `sha256` `md5` `hash`
**limit** | optional | Total number of observables to return | numeric |
-**extend\_source** | optional | Fetch extra data from Anomali server if available | boolean |
+**extend_source** | optional | Fetch extra data from Anomali server if available | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.extend\_source | boolean |
-action\_result\.parameter\.hash | string | `sha1` `sha256` `md5` `hash`
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.extended\_source | string |
-action\_result\.data\.\*\.external\_references\.VirusTotal | string |
-action\_result\.data\.\*\.external\_references\.remote\_api | boolean |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `md5`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.extend_source | boolean | | True False
+action_result.parameter.hash | string | `sha1` `sha256` `md5` `hash` | 9bfc3649f7e6067764ce8ef18e8bfbb837bc68f2dd83e37daa05477c604492b2
+action_result.parameter.limit | numeric | | 1000
+action_result.data.\*.asn | string | |
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.country | string | |
+action_result.data.\*.created_ts | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | |
+action_result.data.\*.extended_source | string | |
+action_result.data.\*.external_references.VirusTotal | string | |
+action_result.data.\*.external_references.remote_api | boolean | | True False
+action_result.data.\*.feed_id | numeric | |
+action_result.data.\*.id | numeric | `threatstream intelligence id` |
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.ip | string | `ip` |
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | |
+action_result.data.\*.itype | string | |
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail2 | string | |
+action_result.data.\*.meta.severity | string | |
+action_result.data.\*.modified_ts | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | `threatstream organization id` |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | |
+action_result.data.\*.source | string | |
+action_result.data.\*.source_reported_confidence | numeric | |
+action_result.data.\*.status | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | |
+action_result.data.\*.tags.\*.name | string | |
+action_result.data.\*.tags.\*.org_id | string | |
+action_result.data.\*.tags.\*.source_user | string | |
+action_result.data.\*.tags.\*.source_user_id | string | |
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.threatscore | numeric | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | md5
+action_result.data.\*.update_id | numeric | |
+action_result.data.\*.uuid | string | | 4cf3228b-0de4-45f0-a66d-255b6ff32eaa
+action_result.data.\*.value | string | `md5` |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved information on File
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'domain reputation'
Get information about a given domain
@@ -457,80 +459,80 @@ Get information about a given domain
Type: **investigate**
Read only: **True**
-If nothing is found, this may be due to the format of the domain\. Try excluding any subdomains \(namely www\)\. If there is still no information found, then it is because ThreatStream has no information on that domain\. ThreatStream, however, may still have Passive DNS \(PDNS\) information on it, which can be found in extra data\. If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
Extra data includes PDNS, insights, and external resources\. By default, extra data is not included in the response\. You can update the flag params to include the extra data\. The search\_exact\_value parameter searches for the exact domain on ThreatStream server\. If this parameter is kept true, then the extend\_source parameter will be ignored and no extra information will be available\.
+If nothing is found, this may be due to the format of the domain. Try excluding any subdomains (namely www). If there is still no information found, then it is because ThreatStream has no information on that domain. ThreatStream, however, may still have Passive DNS (PDNS) information on it, which can be found in extra data. If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
Extra data includes PDNS, insights, and external resources. By default, extra data is not included in the response. You can update the flag params to include the extra data. The search_exact_value parameter searches for the exact domain on ThreatStream server. If this parameter is kept true, then the extend_source parameter will be ignored and no extra information will be available.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**domain** | required | Domain to investigate | string | `domain` `url`
**limit** | optional | Total number of observables to return | numeric |
-**extend\_source** | optional | Fetch extra data from Anomali server if available | boolean |
+**extend_source** | optional | Fetch extra data from Anomali server if available | boolean |
**pdns** | optional | If enabled, pdns will also be fetched | boolean |
**insights** | optional | If enabled, insights will also be fetched | boolean |
-**external\_references** | optional | If enabled, external references will also be fetched | boolean |
-**search\_exact\_value** | optional | Search for the exact domain | boolean |
+**external_references** | optional | If enabled, external references will also be fetched | boolean |
+**search_exact_value** | optional | Search for the exact domain | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.domain | string | `domain` `url`
-action\_result\.parameter\.extend\_source | boolean |
-action\_result\.parameter\.external\_references | boolean |
-action\_result\.parameter\.insights | boolean |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.pdns | boolean |
-action\_result\.parameter\.search\_exact\_value | boolean |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.extended\_source | string |
-action\_result\.data\.\*\.external\_references\.Google Safe Browsing | string |
-action\_result\.data\.\*\.external\_references\.URLVoid | string |
-action\_result\.data\.\*\.external\_references\.VirusTotal | string |
-action\_result\.data\.\*\.external\_references\.Web of Trust | string |
-action\_result\.data\.\*\.external\_references\.urlscan\.io | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `domain`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.domain | string | `domain` `url` | test.com
+action_result.parameter.extend_source | boolean | | True False
+action_result.parameter.external_references | boolean | | True False
+action_result.parameter.insights | boolean | | True False
+action_result.parameter.limit | numeric | |
+action_result.parameter.pdns | boolean | | True False
+action_result.parameter.search_exact_value | boolean | | True False
+action_result.data.\*.asn | string | |
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.country | string | |
+action_result.data.\*.created_ts | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | |
+action_result.data.\*.extended_source | string | |
+action_result.data.\*.external_references.Google Safe Browsing | string | |
+action_result.data.\*.external_references.URLVoid | string | |
+action_result.data.\*.external_references.VirusTotal | string | |
+action_result.data.\*.external_references.Web of Trust | string | |
+action_result.data.\*.external_references.urlscan.io | string | | https://test.io/domain/uponvoice.net
+action_result.data.\*.feed_id | numeric | |
+action_result.data.\*.id | numeric | `threatstream intelligence id` |
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.ip | string | `ip` |
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | |
+action_result.data.\*.itype | string | |
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail2 | string | |
+action_result.data.\*.meta.severity | string | |
+action_result.data.\*.modified_ts | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | `threatstream organization id` |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | |
+action_result.data.\*.source | string | |
+action_result.data.\*.source_reported_confidence | numeric | |
+action_result.data.\*.status | string | |
+action_result.data.\*.tags.\*.id | string | |
+action_result.data.\*.tags.\*.name | string | |
+action_result.data.\*.tags.\*.org_id | string | |
+action_result.data.\*.tags.\*.source_user | string | |
+action_result.data.\*.tags.\*.source_user_id | string | |
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.threatscore | numeric | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | domain
+action_result.data.\*.update_id | numeric | |
+action_result.data.\*.uuid | string | | 4cf3228b-0de4-45f0-a66d-255b6ff32eaa
+action_result.data.\*.value | string | `domain` |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved information on Domain
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'ip reputation'
Get information about a given IP
@@ -538,90 +540,90 @@ Get information about a given IP
Type: **investigate**
Read only: **True**
-If nothing is found, then it is because ThreatStream has no information on that IP\. ThreatStream, however, may still have Passive DNS \(PDNS\) information on it, which can be found in extra data\. If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
Extra data includes PDNS, insights, and external resources\. By default, extra data is not included in the response\. You can update the flag params to include the extra data\.
+If nothing is found, then it is because ThreatStream has no information on that IP. ThreatStream, however, may still have Passive DNS (PDNS) information on it, which can be found in extra data. If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
Extra data includes PDNS, insights, and external resources. By default, extra data is not included in the response. You can update the flag params to include the extra data.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**ip** | required | IP to investigate | string | `ip` `ipv6`
**limit** | optional | Total number of observables to return | numeric |
-**extend\_source** | optional | Fetch extra data from Anomali server if available | boolean |
+**extend_source** | optional | Fetch extra data from Anomali server if available | boolean |
**pdns** | optional | If enabled, pdns will also be fetched | boolean |
**insights** | optional | If enabled, insights will also be fetched | boolean |
-**external\_references** | optional | If enabled, external references will also be fetched | boolean |
+**external_references** | optional | If enabled, external references will also be fetched | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.extend\_source | boolean |
-action\_result\.parameter\.external\_references | boolean |
-action\_result\.parameter\.insights | boolean |
-action\_result\.parameter\.ip | string | `ip` `ipv6`
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.pdns | boolean |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.extended\_source | string |
-action\_result\.data\.\*\.external\_references\.Google Safe Browsing | string |
-action\_result\.data\.\*\.external\_references\.IPVoid | string |
-action\_result\.data\.\*\.external\_references\.Shodan | string |
-action\_result\.data\.\*\.external\_references\.VirusTotal | string |
-action\_result\.data\.\*\.external\_references\.remote\_api | boolean |
-action\_result\.data\.\*\.external\_references\.urlscan\.io | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | numeric |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `ip`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.extend_source | boolean | | True False
+action_result.parameter.external_references | boolean | | True False
+action_result.parameter.insights | boolean | | True False
+action_result.parameter.ip | string | `ip` `ipv6` | 122.122.122.122
+action_result.parameter.limit | numeric | | 1000
+action_result.parameter.pdns | boolean | | True False
+action_result.data.\*.asn | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.country | string | |
+action_result.data.\*.created_by | string | |
+action_result.data.\*.created_ts | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | |
+action_result.data.\*.extended_source | string | |
+action_result.data.\*.external_references.Google Safe Browsing | string | |
+action_result.data.\*.external_references.IPVoid | string | |
+action_result.data.\*.external_references.Shodan | string | |
+action_result.data.\*.external_references.VirusTotal | string | |
+action_result.data.\*.external_references.remote_api | boolean | | True False
+action_result.data.\*.external_references.urlscan.io | string | | https://test.io/domain/uponvoice.net
+action_result.data.\*.feed_id | numeric | |
+action_result.data.\*.id | numeric | `threatstream intelligence id` |
+action_result.data.\*.import_session_id | numeric | |
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | `ip` |
+action_result.data.\*.is_anonymous | boolean | | False
+action_result.data.\*.is_editable | boolean | | False
+action_result.data.\*.is_public | boolean | |
+action_result.data.\*.itype | string | |
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail | string | | Blocklist Brute Force IPs
+action_result.data.\*.meta.detail2 | string | |
+action_result.data.\*.meta.severity | string | |
+action_result.data.\*.modified_ts | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | `threatstream organization id` |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | |
+action_result.data.\*.source | string | |
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | |
+action_result.data.\*.status | string | |
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | |
+action_result.data.\*.tags.\*.name | string | |
+action_result.data.\*.tags.\*.org_id | string | |
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.source_user | string | |
+action_result.data.\*.tags.\*.source_user_id | string | |
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.threatscore | numeric | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | ip
+action_result.data.\*.update_id | numeric | |
+action_result.data.\*.uuid | string | | 4cf3228b-0de4-45f0-a66d-255b6ff32eaa
+action_result.data.\*.value | string | `ip` |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved information on IP
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'email reputation'
Get information about a given email
@@ -629,72 +631,72 @@ Get information about a given email
Type: **investigate**
Read only: **True**
-If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\. The search\_exact\_value parameter searches for the exact email on ThreatStream server\. If this parameter is kept true, then the extend\_source parameter will be ignored and no extra information will be available\.
+If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter. The search_exact_value parameter searches for the exact email on ThreatStream server. If this parameter is kept true, then the extend_source parameter will be ignored and no extra information will be available.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**email** | required | Email to investigate | string | `email`
**limit** | optional | Total number of observables to return | numeric |
-**extend\_source** | optional | Fetch extra data from Anomali server if available | boolean |
-**search\_exact\_value** | optional | Search for the exact email | boolean |
+**extend_source** | optional | Fetch extra data from Anomali server if available | boolean |
+**search_exact_value** | optional | Search for the exact email | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.email | string | `email`
-action\_result\.parameter\.extend\_source | boolean |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.search\_exact\_value | boolean |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.extended\_source | string |
-action\_result\.data\.\*\.external\_references\.remote\_api | boolean |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `email`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.email | string | `email` | test.com
+action_result.parameter.extend_source | boolean | | True False
+action_result.parameter.limit | numeric | | 1000
+action_result.parameter.search_exact_value | boolean | | True False
+action_result.data.\*.asn | string | |
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.country | string | |
+action_result.data.\*.created_ts | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | |
+action_result.data.\*.extended_source | string | |
+action_result.data.\*.external_references.remote_api | boolean | | True False
+action_result.data.\*.feed_id | numeric | |
+action_result.data.\*.id | numeric | `threatstream intelligence id` |
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.ip | string | `ip` | test@test.com
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | |
+action_result.data.\*.itype | string | |
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail | string | |
+action_result.data.\*.meta.detail2 | string | |
+action_result.data.\*.meta.severity | string | |
+action_result.data.\*.modified_ts | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | `threatstream organization id` |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | |
+action_result.data.\*.source | string | |
+action_result.data.\*.source_reported_confidence | numeric | |
+action_result.data.\*.status | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | |
+action_result.data.\*.tags.\*.name | string | |
+action_result.data.\*.tags.\*.org_id | string | |
+action_result.data.\*.tags.\*.source_user | string | |
+action_result.data.\*.tags.\*.source_user_id | string | |
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.threatscore | numeric | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | email
+action_result.data.\*.update_id | numeric | |
+action_result.data.\*.uuid | string | | 4cf3228b-0de4-45f0-a66d-255b6ff32eaa
+action_result.data.\*.value | string | `email` |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved information on Email
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'url reputation'
Get information about a URL
@@ -702,78 +704,78 @@ Get information about a URL
Type: **investigate**
Read only: **True**
-If nothing is found, this is because ThreatStream has no information on that URL\. If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\. The search\_exact\_value parameter searches for the exact url on ThreatStream server\. If this parameter is kept true, then the extend\_source parameter will be ignored and no extra information will be available\.
+If nothing is found, this is because ThreatStream has no information on that URL. If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter. The search_exact_value parameter searches for the exact url on ThreatStream server. If this parameter is kept true, then the extend_source parameter will be ignored and no extra information will be available.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**url** | required | URL to investigate | string | `url`
**limit** | optional | Total number of observables to return | numeric |
-**extend\_source** | optional | Fetch extra data from Anomali server if available | boolean |
-**search\_exact\_value** | optional | Search for the exact url | boolean |
+**extend_source** | optional | Fetch extra data from Anomali server if available | boolean |
+**search_exact_value** | optional | Search for the exact url | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.extend\_source | boolean |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.url | string | `url`
-action\_result\.parameter\.search\_exact\_value | boolean |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.extended\_source | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | numeric |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | numeric |
-action\_result\.data\.\*\.longitude | numeric |
-action\_result\.data\.\*\.meta\.detail | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.registrant\_address | string |
-action\_result\.data\.\*\.meta\.registrant\_created | string |
-action\_result\.data\.\*\.meta\.registrant\_email | string |
-action\_result\.data\.\*\.meta\.registrant\_name | string |
-action\_result\.data\.\*\.meta\.registrant\_org | string |
-action\_result\.data\.\*\.meta\.registrant\_phone | string |
-action\_result\.data\.\*\.meta\.registrant\_updated | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `url`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.extend_source | boolean | | True False
+action_result.parameter.limit | numeric | | 1000
+action_result.parameter.url | string | `url` | http://122.122.122.122/
+action_result.parameter.search_exact_value | boolean | | True False
+action_result.data.\*.asn | string | |
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.country | string | |
+action_result.data.\*.created_ts | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | |
+action_result.data.\*.extended_source | string | |
+action_result.data.\*.feed_id | numeric | |
+action_result.data.\*.id | numeric | `threatstream intelligence id` |
+action_result.data.\*.import_session_id | numeric | |
+action_result.data.\*.ip | string | `ip` |
+action_result.data.\*.is_anonymous | boolean | | False
+action_result.data.\*.is_editable | boolean | | False
+action_result.data.\*.is_public | boolean | |
+action_result.data.\*.itype | string | |
+action_result.data.\*.latitude | numeric | |
+action_result.data.\*.longitude | numeric | |
+action_result.data.\*.meta.detail | string | |
+action_result.data.\*.meta.detail2 | string | |
+action_result.data.\*.meta.registrant_address | string | |
+action_result.data.\*.meta.registrant_created | string | |
+action_result.data.\*.meta.registrant_email | string | | test@test.com
+action_result.data.\*.meta.registrant_name | string | | Protection of Private Person
+action_result.data.\*.meta.registrant_org | string | |
+action_result.data.\*.meta.registrant_phone | string | |
+action_result.data.\*.meta.registrant_updated | string | |
+action_result.data.\*.meta.severity | string | |
+action_result.data.\*.modified_ts | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | `threatstream organization id` |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | |
+action_result.data.\*.source | string | |
+action_result.data.\*.source_reported_confidence | numeric | |
+action_result.data.\*.status | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | |
+action_result.data.\*.tags.\*.name | string | |
+action_result.data.\*.tags.\*.org_id | string | |
+action_result.data.\*.tags.\*.source_user | string | |
+action_result.data.\*.tags.\*.source_user_id | string | |
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.threatscore | numeric | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | url
+action_result.data.\*.update_id | numeric | |
+action_result.data.\*.uuid | string | | 4cf3228b-0de4-45f0-a66d-255b6ff32eaa
+action_result.data.\*.value | string | `url` |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved information on URL
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'whois ip'
Execute a whois lookup on the given IP
@@ -781,7 +783,7 @@ Execute a whois lookup on the given IP
Type: **investigate**
Read only: **True**
-ThreatStream returns whois info as a raw string \(present in the raw field\) which the app will then attempt to parse into the output\. Depending on the contents of the raw string, it may not be able to parse all or any of the required fields\.
+ThreatStream returns whois info as a raw string (present in the raw field) which the app will then attempt to parse into the output. Depending on the contents of the raw string, it may not be able to parse all or any of the required fields.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -789,48 +791,103 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**ip** | required | IP | string | `ip` `ipv6`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.ip | string | `ip` `ipv6`
-action\_result\.data\.\*\.addtional\_info | string |
-action\_result\.data\.\*\.addtional\_info\.asn | string |
-action\_result\.data\.\*\.addtional\_info\.asn\_cidr | string |
-action\_result\.data\.\*\.addtional\_info\.asn\_country\_code | string |
-action\_result\.data\.\*\.addtional\_info\.asn\_date | string |
-action\_result\.data\.\*\.addtional\_info\.asn\_description | string |
-action\_result\.data\.\*\.addtional\_info\.asn\_registry | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.address | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.cidr | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.city | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.country | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.created | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.description | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.emails | string | `email`
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.handle | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.name | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.postal\_code | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.range | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.state | string |
-action\_result\.data\.\*\.addtional\_info\.nets\.\*\.updated | string |
-action\_result\.data\.\*\.addtional\_info\.nir | string |
-action\_result\.data\.\*\.addtional\_info\.query | string | `ip`
-action\_result\.data\.\*\.addtional\_info\.raw | string |
-action\_result\.data\.\*\.addtional\_info\.raw\_referral | string |
-action\_result\.data\.\*\.addtional\_info\.referral | string |
-action\_result\.data\.\*\.contacts\.admin\.handle | string |
-action\_result\.data\.\*\.contacts\.billing | string |
-action\_result\.data\.\*\.contacts\.registrant | string |
-action\_result\.data\.\*\.contacts\.registrant\.name | string |
-action\_result\.data\.\*\.contacts\.tech\.handle | string |
-action\_result\.data\.\*\.emails | string | `email`
-action\_result\.data\.\*\.raw | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.updated\_date | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.ip | string | `ip` `ipv6` | 122.122.122.122
+action_result.data.\*.addtional_info | string | |
+action_result.data.\*.addtional_info.asn | string | | 4134
+action_result.data.\*.addtional_info.asn_cidr | string | | 122.122.122.122/13
+action_result.data.\*.addtional_info.asn_country_code | string | | CN
+action_result.data.\*.addtional_info.asn_date | string | | 2009-10-23
+action_result.data.\*.addtional_info.asn_description | string | | National, NL
+action_result.data.\*.addtional_info.asn_registry | string | | apnic
+action_result.data.\*.addtional_info.nets.\*.address | string | | 3 test IP Street Address
+action_result.data.\*.addtional_info.nets.\*.cidr | string | | 122.122.122.122/32
+action_result.data.\*.addtional_info.nets.\*.city | string | |
+action_result.data.\*.addtional_info.nets.\*.country | string | | CN
+action_result.data.\*.addtional_info.nets.\*.created | string | |
+action_result.data.\*.addtional_info.nets.\*.description | string | | WX
+action_result.data.\*.addtional_info.nets.\*.emails | string | `email` | testmalicious@cta.cq.cn
+action_result.data.\*.addtional_info.nets.\*.handle | string | | ZL235-AP
+action_result.data.\*.addtional_info.nets.\*.name | string | | WX
+action_result.data.\*.addtional_info.nets.\*.postal_code | string | |
+action_result.data.\*.addtional_info.nets.\*.range | string | | 122.122.122.122 - 122.122.122.122
+action_result.data.\*.addtional_info.nets.\*.state | string | |
+action_result.data.\*.addtional_info.nets.\*.updated | string | |
+action_result.data.\*.addtional_info.nir | string | |
+action_result.data.\*.addtional_info.query | string | `ip` | 122.122.122.122
+action_result.data.\*.addtional_info.raw | string | |
+action_result.data.\*.addtional_info.raw_referral | string | |
+action_result.data.\*.addtional_info.referral | string | |
+action_result.data.\*.contacts.admin.handle | string | | IM646-AP
+action_result.data.\*.contacts.billing | string | |
+action_result.data.\*.contacts.registrant | string | |
+action_result.data.\*.contacts.registrant.name | string | | IP Manager
+action_result.data.\*.contacts.tech.handle | string | | IM646-AP
+action_result.data.\*.emails | string | `email` | hostmaster@nic.or.kr
+action_result.data.\*.raw | string | | inetnum: 61.32.0.0 - 61.39.255.255
+netname: BORANET
+descr: LG DACOM Corporation
+admin-c: IM646-AP
+tech-c: IM646-AP
+country: KR
+status: ALLOCATED PORTABLE
+mnt-by: MNT-KRNIC-AP
+mnt-irt: IRT-KRNIC-KR
+last-modified: 2017-02-03T00:55:02Z
+source: APNIC
+irt: IRT-KRNIC-KR
+address: Jeollanam-do Naju-si Jinheung-gil
+e-mail: irt@nic.or.kr
+abuse-mailbox: irt@nic.or.kr
+admin-c: IM574-AP
+tech-c: IM574-AP
+auth: # Filtered
+remarks: irt@nic.or.kr was validated on 2019-10-01
+mnt-by: MNT-KRNIC-AP
+last-modified: 2019-10-01T08:41:39Z
+source: APNIC
+person: IP Manager
+address: Seoul Yongsan-gu Hangang-daero 32
+country: KR
+phone: +82-2-10-1
+e-mail: ipadm@lguplus.co.kr
+nic-hdl: IM646-AP
+mnt-by: MNT-KRNIC-AP
+last-modified: 2017-08-07T01:06:21Z
+source: APNIC
+inetnum: 61.32.0.0 - 61.39.255.255
+netname: BORANET-KR
+descr: LG DACOM Corporation
+country: KR
+admin-c: IA5-KR
+tech-c: IA5-KR
+status: ALLOCATED PORTABLE
+mnt-by: MNT-KRNIC-AP
+mnt-irt: IRT-KRNIC-KR
+remarks: This information has been partially mirrored by APNIC from
+remarks: KRNIC. To obtain more specific information, please use the
+remarks: KRNIC whois server at whois.test.or.kr.
+changed: hostmaster@nic.or.kr
+source: KRNIC
+person: IP Manager
+address: Seoul Yongsan-gu Hangang-daero 32
+address: LG UPLUS
+country: KR
+phone: +82-2-10-1
+e-mail: ipadm@lguplus.co.kr
+nic-hdl: IA5-KR
+mnt-by: MNT-KRNIC-AP
+changed: hostmaster@nic.or.kr
+source: KRNIC
+
+action_result.data.\*.status | string | | Allocated Portable
+action_result.data.\*.updated_date | string | | 2017-08-07T01:06:21
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved whois info Successfully retrieved whois info. Unable to fetch additional info for the given IP. ERROR: HTTP lookup failed for http://whois.test.or.kr/eng/whois.jsc.
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'whois domain'
Execute a whois lookup on the given domain
@@ -838,7 +895,7 @@ Execute a whois lookup on the given domain
Type: **investigate**
Read only: **True**
-ThreatStream returns whois info as a raw string \(present in the raw field\) which the app will then attempt to parse into the output\. Depending on the contents of the raw string, it may not be able to parse all or any of the required fields\.
+ThreatStream returns whois info as a raw string (present in the raw field) which the app will then attempt to parse into the output. Depending on the contents of the raw string, it may not be able to parse all or any of the required fields.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -846,64 +903,196 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**domain** | required | Domain | string | `domain` `url`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.domain | string | `domain` `url`
-action\_result\.data\.\*\.contacts\.admin | string |
-action\_result\.data\.\*\.contacts\.admin\.city | string |
-action\_result\.data\.\*\.contacts\.admin\.country | string |
-action\_result\.data\.\*\.contacts\.admin\.email | string | `email`
-action\_result\.data\.\*\.contacts\.admin\.fax | string |
-action\_result\.data\.\*\.contacts\.admin\.fax\_ext | string |
-action\_result\.data\.\*\.contacts\.admin\.handle | string |
-action\_result\.data\.\*\.contacts\.admin\.name | string |
-action\_result\.data\.\*\.contacts\.admin\.organization | string |
-action\_result\.data\.\*\.contacts\.admin\.phone | string |
-action\_result\.data\.\*\.contacts\.admin\.postalcode | string |
-action\_result\.data\.\*\.contacts\.admin\.state | string |
-action\_result\.data\.\*\.contacts\.admin\.street | string |
-action\_result\.data\.\*\.contacts\.billing | string |
-action\_result\.data\.\*\.contacts\.registrant | string |
-action\_result\.data\.\*\.contacts\.registrant\.city | string |
-action\_result\.data\.\*\.contacts\.registrant\.country | string |
-action\_result\.data\.\*\.contacts\.registrant\.email | string | `email`
-action\_result\.data\.\*\.contacts\.registrant\.fax | string |
-action\_result\.data\.\*\.contacts\.registrant\.fax\_ext | string |
-action\_result\.data\.\*\.contacts\.registrant\.handle | string |
-action\_result\.data\.\*\.contacts\.registrant\.name | string |
-action\_result\.data\.\*\.contacts\.registrant\.organization | string |
-action\_result\.data\.\*\.contacts\.registrant\.phone | string |
-action\_result\.data\.\*\.contacts\.registrant\.postalcode | string |
-action\_result\.data\.\*\.contacts\.registrant\.state | string |
-action\_result\.data\.\*\.contacts\.registrant\.street | string |
-action\_result\.data\.\*\.contacts\.tech | string |
-action\_result\.data\.\*\.contacts\.tech\.city | string |
-action\_result\.data\.\*\.contacts\.tech\.country | string |
-action\_result\.data\.\*\.contacts\.tech\.email | string | `email`
-action\_result\.data\.\*\.contacts\.tech\.fax | string |
-action\_result\.data\.\*\.contacts\.tech\.fax\_ext | string |
-action\_result\.data\.\*\.contacts\.tech\.handle | string |
-action\_result\.data\.\*\.contacts\.tech\.name | string |
-action\_result\.data\.\*\.contacts\.tech\.organization | string |
-action\_result\.data\.\*\.contacts\.tech\.phone | string |
-action\_result\.data\.\*\.contacts\.tech\.postalcode | string |
-action\_result\.data\.\*\.contacts\.tech\.state | string |
-action\_result\.data\.\*\.contacts\.tech\.street | string |
-action\_result\.data\.\*\.creation\_date | string |
-action\_result\.data\.\*\.emails | string | `email`
-action\_result\.data\.\*\.expiration\_date | string |
-action\_result\.data\.\*\.id | string |
-action\_result\.data\.\*\.nameservers | string |
-action\_result\.data\.\*\.raw | string |
-action\_result\.data\.\*\.registrar | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.updated\_date | string |
-action\_result\.data\.\*\.whois\_server | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.domain | string | `domain` `url` | malware3.obfuscated.network test.com
+action_result.data.\*.contacts.admin | string | |
+action_result.data.\*.contacts.admin.city | string | | Redacted For Privacy
+action_result.data.\*.contacts.admin.country | string | | Redacted For Privacy
+action_result.data.\*.contacts.admin.email | string | `email` | please query the rdds service of the registrar of record identified in this output for information on how to contact the registrant, admin, or tech contact of the queried domain name.
+action_result.data.\*.contacts.admin.fax | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.admin.fax_ext | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.admin.handle | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.admin.name | string | | Redacted For Privacy
+action_result.data.\*.contacts.admin.organization | string | | Redacted For Privacy
+action_result.data.\*.contacts.admin.phone | string | | REDACTED FOR PRIVACY ext. REDACTED FOR PRIVACY
+action_result.data.\*.contacts.admin.postalcode | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.admin.state | string | | Redacted For Privacy
+action_result.data.\*.contacts.admin.street | string | | Redacted For Privacy
+action_result.data.\*.contacts.billing | string | |
+action_result.data.\*.contacts.registrant | string | |
+action_result.data.\*.contacts.registrant.city | string | | Redacted For Privacy
+action_result.data.\*.contacts.registrant.country | string | | United States
+action_result.data.\*.contacts.registrant.email | string | `email` | please query the rdds service of the registrar of record identified in this output for information on how to contact the registrant, admin, or tech contact of the queried domain name.
+action_result.data.\*.contacts.registrant.fax | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.registrant.fax_ext | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.registrant.handle | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.registrant.name | string | | Redacted For Privacy
+action_result.data.\*.contacts.registrant.organization | string | | Domains By Proxy, LLC
+action_result.data.\*.contacts.registrant.phone | string | | REDACTED FOR PRIVACY ext. REDACTED FOR PRIVACY
+action_result.data.\*.contacts.registrant.postalcode | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.registrant.state | string | | Arizona
+action_result.data.\*.contacts.registrant.street | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech | string | |
+action_result.data.\*.contacts.tech.city | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech.country | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech.email | string | `email` | please query the rdds service of the registrar of record identified in this output for information on how to contact the registrant, admin, or tech contact of the queried domain name.
+action_result.data.\*.contacts.tech.fax | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.tech.fax_ext | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.tech.handle | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.tech.name | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech.organization | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech.phone | string | | REDACTED FOR PRIVACY ext. REDACTED FOR PRIVACY
+action_result.data.\*.contacts.tech.postalcode | string | | REDACTED FOR PRIVACY
+action_result.data.\*.contacts.tech.state | string | | Redacted For Privacy
+action_result.data.\*.contacts.tech.street | string | | Redacted For Privacy
+action_result.data.\*.creation_date | string | | 2017-04-08T04:08:19 1997-09-15T00:00:00
+action_result.data.\*.emails | string | `email` | abuse@test.com whoisrequest@test.com
+action_result.data.\*.expiration_date | string | | 2023-04-08T04:08:19 2028-09-13T00:00:00
+action_result.data.\*.id | string | | 65e105d7aa3a44bfb2c5cab6e6e9e4a4-DONUTS 2138514_DOMAIN_COM-VRSN
+action_result.data.\*.nameservers | string | | ns-cloud-c4.test.com ns4.test.com
+action_result.data.\*.raw | string | | Domain Name: obfuscated.network
+Registry Domain ID: 65e105d7aa3a44bfb2c5cab6e6e9e4a4-DONUTS
+Registrar WHOIS Server: whois.godaddy.com/
+Registrar URL: http://www.godaddy.com/domains/search.aspx?ci=8990
+Updated Date: 2019-09-23T23:57:27Z
+Creation Date: 2017-04-08T04:08:19Z
+Registry Expiry Date: 2023-04-08T04:08:19Z
+Registrar: GoDaddy.com, LLC
+Registrar IANA ID: 146
+Registrar Abuse Contact Email: abuse@godaddy.com
+Registrar Abuse Contact Phone: +1.4806242505
+Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
+Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
+Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
+Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
+Registry Registrant ID: REDACTED FOR PRIVACY
+Registrant Name: REDACTED FOR PRIVACY
+Registrant Organization: Domains By Proxy, LLC
+Registrant Street: REDACTED FOR PRIVACY
+Registrant City: REDACTED FOR PRIVACY
+Registrant State/Province: Arizona
+Registrant Postal Code: REDACTED FOR PRIVACY
+Registrant Country: US
+Registrant Phone: REDACTED FOR PRIVACY
+Registrant Phone Ext: REDACTED FOR PRIVACY
+Registrant Fax: REDACTED FOR PRIVACY
+Registrant Fax Ext: REDACTED FOR PRIVACY
+Registrant Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
+Registry Admin ID: REDACTED FOR PRIVACY
+Admin Name: REDACTED FOR PRIVACY
+Admin Organization: REDACTED FOR PRIVACY
+Admin Street: REDACTED FOR PRIVACY
+Admin City: REDACTED FOR PRIVACY
+Admin State/Province: REDACTED FOR PRIVACY
+Admin Postal Code: REDACTED FOR PRIVACY
+Admin Country: REDACTED FOR PRIVACY
+Admin Phone: REDACTED FOR PRIVACY
+Admin Phone Ext: REDACTED FOR PRIVACY
+Admin Fax: REDACTED FOR PRIVACY
+Admin Fax Ext: REDACTED FOR PRIVACY
+Admin Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
+Registry Tech ID: REDACTED FOR PRIVACY
+Tech Name: REDACTED FOR PRIVACY
+Tech Organization: REDACTED FOR PRIVACY
+Tech Street: REDACTED FOR PRIVACY
+Tech City: REDACTED FOR PRIVACY
+Tech State/Province: REDACTED FOR PRIVACY
+Tech Postal Code: REDACTED FOR PRIVACY
+Tech Country: REDACTED FOR PRIVACY
+Tech Phone: REDACTED FOR PRIVACY
+Tech Phone Ext: REDACTED FOR PRIVACY
+Tech Fax: REDACTED FOR PRIVACY
+Tech Fax Ext: REDACTED FOR PRIVACY
+Tech Email: Please query the RDDS service of the Registrar of Record identified in this output for information on how to contact the Registrant, Admin, or Tech contact of the queried domain name.
+Name Server: ns-cloud-c1.googledomains.com
+Name Server: ns-cloud-c2.googledomains.com
+Name Server: ns-cloud-c3.googledomains.com
+Name Server: ns-cloud-c4.googledomains.com
+DNSSEC: signedDelegation
+URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
+>>> Last update of WHOIS database: 2020-01-12T06:25:08Z <<<
+For more information on Whois status codes, please visit https://icann.org/epp
+Terms of Use: Donuts Inc. provides this Whois service for information purposes, and to assist persons in obtaining information about or related to a domain name registration record. Donuts does not guarantee its accuracy. Users accessing the Donuts Whois service agree to use the data only for lawful purposes, and under no circumstances may this data be used to: a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the registrar’s own existing customers and b) enable high volume, automated, electronic processes that send queries or data to the systems of Donuts or any ICANN-accredited registrar, except as reasonably necessary to register domain names or modify existing registrations. When using the Donuts Whois service, please consider the following: The Whois service is not a replacement for standard EPP commands to the SRS service. Whois is not considered authoritative for registered domain objects. The Whois service may be scheduled for downtime during production or OT&E maintenance periods. Queries to the Whois services are throttled. If too many queries are received from a single IP address within a specified time, the service will begin to reject further queries for a period of time to prevent disruption of Whois service access. Abuse of the Whois system through data mining is mitigated by detecting and limiting bulk query access from single sources. Where applicable, the presence of a [Non-Public Data] tag indicates that such data is not made publicly available due to applicable data privacy laws or requirements. Should you wish to contact the registrant, please refer to the Whois records available through the registrar URL listed above. Access to non-public data may be provided, upon request, where it can be reasonably confirmed that the requester holds a specific legitimate interest and a proper legal basis for accessing the withheld data. Access to this data can be requested by submitting a request via the form found at https://donuts.domains/about/policies/whois-layered-access/ Donuts Inc. reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy. Domain Name: google.com
+Registry Domain ID: 2138514_DOMAIN_COM-VRSN
+Registrar WHOIS Server: whois.markmonitor.com
+Registrar URL: http://www.markmonitor.com
+Updated Date: 2019-09-09T08:39:04-0700
+Creation Date: 1997-09-15T00:00:00-0700
+Registrar Registration Expiration Date: 2028-09-13T00:00:00-0700
+Registrar: MarkMonitor, Inc.
+Registrar IANA ID: 292
+Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
+Registrar Abuse Contact Phone: +1.2083895770
+Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
+Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
+Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
+Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
+Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
+Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
+Registrant Organization: Google LLC
+Registrant State/Province: CA
+Registrant Country: US
+Admin Organization: Google LLC
+Admin State/Province: CA
+Admin Country: US
+Tech Organization: Google LLC
+Tech State/Province: CA
+Tech Country: US
+Name Server: ns3.google.com
+Name Server: ns2.google.com
+Name Server: ns1.google.com
+Name Server: ns4.google.com
+DNSSEC: unsigned
+URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
+>>> Last update of WHOIS database: 2020-01-11T17:54:34-0800 <<<
+For more information on WHOIS status codes, please visit:
+ https://www.icann.org/resources/pages/epp-status-codes
+If you wish to contact this domain’s Registrant, Administrative, or Technical
+contact, and such email address is not visible above, you may do so via our web
+form, pursuant to ICANN’s Temporary Specification. To verify that you are not a
+robot, please enter your email address to receive a link to a page that
+facilitates email communication with the relevant contact(s).
+Web-based WHOIS:
+ https://domains.markmonitor.com/whois
+If you have a legitimate interest in viewing the non-public WHOIS details, send
+your request and the reasons for your request to whoisrequest@markmonitor.com
+and specify the domain name in the subject line. We will review that request and
+may ask for supporting documentation and explanation.
+The data in MarkMonitor’s WHOIS database is provided for information purposes,
+and to assist persons in obtaining information about or related to a domain
+name’s registration record. While MarkMonitor believes the data to be accurate,
+the data is provided "as is" with no guarantee or warranties regarding its
+accuracy.
+By submitting a WHOIS query, you agree that you will use this data only for
+lawful purposes and that, under no circumstances will you use this data to:
+ (1) allow, enable, or otherwise support the transmission by email, telephone,
+or facsimile of mass, unsolicited, commercial advertising, or spam; or
+ (2) enable high volume, automated, or electronic processes that send queries,
+data, or email to MarkMonitor (or its systems) or the domain name contacts (or
+its systems).
+MarkMonitor.com reserves the right to modify these terms at any time.
+By submitting this query, you agree to abide by this policy.
+MarkMonitor is the Global Leader in Online Brand Protection.
+MarkMonitor Domain Management(TM)
+MarkMonitor Brand Protection(TM)
+MarkMonitor AntiCounterfeiting(TM)
+MarkMonitor AntiPiracy(TM)
+MarkMonitor AntiFraud(TM)
+Professional and Managed Services
+Visit MarkMonitor at https://www.markmonitor.com
+Contact us at +1.8007459229
+In Europe, at +44.02032062220
+--
+action_result.data.\*.registrar | string | | test.com, LLC test, Inc.
+action_result.data.\*.status | string | | clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
+action_result.data.\*.updated_date | string | | 2019-09-23T23:57:27 2019-09-09T08:39:04
+action_result.data.\*.whois_server | string | | whois.test.com/ whois.test.com
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved whois info
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get observable'
Get observable present in ThreatStream by ID number
@@ -914,65 +1103,65 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**intelligence\_id** | required | ID number of intelligence to return | string | `threatstream intelligence id`
+**intelligence_id** | required | ID number of intelligence to return | string | `threatstream intelligence id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.intelligence\_id | string | `threatstream intelligence id`
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string | `email`
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string | `email`
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `email`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.intelligence_id | string | `threatstream intelligence id` | 171143571
+action_result.data.\*.asn | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.confidence | numeric | | 50
+action_result.data.\*.country | string | |
+action_result.data.\*.created_by | string | `email` | test@test.com
+action_result.data.\*.created_ts | string | | 2019-12-12T09:07:42.124Z
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | | 2020-03-11T09:04:49.324Z
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream intelligence id` | 171143571
+action_result.data.\*.import_session_id | string | | 235
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | |
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.itype | string | | mal_email
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail2 | string | | imported by user 136
+action_result.data.\*.meta.severity | string | | low
+action_result.data.\*.modified_ts | string | | 2019-12-12T09:08:15.714Z
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.rdns | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v2/intelligence/171143571/?remote_api=true
+action_result.data.\*.retina_confidence | numeric | | -1
+action_result.data.\*.source | string | `email` | test@test.com
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | | 50
+action_result.data.\*.status | string | | active
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | | cg0
+action_result.data.\*.tags.\*.name | string | | test_name
+action_result.data.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | | malware
+action_result.data.\*.threatscore | numeric | | 10
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | email
+action_result.data.\*.update_id | numeric | | 343406992
+action_result.data.\*.uuid | string | | 4a035a95-6a80-4eaf-be5e-c2bfc4bdf570
+action_result.data.\*.value | string | `email` | test@test00.com
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list observables'
List observables present in ThreatStream
@@ -980,7 +1169,7 @@ List observables present in ThreatStream
Type: **investigate**
Read only: **True**
-- The observables will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The observables will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -988,74 +1177,74 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**limit** | optional | Total number of observables to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.registrant\_address | string |
-action\_result\.data\.\*\.meta\.registrant\_created | string |
-action\_result\.data\.\*\.meta\.registrant\_email | string |
-action\_result\.data\.\*\.meta\.registrant\_name | string |
-action\_result\.data\.\*\.meta\.registrant\_org | string |
-action\_result\.data\.\*\.meta\.registrant\_phone | string |
-action\_result\.data\.\*\.meta\.registrant\_updated | string |
-action\_result\.data\.\*\.meta\.registrantion\_created | string |
-action\_result\.data\.\*\.meta\.registrantion\_updated | string |
-action\_result\.data\.\*\.meta\.registration\_created | string |
-action\_result\.data\.\*\.meta\.registration\_updated | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string |
-action\_result\.summary\.observables\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 5
+action_result.data.\*.asn | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.confidence | numeric | | 57
+action_result.data.\*.country | string | | DE
+action_result.data.\*.created_by | string | | testuser2@test.testdata.com
+action_result.data.\*.created_ts | string | | 2019-09-06T08:27:20.995Z
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | | 2019-09-07T08:27:17.860Z
+action_result.data.\*.feed_id | numeric | | 122
+action_result.data.\*.id | numeric | `threatstream intelligence id` | 53702579051
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | `ip` | 122.122.122.122
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.itype | string | | tor_ip
+action_result.data.\*.latitude | string | | 49.7739
+action_result.data.\*.longitude | string | | 8.8844
+action_result.data.\*.meta.detail | string | |
+action_result.data.\*.meta.detail2 | string | | imported by user 668
+action_result.data.\*.meta.registrant_address | string | |
+action_result.data.\*.meta.registrant_created | string | |
+action_result.data.\*.meta.registrant_email | string | | test@test00.com
+action_result.data.\*.meta.registrant_name | string | | Protection of Private Person
+action_result.data.\*.meta.registrant_org | string | |
+action_result.data.\*.meta.registrant_phone | string | |
+action_result.data.\*.meta.registrant_updated | string | |
+action_result.data.\*.meta.registrantion_created | string | | 2001-06-28T16:04:59+00:00
+action_result.data.\*.meta.registrantion_updated | string | | 2014-08-13T20:24:31+00:00
+action_result.data.\*.meta.registration_created | string | | 1993-02-09T05:00:00+00:00
+action_result.data.\*.meta.registration_updated | string | | 2019-02-05T15:21:43+00:00
+action_result.data.\*.meta.severity | string | | low
+action_result.data.\*.modified_ts | string | | 2019-09-06T08:27:20.995Z
+action_result.data.\*.org | string | | ENTEGA Medianet GmbH
+action_result.data.\*.owner_organization_id | numeric | | 2
+action_result.data.\*.rdns | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v2/intelligence/53702579051/
+action_result.data.\*.retina_confidence | numeric | | 57
+action_result.data.\*.source | string | | TOR Exit Nodes
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | | 100
+action_result.data.\*.status | string | | active
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | | dgo
+action_result.data.\*.tags.\*.name | string | | Suspicious-Domain-Registration
+action_result.data.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | | tor
+action_result.data.\*.threatscore | numeric | | 15
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | ip
+action_result.data.\*.update_id | numeric | | 4887255342
+action_result.data.\*.uuid | string | | 9f6cb8db-bb18-45e0-b46a-da9b2f783d1c
+action_result.data.\*.value | string | | 122.122.122.122
+action_result.summary.observables_returned | numeric | | 5
+action_result.message | string | | Observables returned: 5
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get vulnerability'
Get vulnerability present in ThreatStream by ID number
@@ -1066,58 +1255,58 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**vulnerability\_id** | required | ID number of vulnerability to return | string | `threatstream vulnerability id`
+**vulnerability_id** | required | ID number of vulnerability to return | string | `threatstream vulnerability id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.vulnerability\_id | string | `threatstream vulnerability id`
-action\_result\.data\.\*\.aliases | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.cvss2\_score | string |
-action\_result\.data\.\*\.cvss3\_score | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | string |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_system | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.update\_id | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.vulnerability_id | string | `threatstream vulnerability id` | 5679
+action_result.data.\*.aliases | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.created_ts | string | | 2019-12-11T07:19:48.120816
+action_result.data.\*.cvss2_score | string | |
+action_result.data.\*.cvss3_score | string | |
+action_result.data.\*.description | string | |
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | string | | 0
+action_result.data.\*.id | numeric | | 5679
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_system | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2019-12-11T07:19:48.129404
+action_result.data.\*.name | string | | test_vulnerabilities_remote
+action_result.data.\*.organization.id | string | | 67
+action_result.data.\*.organization.name | string | | qa.test.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 67
+action_result.data.\*.owner_user.email | string | `email` | test@qa.test.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | new
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/vulnerability/5679/?remote_api=true
+action_result.data.\*.source | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.tlp | string | |
+action_result.data.\*.update_id | string | | 14060
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved vulnerability
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list vulnerabilities'
List vulnerabilities present in ThreatStream
@@ -1125,7 +1314,7 @@ List vulnerabilities present in ThreatStream
Type: **investigate**
Read only: **True**
-- The vulnerabilities will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The vulnerabilities will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -1133,51 +1322,51 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**limit** | optional | Total number of vulnerabilities to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream vulnerability id`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_system | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string | `threatstream organization id`
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.title | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.summary\.vulnerabilities\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 1000
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 146
+action_result.data.\*.circles.\*.name | string | | Anomali Curated OSINT
+action_result.data.\*.circles.\*.remote_api | boolean | | True False
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/146/
+action_result.data.\*.created_ts | string | | 2017-11-16T00:43:49.307763
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream vulnerability id` | 1
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes_private_only
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_system | boolean | | True False
+action_result.data.\*.modified_ts | string | | 2010-12-16T05:00:00
+action_result.data.\*.name | string | | CVE-1999-0001
+action_result.data.\*.organization.id | string | `threatstream organization id` | 2342
+action_result.data.\*.organization.name | string | | test_organization_name.us
+action_result.data.\*.organization.title | string | | analyst
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 2
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.publication_status | string | | published
+action_result.data.\*.published_ts | string | | 1999-12-30T05:00:00
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/vulnerability/1/
+action_result.data.\*.source | string | | mitre
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.tags | string | | NVD-CWE-Other
+action_result.data.\*.tags_v2.\*.id | string | | 2_CWE-20
+action_result.data.\*.tags_v2.\*.name | string | | CWE-20
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.tags_v2.\*.tlp | string | | red
+action_result.data.\*.tlp | string | | white
+action_result.data.\*.update_id | numeric | | 451620
+action_result.data.\*.uuid | string | |
+action_result.summary.vulnerabilities_returned | numeric | | 1000
+action_result.message | string | | Vulnerabilities returned: 1000
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list incidents'
List incidents present in ThreatStream
@@ -1185,68 +1374,68 @@ List incidents present in ThreatStream
Type: **investigate**
Read only: **True**
-- The incidents will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The incidents will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**intel\_value** | optional | Intelligence value to filter incidents \(ie\. google\.com\) | string |
+**intel_value** | optional | Intelligence value to filter incidents (ie. google.com) | string |
**limit** | optional | Total number of incidents to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.intel\_value | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent\.id | string |
-action\_result\.data\.\*\.parent\.name | string |
-action\_result\.data\.\*\.parent\.recource\_uri | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.incidents\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.intel_value | string | | test@test.com
+action_result.parameter.limit | numeric | | 10
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 145
+action_result.data.\*.circles.\*.name | string | | Anomali Labs Premium
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/test/145/
+action_result.data.\*.created_ts | string | | 2015-08-11T19:39:13.604417
+action_result.data.\*.end_date | string | | 2011-04-08T04:00:00
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream incident id` | 1
+action_result.data.\*.is_anonymous | boolean | | False True
+action_result.data.\*.is_cloneable | string | | yes_private_only
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.modified_ts | string | | 2015-09-25T16:51:45.730982
+action_result.data.\*.name | string | | Test Incident Name
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 1223
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.parent.id | string | | 5794
+action_result.data.\*.parent.name | string | | MySpace Credential Leak (2016)
+action_result.data.\*.parent.recource_uri | string | | /api/v1/incident/5794/
+action_result.data.\*.publication_status | string | | published
+action_result.data.\*.published_ts | string | | 2015-09-25T16:51:45.730982
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/incident/1/
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 1
+action_result.data.\*.start_date | string | | 2015-08-11T19:18:53.160000
+action_result.data.\*.status | string | |
+action_result.data.\*.status.display_name | string | | New
+action_result.data.\*.status.id | numeric | | 1
+action_result.data.\*.status.resource_uri | string | | /api/v1/incidentstatustype/1/
+action_result.data.\*.tags | string | | Breach
+action_result.data.\*.tags_v2.\*.id | string | | 1223_Axiom
+action_result.data.\*.tags_v2.\*.name | string | | Axiom
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.tlp | string | | white
+action_result.data.\*.uuid | string | | f47b82f2-3607-42bc-9ed1-5c86e15e952b
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.incidents_returned | numeric | | 142
+action_result.message | string | | Incidents returned: 142
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete incident'
Delete incident in ThreatStream by ID number
@@ -1257,18 +1446,18 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**incident\_id** | required | ID number of incident to delete | string | `threatstream incident id`
+**incident_id** | required | ID number of incident to delete | string | `threatstream incident id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.incident\_id | string | `threatstream incident id`
-action\_result\.data | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.incident_id | string | `threatstream incident id` | 15518
+action_result.data | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted incident
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get incident'
Get incident in ThreatStream by ID number
@@ -1279,127 +1468,127 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**incident\_id** | required | ID number of incident to return | string | `threatstream incident id`
+**incident_id** | required | ID number of incident to return | string | `threatstream incident id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.incident\_id | string | `threatstream incident id`
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.asn | string |
-action\_result\.data\.\*\.intelligence\.\*\.association\_info\.\*\.comment | string |
-action\_result\.data\.\*\.intelligence\.\*\.association\_info\.\*\.created | string |
-action\_result\.data\.\*\.intelligence\.\*\.association\_info\.\*\.from\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.association\_info\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.country | string |
-action\_result\.data\.\*\.intelligence\.\*\.created\_by | string | `email`
-action\_result\.data\.\*\.intelligence\.\*\.created\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.description | string |
-action\_result\.data\.\*\.intelligence\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.id | string | `threatstream intelligence id`
-action\_result\.data\.\*\.intelligence\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.import\_source | string |
-action\_result\.data\.\*\.intelligence\.\*\.ip | string |
-action\_result\.data\.\*\.intelligence\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.itype | string |
-action\_result\.data\.\*\.intelligence\.\*\.latitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.longitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registrant\_address | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registrant\_email | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registrant\_name | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registrant\_phone | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registration\_created | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.registration\_updated | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.intelligence\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.org | string |
-action\_result\.data\.\*\.intelligence\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.rdns | string |
-action\_result\.data\.\*\.intelligence\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.intelligence\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.source | string | `email`
-action\_result\.data\.\*\.intelligence\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.status | string |
-action\_result\.data\.\*\.intelligence\.\*\.subtype | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.category | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.tagger | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.threat\_type | string |
-action\_result\.data\.\*\.intelligence\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.intelligence\.\*\.type | string |
-action\_result\.data\.\*\.intelligence\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.uuid | string |
-action\_result\.data\.\*\.intelligence\.\*\.value | string | `email`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.status\_desc | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.incident_id | string | `threatstream incident id` | 1000000003
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.created_ts | string | | 2019-12-11T07:12:16.022460
+action_result.data.\*.description | string | |
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.end_date | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | | 1000000003
+action_result.data.\*.intelligence.\*.asn | string | |
+action_result.data.\*.intelligence.\*.association_info.\*.comment | string | |
+action_result.data.\*.intelligence.\*.association_info.\*.created | string | | 2021-05-27T12:26:00.546115
+action_result.data.\*.intelligence.\*.association_info.\*.from_id | string | | 173098
+action_result.data.\*.intelligence.\*.association_info.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.intelligence.\*.confidence | numeric | | 50
+action_result.data.\*.intelligence.\*.country | string | |
+action_result.data.\*.intelligence.\*.created_by | string | `email` | qa+test@test00.com
+action_result.data.\*.intelligence.\*.created_ts | string | | 2019-12-12T09:05:12.270082
+action_result.data.\*.intelligence.\*.description | string | |
+action_result.data.\*.intelligence.\*.expiration_ts | string | | 2020-03-11T09:04:49.324000
+action_result.data.\*.intelligence.\*.feed_id | numeric | | 0
+action_result.data.\*.intelligence.\*.id | string | `threatstream intelligence id` | 1000000009
+action_result.data.\*.intelligence.\*.import_session_id | string | | 1000000005
+action_result.data.\*.intelligence.\*.import_source | string | |
+action_result.data.\*.intelligence.\*.ip | string | |
+action_result.data.\*.intelligence.\*.is_anonymous | boolean | | True False
+action_result.data.\*.intelligence.\*.is_editable | boolean | | True False
+action_result.data.\*.intelligence.\*.is_public | boolean | | True False
+action_result.data.\*.intelligence.\*.itype | string | | mal_email
+action_result.data.\*.intelligence.\*.latitude | string | |
+action_result.data.\*.intelligence.\*.longitude | string | |
+action_result.data.\*.intelligence.\*.meta.detail2 | string | | imported by user 136
+action_result.data.\*.intelligence.\*.meta.registrant_address | string | | calavi, Calavi, BENIN, 229
+action_result.data.\*.intelligence.\*.meta.registrant_email | string | | test@outlook.com
+action_result.data.\*.intelligence.\*.meta.registrant_name | string | | test registrant
+action_result.data.\*.intelligence.\*.meta.registrant_phone | string | | 22966300066
+action_result.data.\*.intelligence.\*.meta.registration_created | string | | 2017-05-31T12:18:59+00:00
+action_result.data.\*.intelligence.\*.meta.registration_updated | string | | 2017-06-26T12:58:10+00:00
+action_result.data.\*.intelligence.\*.meta.severity | string | | low
+action_result.data.\*.intelligence.\*.modified_ts | string | | 2019-12-12T09:05:42.169722
+action_result.data.\*.intelligence.\*.org | string | |
+action_result.data.\*.intelligence.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.intelligence.\*.rdns | string | |
+action_result.data.\*.intelligence.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.resource_uri | string | |
+action_result.data.\*.intelligence.\*.retina_confidence | numeric | | -1
+action_result.data.\*.intelligence.\*.source | string | `email` | qa+test@test00.com
+action_result.data.\*.intelligence.\*.source_reported_confidence | numeric | | 50
+action_result.data.\*.intelligence.\*.status | string | | active
+action_result.data.\*.intelligence.\*.subtype | string | |
+action_result.data.\*.intelligence.\*.tags | string | |
+action_result.data.\*.intelligence.\*.tags.\*.category | string | | user
+action_result.data.\*.intelligence.\*.tags.\*.id | numeric | | 123
+action_result.data.\*.intelligence.\*.tags.\*.name | string | | test_hybrid
+action_result.data.\*.intelligence.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.intelligence.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.tags.\*.source_user | string | |
+action_result.data.\*.intelligence.\*.tags.\*.source_user_id | string | | 1234
+action_result.data.\*.intelligence.\*.tags.\*.tagger | string | | user
+action_result.data.\*.intelligence.\*.tags.\*.tlp | string | | white
+action_result.data.\*.intelligence.\*.threat_type | string | | malware
+action_result.data.\*.intelligence.\*.threatscore | numeric | | 10
+action_result.data.\*.intelligence.\*.tlp | string | | amber
+action_result.data.\*.intelligence.\*.trusted_circle_ids | string | |
+action_result.data.\*.intelligence.\*.type | string | | email
+action_result.data.\*.intelligence.\*.update_id | numeric | | 100010
+action_result.data.\*.intelligence.\*.uuid | string | | a5f417fb-0c7e-4eb7-b590-bca1af0c3dfb
+action_result.data.\*.intelligence.\*.value | string | `email` | test@tes123.com
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2019-12-12T13:21:42.080982
+action_result.data.\*.name | string | | test_local_incident
+action_result.data.\*.organization.id | string | | 67
+action_result.data.\*.organization.name | string | | qa.test.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 67
+action_result.data.\*.owner_user.email | string | `email` | qa+test@qa.test.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | new
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/incident/1000000003/
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | |
+action_result.data.\*.status.display_name | string | | New
+action_result.data.\*.status.id | numeric | | 1
+action_result.data.\*.status.resource_uri | string | | /api/v1/incidentstatustype/1/
+action_result.data.\*.status_desc | string | |
+action_result.data.\*.tags_v2.\*.id | string | | 15e
+action_result.data.\*.tags_v2.\*.name | string | | test_name
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.uuid | string | | 28a86936-dfa8-44aa-9305-b3a5b9dbfbed
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved incident
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create incident'
Create an incident in ThreatStream
@@ -1410,75 +1599,75 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the incident \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the incident \- Note that this appends | string | `threatstream intelligence id`
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the incident - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the incident - Note that this appends | string | `threatstream intelligence id`
**name** | required | Name to give the incident | string |
**fields** | optional | JSON formatted string of fields to include with the incident | string |
-**is\_public** | optional | Classification designation | boolean |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
+**is_public** | optional | Classification designation | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.is\_public | boolean |
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.fjregnvjnj | string |
-action\_result\.data\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.invalid field | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string | `threatstream organization id`
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.status\_desc | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` | 171831109
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.fields | string | | {"status": 2}
+action_result.parameter.is_public | boolean | | True False
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` | 1000000003,1000000004
+action_result.parameter.name | string | | new_threatstream_2
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.created_ts | string | | 2019-12-15T06:39:20.395924
+action_result.data.\*.description | string | |
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.end_date | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.fjregnvjnj | string | | frfer
+action_result.data.\*.id | numeric | `threatstream incident id` | 1000000008
+action_result.data.\*.intelligence.\*.id | numeric | | 1000000003
+action_result.data.\*.invalid field | string | | failed
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2019-12-15T06:39:20.407307
+action_result.data.\*.name | string | | new_threatstream_2
+action_result.data.\*.organization.id | string | `threatstream organization id` | 67
+action_result.data.\*.organization.name | string | | qa.test.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 67
+action_result.data.\*.owner_user.email | string | `email` | qa+test@qa.test.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | new
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/incident/1000000008/
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | |
+action_result.data.\*.status.display_name | string | | New
+action_result.data.\*.status.id | numeric | | 1
+action_result.data.\*.status.resource_uri | string | | /api/v1/incidentstatustype/1/
+action_result.data.\*.status_desc | string | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.uuid | string | | 68ed8fc0-8f3b-4a86-bc52-724a0057d43b
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully created incident
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update incident'
Update an incident in ThreatStream by ID number
@@ -1489,69 +1678,69 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the incident \- Note that this appends | string |
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the incident \- Note that this appends | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the incident - Note that this appends | string |
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the incident - Note that this appends | string |
**fields** | optional | JSON formatted string of fields to update on the incident | string |
-**incident\_id** | required | ID number of incident to update | string | `threatstream incident id`
+**incident_id** | required | ID number of incident to update | string | `threatstream incident id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.cloud\_intelligence | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.incident\_id | string | `threatstream incident id`
-action\_result\.parameter\.local\_intelligence | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.invalid field | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string | `threatstream organization id`
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric | `threatstream organization id`
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.status\_desc | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.cloud_intelligence | string | | 171831109
+action_result.parameter.fields | string | | {"status": 2}
+action_result.parameter.incident_id | string | `threatstream incident id` | 1000000008
+action_result.parameter.local_intelligence | string | | 1000000002
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.created_ts | string | | 2019-12-15T06:39:20.395924
+action_result.data.\*.description | string | |
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.end_date | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream incident id` | 1000000008
+action_result.data.\*.intelligence.\*.id | numeric | `threatstream incident id` | 1000000002
+action_result.data.\*.invalid field | string | | failed
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2019-12-15T09:23:18.988408
+action_result.data.\*.name | string | | new_threatstream_2
+action_result.data.\*.organization.id | string | `threatstream organization id` | 67
+action_result.data.\*.organization.name | string | | qa.test.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.organization_id | numeric | `threatstream organization id` | 67
+action_result.data.\*.owner_user.email | string | `email` | qa+test@qa.test.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | new
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/incident/1000000008/
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | |
+action_result.data.\*.status.display_name | string | | Open
+action_result.data.\*.status.id | numeric | | 2
+action_result.data.\*.status.resource_uri | string | | /api/v1/incidentstatustype/2/
+action_result.data.\*.status_desc | string | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.uuid | string | | 28a86936-dfa8-44aa-9305-b3a5b9dbfbed
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully updated incident
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import domain observable'
Import domain observable into ThreatStream
@@ -1559,43 +1748,43 @@ Import domain observable into ThreatStream
Type: **generic**
Read only: **False**
-- For importing domain observables without approval, the user must provide indicator type in the field parameter \(e\.g \- "mal\_domain"\) whereas, for importing observables with approval, the user must provide threat type in the field parameter \(e\.g \- "malware"\)\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
+- For importing domain observables without approval, the user must provide indicator type in the field parameter (e.g - "mal_domain") whereas, for importing observables with approval, the user must provide threat type in the field parameter (e.g - "malware").
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**domain** | required | Value of domain | string | `domain`
-**indicator\_type** | required | Type of observable to import | string |
-**source** | optional | Source of observable to import \(It will only be reflected on UI when observable is imported without approval\) | string |
+**indicator_type** | required | Type of observable to import | string |
+**source** | optional | Source of observable to import (It will only be reflected on UI when observable is imported without approval) | string |
**classification** | optional | Designate classification for observable | string |
**severity** | optional | Severity of the observable | string |
-**tags** | optional | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
-**allow\_unresolved** | optional | Unresolved domains will be imported if set to true | boolean |
+**tags** | optional | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
+**allow_unresolved** | optional | Unresolved domains will be imported if set to true | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.allow\_unresolved | boolean |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.domain | string | `domain`
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.job\_id | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.allow_unresolved | boolean | | True False
+action_result.parameter.classification | string | | public
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.domain | string | `domain` | test.com
+action_result.parameter.indicator_type | string | | mal_domain malware
+action_result.parameter.severity | string | | medium
+action_result.parameter.source | string | | testsource
+action_result.parameter.tags | string | `threatstream tags` | test_domain_tag
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.data.\*.import_session_id | string | | 3369
+action_result.data.\*.job_id | string | | a75b7e4a-fc77-4d76-ad1f-4de03bbc7fa2
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.success | boolean | | True False
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import url observable'
Import URL observable into ThreatStream
@@ -1603,39 +1792,39 @@ Import URL observable into ThreatStream
Type: **generic**
Read only: **False**
-- For importing URL observables without approval, the user must provide indicator type in the indicator\_type parameter \(e\.g \- "phish\_url"\) whereas, for importing observables with approval, the user must provide threat type in the indicator\_type parameter \(e\.g \- "phish"\)\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
+- For importing URL observables without approval, the user must provide indicator type in the indicator_type parameter (e.g - "phish_url") whereas, for importing observables with approval, the user must provide threat type in the indicator_type parameter (e.g - "phish").
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**url** | required | Value of URL | string | `url`
-**indicator\_type** | required | Type of observable to import | string |
-**source** | optional | Source of observable to import \(It will only be reflected on UI when observable is imported without approval\) | string |
+**indicator_type** | required | Type of observable to import | string |
+**source** | optional | Source of observable to import (It will only be reflected on UI when observable is imported without approval) | string |
**classification** | optional | Designate classification for observable | string |
**severity** | optional | Severity of the observable | string |
-**tags** | optional | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
-**allow\_unresolved** | optional | Unresolved urls will be imported if set to true | boolean |
+**tags** | optional | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
+**allow_unresolved** | optional | Unresolved urls will be imported if set to true | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.allow\_unresolved | boolean |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.url | string | `url`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.allow_unresolved | boolean | | True False
+action_result.parameter.classification | string | | public
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.indicator_type | string | | phish_url phish
+action_result.parameter.severity | string | | medium
+action_result.parameter.source | string | | testsource
+action_result.parameter.tags | string | `threatstream tags` | test_url_tag
+action_result.parameter.url | string | `url` | http://122.122.122.122/
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import ip observable'
Import IP observable into ThreatStream
@@ -1643,37 +1832,37 @@ Import IP observable into ThreatStream
Type: **generic**
Read only: **False**
-- For importing IP observables without approval, the user must provide indicator type in the indicator\_type parameter \(e\.g \- "apt\_ip"\) whereas, for importing observables with approval, the user must provide threat type in the indicator\_type parameter \(e\.g \- "apt"\)\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
+- For importing IP observables without approval, the user must provide indicator type in the indicator_type parameter (e.g - "apt_ip") whereas, for importing observables with approval, the user must provide threat type in the indicator_type parameter (e.g - "apt").
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**ip\_address** | required | Value of IP | string | `ip` `ipv6`
-**indicator\_type** | required | Type of observable to import | string |
-**source** | optional | Source of observable to import \(It will only be reflected on UI when observable is imported without approval\) | string |
+**ip_address** | required | Value of IP | string | `ip` `ipv6`
+**indicator_type** | required | Type of observable to import | string |
+**source** | optional | Source of observable to import (It will only be reflected on UI when observable is imported without approval) | string |
**classification** | optional | Designate classification for observable | string |
**severity** | optional | Severity of the observable | string |
-**tags** | optional | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
+**tags** | optional | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.ip\_address | string | `ip` `ipv6`
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.classification | string | | public
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.indicator_type | string | | apt_ip apt
+action_result.parameter.ip_address | string | `ip` `ipv6` | 122.122.122.122
+action_result.parameter.severity | string | | medium
+action_result.parameter.source | string | | testsource
+action_result.parameter.tags | string | `threatstream tags` | test_ip_tag
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import file observable'
Import file observable into ThreatStream
@@ -1681,42 +1870,42 @@ Import file observable into ThreatStream
Type: **generic**
Read only: **False**
-- For importing file observables without approval, the user must provide indicator type in the field parameter \(e\.g \- "crypto\_hash"\) whereas, for importing observables with approval, the user must provide threat type in the field parameter \(e\.g \- "crypto"\)\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
+- For importing file observables without approval, the user must provide indicator type in the field parameter (e.g - "crypto_hash") whereas, for importing observables with approval, the user must provide threat type in the field parameter (e.g - "crypto").
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**file\_hash** | required | Hash value of file | string | `sha1` `sha256` `md5` `hash`
-**indicator\_type** | required | Type of observable to import | string |
-**source** | optional | Source of observable to import \(It will only be reflected on UI when observable is imported without approval\) | string |
+**file_hash** | required | Hash value of file | string | `sha1` `sha256` `md5` `hash`
+**indicator_type** | required | Type of observable to import | string |
+**source** | optional | Source of observable to import (It will only be reflected on UI when observable is imported without approval) | string |
**confidence** | required | Confidence level | numeric |
**classification** | optional | Designate classification for observable | string |
**severity** | optional | Severity of the observable | string |
-**tags** | optional | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
+**tags** | optional | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.confidence | numeric |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.file\_hash | string | `sha1` `sha256` `md5` `hash`
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.job\_id | string |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.classification | string | | public
+action_result.parameter.confidence | numeric | | 71
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.file_hash | string | `sha1` `sha256` `md5` `hash` | EBDD888E3A22FE7EA3C5750DAFB5484367CA808184D480D461B5E51580AC813B
+action_result.parameter.indicator_type | string | | crypto_hash crypto
+action_result.parameter.severity | string | | medium
+action_result.parameter.source | string | | testsource
+action_result.parameter.tags | string | `threatstream tags` | test_file_tag
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.data.\*.import_session_id | string | | 1000001099
+action_result.data.\*.job_id | string | | ba6002fd-6bb9-4e6d-912d-8d69e3db5c65
+action_result.data.\*.success | boolean | | True False
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import email observable'
Import email observable into ThreatStream
@@ -1724,42 +1913,42 @@ Import email observable into ThreatStream
Type: **generic**
Read only: **False**
-- For importing email observables without approval, the user must provide indicator type in the indicator\_type parameter \(e\.g \- "spam\_email"\) whereas, for importing observables with approval, the user must provide threat type in the indicator\_type parameter \(e\.g \- "spam"\)\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
+- For importing email observables without approval, the user must provide indicator type in the indicator_type parameter (e.g - "spam_email") whereas, for importing observables with approval, the user must provide threat type in the indicator_type parameter (e.g - "spam").
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**email** | required | Value of email | string | `email`
-**indicator\_type** | required | Type of observable to import | string |
-**source** | optional | Source of observable to import \(It will only be reflected on UI when observable is imported without approval\) | string |
+**indicator_type** | required | Type of observable to import | string |
+**source** | optional | Source of observable to import (It will only be reflected on UI when observable is imported without approval) | string |
**confidence** | required | Confidence level | numeric |
**classification** | optional | Designate classification for observable | string |
**severity** | optional | Severity of the observable | string |
-**tags** | optional | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
+**tags** | optional | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.confidence | numeric |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.email | string | `email`
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.job\_id | string |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.classification | string | | private
+action_result.parameter.confidence | numeric | | 79
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.email | string | `email` | test_remote_1@tmail.com
+action_result.parameter.indicator_type | string | | spam_email spam
+action_result.parameter.severity | string | | medium
+action_result.parameter.source | string | | testsource
+action_result.parameter.tags | string | `threatstream tags` | test_email_test
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.data.\*.import_session_id | string | | 1000000020
+action_result.data.\*.job_id | string | | 321d4116-b632-4ea5-8862-e04c6572e300
+action_result.data.\*.success | boolean | | True False
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'import observables'
Import observables into ThreatStream
@@ -1767,39 +1956,40 @@ Import observables into ThreatStream
Type: **generic**
Read only: **False**
-- For importing observables without approval, the user must provide indicator type in the field parameter \(e\.g \- \{"itype"\: "<indicator\_type>"\}\) whereas, for importing observables with approval, the user must provide threat type in the field parameter \(e\.g \- \{"threat\_type"\: "<threat\_type>"\}\)\.
- The "allow\_unresolved" parameter will be passed in the API call if the "value" parameter is set to "domain" or "url" and "with\_approval" parameter is set to "False"\.
- The possible values of indicator type \(itype\) and threat\_type are listed at the starting of the documentation\. If the input contains any indicator type \(itype\) or threat\_type value except the ones listed, the action will behave according to the API behavior\.
- For importing observables of type 'URL', 'IP' and 'Domain', Threatstream itself detects the confidence value whereas, for importing observables of type 'Email', 'File', the user must provide confidence value in the field parameter \(e\.g \- \{"itype"\: "<indicator\_type>", "confidence"\: <confidence\_value>\}\)\.
- If both the "itype" and "threat\_type" values are passed in the "fields" parameter when "with\_approval" is set to "True", the action will behave according to the API behavior\.
+- For importing observables without approval, the user must provide indicator type in the field parameter (e.g - {"itype": "<indicator_type>"}) whereas, for importing observables with approval, the user must provide threat type in the field parameter (e.g - {"threat_type": "<threat_type>"}).
- The "allow_unresolved" parameter will be passed in the API call if the "value" parameter is set to "domain" or "url" and "with_approval" parameter is set to "False".
- The possible values of indicator type (itype) and threat_type are listed at the starting of the documentation. If the input contains any indicator type (itype) or threat_type value except the ones listed, the action will behave according to the API behavior.
- For importing observables of type 'URL', 'IP' and 'Domain', Threatstream itself detects the confidence value whereas, for importing observables of type 'Email', 'File', the user must provide confidence value in the field parameter (e.g - {"itype": "<indicator_type>", "confidence": <confidence_value>}).
- If both the "itype" and "threat_type" values are passed in the "fields" parameter when "with_approval" is set to "True", the action will behave according to the API behavior.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**observable\_type** | required | Type of observable to import | string |
+**observable_type** | required | Type of observable to import, default types: [ip, domain, url, email, hash]. Custom types can be provided if they are available on ThreatStream instance | string |
**value** | required | Observable value | string | `ip` `domain` `url` `email` `md5` `sha1` `hash`
**classification** | required | Designate classification for observable | string |
**fields** | optional | JSON formatted string of fields to include with the observable | string |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**with\_approval** | optional | Import the observable with approvals | boolean |
-**allow\_unresolved** | optional | Unresolved domains will be imported if set to true | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**with_approval** | optional | Import the observable with approvals | boolean |
+**allow_unresolved** | optional | Unresolved domains will be imported if set to true | boolean |
+**allow_custom_type** | optional | Allows upload of custom observable_type | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.allow\_unresolved | boolean |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.observable\_type | string |
-action\_result\.parameter\.value | string | `ip` `domain` `url` `email` `md5` `sha1` `hash`
-action\_result\.parameter\.with\_approval | boolean |
-action\_result\.data | string |
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.job\_id | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.allow_unresolved | boolean | | True False
+action_result.parameter.classification | string | | public
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.fields | string | | {"itype": "tor_ip", "confidence": 45} {"threat_type": "tor", "confidence": 45}
+action_result.parameter.observable_type | string | | ip
+action_result.parameter.value | string | `ip` `domain` `url` `email` `md5` `sha1` `hash` | 122.122.122.122
+action_result.parameter.with_approval | boolean | | True False
+action_result.data | string | |
+action_result.data.\*.import_session_id | string | | 1045
+action_result.data.\*.job_id | string | | 2643424c-868d-42c5-9234-8d754cfcfe4f
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.success | boolean | | True False
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Successfully sent the request for importing the observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'tag observable'
Add a tag to the observable
@@ -1811,30 +2001,30 @@ Read only: **False**
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**id** | required | Intelligence ID | string | `threatstream intelligence id`
-**source\_user\_id** | required | ID of user to associate with tag | string |
-**tags** | required | Comma\-separated list of tags to associate with this Observable | string | `threatstream tags`
+**source_user_id** | required | ID of user to associate with tag | string |
+**tags** | required | Comma-separated list of tags to associate with this Observable | string | `threatstream tags`
**tlp** | optional | TLP to assign to each tag | string | `threatstream tlp`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.id | string | `threatstream intelligence id`
-action\_result\.parameter\.source\_user\_id | string |
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.tlp | string | `threatstream tlp`
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.id | string | `threatstream intelligence id` | 51590754288
+action_result.parameter.source_user_id | string | | 16783
+action_result.parameter.tags | string | `threatstream tags` | test_tag
+action_result.parameter.tlp | string | `threatstream tlp` | red white
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.success | boolean | | True False
+action_result.data.\*.tags.\*.id | string | | 9x2 nyj
+action_result.data.\*.tags.\*.name | string | | tag_test
+action_result.data.\*.tags.\*.org_id | numeric | |
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.source_user_id | string | | 16783
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.summary | string | |
+action_result.message | string | | Successfully tagged Observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get pcap'
Download pcap file of a sample submitted to the sandbox and add it to vault
@@ -1848,16 +2038,16 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**id** | required | ID of report associated with the pcap to download | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.id | numeric |
-action\_result\.data\.\*\.file\_name | string |
-action\_result\.data\.\*\.vault\_id | string | `sha1` `vault id`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.id | numeric | | 445798
+action_result.data.\*.file_name | string | | 20190819_134705_userId-16783_dump.pcap
+action_result.data.\*.vault_id | string | `sha1` `vault id` | 285ed37b6be7b4bf1583b59150b22e9a741caede
+action_result.summary | string | |
+action_result.message | string | | PCAP file added successfully to the vault
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'detonate file'
Detonate file in ThreatStream
@@ -1865,62 +2055,62 @@ Detonate file in ThreatStream
Type: **generic**
Read only: **False**
-If classification or platform parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered\.
+If classification or platform parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**platform** | optional | Which platform to run the detonation on \- Ex\: WINDOWS10x64\. Default is 'WINDOWS7' which will run the detonation on 'WINDOWS7' platform | string |
-**vault\_id** | required | Vault id of file to be detonated | string | `vault id` `sha1`
-**classification** | required | Classification of the sandbox submission \- private or public | string |
-**use\_premium\_sandbox** | optional | Specify whether the premium sandbox should be used for detonation \- true or false\. If you want to use the Joe Sandbox service for detonation, set this attribute to true | boolean |
-**use\_vmray\_sandbox** | optional | Specify whether the vmray sandbox should be used for detonation \- true or false\. If you want to use the VMRay sandbox service for detonation, set this attribute to true | boolean |
-**vmray\_max\_jobs** | optional | Specify the number of detonations you want VMRay to perform for the submission | numeric |
-**fields** | optional | JSON formatted string of additional fields to be included in the detonate file action\. e\.g\. \{"file\_has\_password"\:"true","file\_password"\:"abc123"\}\. Please check the API doc to find more information on other valid fields | string |
+**platform** | optional | Which platform to run the detonation on - Ex: WINDOWS10x64. Default is 'WINDOWS7' which will run the detonation on 'WINDOWS7' platform | string |
+**vault_id** | required | Vault id of file to be detonated | string | `vault id` `sha1`
+**classification** | required | Classification of the sandbox submission - private or public | string |
+**use_premium_sandbox** | optional | Specify whether the premium sandbox should be used for detonation - true or false. If you want to use the Joe Sandbox service for detonation, set this attribute to true | boolean |
+**use_vmray_sandbox** | optional | Specify whether the vmray sandbox should be used for detonation - true or false. If you want to use the VMRay sandbox service for detonation, set this attribute to true | boolean |
+**vmray_max_jobs** | optional | Specify the number of detonations you want VMRay to perform for the submission | numeric |
+**fields** | optional | JSON formatted string of additional fields to be included in the detonate file action. e.g. {"file_has_password":"true","file_password":"abc123"}. Please check the API doc to find more information on other valid fields | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.platform | string |
-action\_result\.parameter\.use\_premium\_sandbox | boolean |
-action\_result\.parameter\.use\_vmray\_sandbox | boolean |
-action\_result\.parameter\.vault\_id | string | `vault id` `sha1`
-action\_result\.parameter\.vmray\_max\_jobs | numeric |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.reports\.ANDROID4\.4\.detail | string |
-action\_result\.data\.\*\.reports\.ANDROID4\.4\.status | string |
-action\_result\.data\.\*\.reports\.ANDROID5\.1\.detail | string |
-action\_result\.data\.\*\.reports\.ANDROID5\.1\.status | string |
-action\_result\.data\.\*\.reports\.ANDROID6\.0\.detail | string |
-action\_result\.data\.\*\.reports\.ANDROID6\.0\.status | string |
-action\_result\.data\.\*\.reports\.MACOSX\.detail | string |
-action\_result\.data\.\*\.reports\.MACOSX\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS10\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS10\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS10x64\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS10x64\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS7\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS7\.id | numeric |
-action\_result\.data\.\*\.reports\.WINDOWS7\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS7NATIVE\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS7NATIVE\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS7OFFICE2010\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS7OFFICE2010\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWS7OFFICE2013\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS7OFFICE2013\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.id | numeric |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWSXPNATIVE\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWSXPNATIVE\.status | string |
-action\_result\.data\.\*\.success | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.classification | string | | public
+action_result.parameter.fields | string | | {"file_has_password":"true","file_password":"abc123","import_indicators":"true","report_radio-notes":"Credential-Exposure,compromised_email","trusted_circles":"13"}
+action_result.parameter.platform | string | | WINDOWS7
+action_result.parameter.use_premium_sandbox | boolean | | True False
+action_result.parameter.use_vmray_sandbox | boolean | | True False
+action_result.parameter.vault_id | string | `vault id` `sha1` | dd88508cda7bcfc71ffdbc0e26afe97d3fb9a0b6
+action_result.parameter.vmray_max_jobs | numeric | | 5
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.reports.ANDROID4.4.detail | string | |
+action_result.data.\*.reports.ANDROID4.4.status | string | |
+action_result.data.\*.reports.ANDROID5.1.detail | string | |
+action_result.data.\*.reports.ANDROID5.1.status | string | |
+action_result.data.\*.reports.ANDROID6.0.detail | string | |
+action_result.data.\*.reports.ANDROID6.0.status | string | |
+action_result.data.\*.reports.MACOSX.detail | string | |
+action_result.data.\*.reports.MACOSX.status | string | |
+action_result.data.\*.reports.WINDOWS10.detail | string | |
+action_result.data.\*.reports.WINDOWS10.status | string | |
+action_result.data.\*.reports.WINDOWS10x64.detail | string | |
+action_result.data.\*.reports.WINDOWS10x64.status | string | |
+action_result.data.\*.reports.WINDOWS7.detail | string | |
+action_result.data.\*.reports.WINDOWS7.id | numeric | | 449205
+action_result.data.\*.reports.WINDOWS7.status | string | |
+action_result.data.\*.reports.WINDOWS7NATIVE.detail | string | |
+action_result.data.\*.reports.WINDOWS7NATIVE.status | string | |
+action_result.data.\*.reports.WINDOWS7OFFICE2010.detail | string | |
+action_result.data.\*.reports.WINDOWS7OFFICE2010.status | string | |
+action_result.data.\*.reports.WINDOWS7OFFICE2013.detail | string | |
+action_result.data.\*.reports.WINDOWS7OFFICE2013.status | string | |
+action_result.data.\*.reports.WINDOWSXP.detail | string | |
+action_result.data.\*.reports.WINDOWSXP.id | numeric | | 449204
+action_result.data.\*.reports.WINDOWSXP.status | string | |
+action_result.data.\*.reports.WINDOWSXPNATIVE.detail | string | |
+action_result.data.\*.reports.WINDOWSXPNATIVE.status | string | |
+action_result.data.\*.success | string | | True False
+action_result.summary | string | |
+action_result.message | string | | Successfully detonated file
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'detonate url'
Detonate URL in ThreatStream
@@ -1928,42 +2118,42 @@ Detonate URL in ThreatStream
Type: **generic**
Read only: **False**
-If classification or platform parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered\.
+If classification or platform parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**platform** | optional | Which platform to run the detonation on \- Ex\: WINDOWS10x64\. Default is 'WINDOWS7' which will run the detonation on 'WINDOWS7' platform | string |
+**platform** | optional | Which platform to run the detonation on - Ex: WINDOWS10x64. Default is 'WINDOWS7' which will run the detonation on 'WINDOWS7' platform | string |
**url** | required | URL to be detonated | string | `url`
-**classification** | required | Classification of the sandbox submission \- private or public | string |
-**use\_premium\_sandbox** | optional | Specify whether the premium sandbox should be used for detonation \- true or false\. If you want to use the Joe Sandbox service for detonation, set this attribute to true | boolean |
-**use\_vmray\_sandbox** | optional | Specify whether the vmray sandbox should be used for detonation \- true or false\. If you want to use the VMRay sandbox service for detonation, set this attribute to true | boolean |
-**vmray\_max\_jobs** | optional | Specify the number of detonations you want VMRay to perform for the submission | numeric |
-**fields** | optional | JSON formatted string of additional fields to be included in the detonate url action\. e\.g\. \{"import\_indicators"\:"true","report\_radio\-notes"\:"Credential\-Exposure,compromised\_email"\}\. Please check the API doc to find more infomation on other valid fields | string |
+**classification** | required | Classification of the sandbox submission - private or public | string |
+**use_premium_sandbox** | optional | Specify whether the premium sandbox should be used for detonation - true or false. If you want to use the Joe Sandbox service for detonation, set this attribute to true | boolean |
+**use_vmray_sandbox** | optional | Specify whether the vmray sandbox should be used for detonation - true or false. If you want to use the VMRay sandbox service for detonation, set this attribute to true | boolean |
+**vmray_max_jobs** | optional | Specify the number of detonations you want VMRay to perform for the submission | numeric |
+**fields** | optional | JSON formatted string of additional fields to be included in the detonate url action. e.g. {"import_indicators":"true","report_radio-notes":"Credential-Exposure,compromised_email"}. Please check the API doc to find more infomation on other valid fields | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.classification | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.platform | string |
-action\_result\.parameter\.url | string | `url`
-action\_result\.parameter\.use\_premium\_sandbox | boolean |
-action\_result\.parameter\.use\_vmray\_sandbox | boolean |
-action\_result\.parameter\.vmray\_max\_jobs | numeric |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.reports\.WINDOWS7\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWS7\.id | numeric |
-action\_result\.data\.\*\.reports\.WINDOWS7\.status | string |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.detail | string |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.id | numeric |
-action\_result\.data\.\*\.reports\.WINDOWSXP\.status | string |
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.classification | string | | public
+action_result.parameter.fields | string | | {"import_indicators":"true","report_radio-notes":"Credential-Exposure,compromised_email","trusted_circles":"13"}
+action_result.parameter.platform | string | | WINDOWS7
+action_result.parameter.url | string | `url` | https://test.com
+action_result.parameter.use_premium_sandbox | boolean | | True False
+action_result.parameter.use_vmray_sandbox | boolean | | True False
+action_result.parameter.vmray_max_jobs | numeric | | 5
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.reports.WINDOWS7.detail | string | | /api/v1/submit/451705/report/
+action_result.data.\*.reports.WINDOWS7.id | numeric | | 451705
+action_result.data.\*.reports.WINDOWS7.status | string | | /api/v1/submit/451705/
+action_result.data.\*.reports.WINDOWSXP.detail | string | | /api/v1/submit/451704/report/
+action_result.data.\*.reports.WINDOWSXP.id | numeric | | 451704
+action_result.data.\*.reports.WINDOWSXP.status | string | | /api/v1/submit/451704/
+action_result.data.\*.success | boolean | | True False
+action_result.summary | string | |
+action_result.message | string | | Successfully detonated URL
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get status'
Retrieve detonation status present in Threatstream
@@ -1974,55 +2164,55 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**endpoint** | required | Endpoint given by Detonate File/URL \(eg\: /api/v1/submit/12345/\) | string | `threatstream endpoint status`
+**endpoint** | required | Endpoint given by Detonate File/URL (eg: /api/v1/submit/12345/) | string | `threatstream endpoint status`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.endpoint | string | `threatstream endpoint status`
-action\_result\.data\.\*\.classification | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.date\_added | string |
-action\_result\.data\.\*\.detail | string |
-action\_result\.data\.\*\.file | string |
-action\_result\.data\.\*\.html\_report | string |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.import\_indicators | boolean |
-action\_result\.data\.\*\.jobID | string |
-action\_result\.data\.\*\.maec\_report | string |
-action\_result\.data\.\*\.md5 | string |
-action\_result\.data\.\*\.message | string |
-action\_result\.data\.\*\.misc\_info | string |
-action\_result\.data\.\*\.notes | string |
-action\_result\.data\.\*\.pdf\_generated | numeric |
-action\_result\.data\.\*\.platform | string |
-action\_result\.data\.\*\.platform\_label | string |
-action\_result\.data\.\*\.priority | numeric |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.reportid | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.sandbox\_vendor | string |
-action\_result\.data\.\*\.sha1 | string |
-action\_result\.data\.\*\.sha256 | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.url | string | `url`
-action\_result\.data\.\*\.user\.id | numeric |
-action\_result\.data\.\*\.user\.username | string | `email` `user name`
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.data\.\*\.verdict | string |
-action\_result\.data\.\*\.virustotal | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.data\.\*\.yara | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.endpoint | string | `threatstream endpoint status` | /api/v1/submit/454240/
+action_result.data.\*.classification | string | | private
+action_result.data.\*.confidence | numeric | |
+action_result.data.\*.date_added | string | | 2018-08-17T17:52:13.832385
+action_result.data.\*.detail | string | |
+action_result.data.\*.file | string | | /test_file.png
+action_result.data.\*.html_report | string | |
+action_result.data.\*.id | numeric | | 291629
+action_result.data.\*.import_indicators | boolean | | True False
+action_result.data.\*.jobID | string | | 189200
+action_result.data.\*.maec_report | string | |
+action_result.data.\*.md5 | string | |
+action_result.data.\*.message | string | |
+action_result.data.\*.misc_info | string | |
+action_result.data.\*.notes | string | |
+action_result.data.\*.pdf_generated | numeric | | 0
+action_result.data.\*.platform | string | | WINDOWS7
+action_result.data.\*.platform_label | string | | Windows 7
+action_result.data.\*.priority | numeric | | 2
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.reportid | string | |
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.sandbox_vendor | string | | test
+action_result.data.\*.sha1 | string | |
+action_result.data.\*.sha256 | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.status | string | | processing
+action_result.data.\*.url | string | `url` |
+action_result.data.\*.user.id | numeric | | 6941
+action_result.data.\*.user.username | string | `email` `user name` |
+action_result.data.\*.user_id | numeric | | 16783
+action_result.data.\*.verdict | string | | benign
+action_result.data.\*.virustotal | string | |
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.data.\*.yara | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved detonation status
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get report'
Retrieve detonation report present in Threatstream
@@ -2033,131 +2223,131 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**endpoint** | required | Endpoint given by Detonate File/URL \(eg\: /api/v1/submit/141/report/\) | string | `threatstream endpoint report`
+**endpoint** | required | Endpoint given by Detonate File/URL (eg: /api/v1/submit/141/report/) | string | `threatstream endpoint report`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.endpoint | string | `threatstream endpoint report`
-action\_result\.data\.\*\.pcap | string | `url`
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.results\.behavior\.anomaly\.\*\.category | string |
-action\_result\.data\.\*\.results\.behavior\.anomaly\.\*\.funcname | string |
-action\_result\.data\.\*\.results\.behavior\.anomaly\.\*\.message | string |
-action\_result\.data\.\*\.results\.behavior\.anomaly\.\*\.name | string |
-action\_result\.data\.\*\.results\.behavior\.anomaly\.\*\.pid | numeric |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.classname | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.content | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.file | string | `file name` `file path`
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.moduleaddress | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.object | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.pathtofile | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.regkey | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.data\.windowname | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.eid | numeric |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.event | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.object | string |
-action\_result\.data\.\*\.results\.behavior\.enhanced\.\*\.timestamp | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.api | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.arguments\.\*\.name | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.arguments\.\*\.value | string | `file path` `file name`
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.category | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.id | numeric |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.repeated | numeric |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.return | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.status | boolean |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.thread\_id | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.calls\.\*\.timestamp | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.first\_seen | string |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.parent\_id | numeric |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.process\_id | numeric |
-action\_result\.data\.\*\.results\.behavior\.processes\.\*\.process\_name | string | `file name`
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.children\.\*\.name | string |
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.children\.\*\.parent\_id | numeric |
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.children\.\*\.pid | numeric |
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.name | string | `file name`
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.parent\_id | numeric |
-action\_result\.data\.\*\.results\.behavior\.processtree\.\*\.pid | numeric | `pid`
-action\_result\.data\.\*\.results\.behavior\.summary\.files | string | `file path` `file name`
-action\_result\.data\.\*\.results\.behavior\.summary\.keys | string |
-action\_result\.data\.\*\.results\.debug\.log | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.crc32 | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.md5 | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.name | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.path | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.sha1 | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.sha256 | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.sha512 | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.size | numeric |
-action\_result\.data\.\*\.results\.dropped\.\*\.ssdeep | string |
-action\_result\.data\.\*\.results\.dropped\.\*\.type | string |
-action\_result\.data\.\*\.results\.info\.category | string |
-action\_result\.data\.\*\.results\.info\.custom | string |
-action\_result\.data\.\*\.results\.info\.duration | numeric |
-action\_result\.data\.\*\.results\.info\.ended | string |
-action\_result\.data\.\*\.results\.info\.id | numeric |
-action\_result\.data\.\*\.results\.info\.machine\.id | numeric |
-action\_result\.data\.\*\.results\.info\.machine\.label | string |
-action\_result\.data\.\*\.results\.info\.machine\.manager | string |
-action\_result\.data\.\*\.results\.info\.machine\.name | string |
-action\_result\.data\.\*\.results\.info\.machine\.shutdown\_on | string |
-action\_result\.data\.\*\.results\.info\.machine\.started\_on | string |
-action\_result\.data\.\*\.results\.info\.package | string |
-action\_result\.data\.\*\.results\.info\.started | string |
-action\_result\.data\.\*\.results\.info\.version | string |
-action\_result\.data\.\*\.results\.network\.dns\.\*\.answers\.\*\.data | string |
-action\_result\.data\.\*\.results\.network\.dns\.\*\.answers\.\*\.type | string |
-action\_result\.data\.\*\.results\.network\.dns\.\*\.request | string |
-action\_result\.data\.\*\.results\.network\.dns\.\*\.type | string |
-action\_result\.data\.\*\.results\.network\.domains\.\*\.domain | string |
-action\_result\.data\.\*\.results\.network\.domains\.\*\.ip | string |
-action\_result\.data\.\*\.results\.network\.hosts | string | `ip`
-action\_result\.data\.\*\.results\.network\.pcap\_sha256 | string | `sha256`
-action\_result\.data\.\*\.results\.network\.sorted\_pcap\_sha256 | string | `sha256`
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.dport | numeric |
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.dst | string | `ip`
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.offset | numeric |
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.sport | numeric |
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.src | string | `ip`
-action\_result\.data\.\*\.results\.network\.tcp\.\*\.time | numeric |
-action\_result\.data\.\*\.results\.network\.udp\.\*\.dport | numeric |
-action\_result\.data\.\*\.results\.network\.udp\.\*\.dst | string | `ip`
-action\_result\.data\.\*\.results\.network\.udp\.\*\.offset | numeric |
-action\_result\.data\.\*\.results\.network\.udp\.\*\.sport | numeric |
-action\_result\.data\.\*\.results\.network\.udp\.\*\.src | string | `ip`
-action\_result\.data\.\*\.results\.network\.udp\.\*\.time | numeric |
-action\_result\.data\.\*\.results\.signatures\.\*\.alert | boolean |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.process\.process\_name | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.type | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.value\.category | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.value\.return | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.value\.status | boolean |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.value\.thread\_id | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.data\.\*\.signs\.\*\.value\.timestamp | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.name | string |
-action\_result\.data\.\*\.results\.signatures\.\*\.severity | numeric |
-action\_result\.data\.\*\.results\.target\.category | string |
-action\_result\.data\.\*\.results\.target\.file\.crc32 | string |
-action\_result\.data\.\*\.results\.target\.file\.md5 | string | `md5`
-action\_result\.data\.\*\.results\.target\.file\.name | string |
-action\_result\.data\.\*\.results\.target\.file\.path | string |
-action\_result\.data\.\*\.results\.target\.file\.sha1 | string | `sha1`
-action\_result\.data\.\*\.results\.target\.file\.sha256 | string | `sha256`
-action\_result\.data\.\*\.results\.target\.file\.sha512 | string |
-action\_result\.data\.\*\.results\.target\.file\.size | numeric |
-action\_result\.data\.\*\.results\.target\.file\.ssdeep | string |
-action\_result\.data\.\*\.results\.target\.file\.type | string |
-action\_result\.data\.\*\.results\.target\.url | string |
-action\_result\.data\.\*\.screenshots | string | `url`
-action\_result\.data\.\*\.success | boolean |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.endpoint | string | `threatstream endpoint report` | /api/v1/submit/141/report/
+action_result.data.\*.pcap | string | `url` |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.results.behavior.anomaly.\*.category | string | | unhook
+action_result.data.\*.results.behavior.anomaly.\*.funcname | string | | SetWindowsHookExW
+action_result.data.\*.results.behavior.anomaly.\*.message | string | | Function hook was modified!
+action_result.data.\*.results.behavior.anomaly.\*.name | string | | iexplore.exe
+action_result.data.\*.results.behavior.anomaly.\*.pid | numeric | | 2012
+action_result.data.\*.results.behavior.enhanced.\*.data.classname | string | | Shell_TrayWnd
+action_result.data.\*.results.behavior.enhanced.\*.data.content | string | | 0
+action_result.data.\*.results.behavior.enhanced.\*.data.file | string | `file name` `file path` | KERNEL32.DLL
+action_result.data.\*.results.behavior.enhanced.\*.data.moduleaddress | string | |
+action_result.data.\*.results.behavior.enhanced.\*.data.object | string | |
+action_result.data.\*.results.behavior.enhanced.\*.data.pathtofile | string | |
+action_result.data.\*.results.behavior.enhanced.\*.data.regkey | string | | DisableUNCCheck
+action_result.data.\*.results.behavior.enhanced.\*.data.windowname | string | |
+action_result.data.\*.results.behavior.enhanced.\*.eid | numeric | | 1
+action_result.data.\*.results.behavior.enhanced.\*.event | string | | load
+action_result.data.\*.results.behavior.enhanced.\*.object | string | | library
+action_result.data.\*.results.behavior.enhanced.\*.timestamp | string | | 2018-08-18 00:52:26,968
+action_result.data.\*.results.behavior.processes.\*.calls.\*.api | string | | NtOpenDirectoryObject
+action_result.data.\*.results.behavior.processes.\*.calls.\*.arguments.\*.name | string | | DirectoryHandle
+action_result.data.\*.results.behavior.processes.\*.calls.\*.arguments.\*.value | string | `file path` `file name` | 0x00000088
+action_result.data.\*.results.behavior.processes.\*.calls.\*.category | string | | filesystem
+action_result.data.\*.results.behavior.processes.\*.calls.\*.id | numeric | | 0
+action_result.data.\*.results.behavior.processes.\*.calls.\*.repeated | numeric | | 0
+action_result.data.\*.results.behavior.processes.\*.calls.\*.return | string | | 0x00000000
+action_result.data.\*.results.behavior.processes.\*.calls.\*.status | boolean | | True False
+action_result.data.\*.results.behavior.processes.\*.calls.\*.thread_id | string | | 2684
+action_result.data.\*.results.behavior.processes.\*.calls.\*.timestamp | string | | 2018-08-18 00:52:26,936
+action_result.data.\*.results.behavior.processes.\*.first_seen | string | | 2018-08-18 00:52:26,921
+action_result.data.\*.results.behavior.processes.\*.parent_id | numeric | | 2228
+action_result.data.\*.results.behavior.processes.\*.process_id | numeric | | 2680
+action_result.data.\*.results.behavior.processes.\*.process_name | string | `file name` | cmd.exe
+action_result.data.\*.results.behavior.processtree.\*.children.\*.name | string | | iexplore.exe
+action_result.data.\*.results.behavior.processtree.\*.children.\*.parent_id | numeric | | 1772
+action_result.data.\*.results.behavior.processtree.\*.children.\*.pid | numeric | | 2012
+action_result.data.\*.results.behavior.processtree.\*.name | string | `file name` | cmd.exe
+action_result.data.\*.results.behavior.processtree.\*.parent_id | numeric | | 2228
+action_result.data.\*.results.behavior.processtree.\*.pid | numeric | `pid` | 2680
+action_result.data.\*.results.behavior.summary.files | string | `file path` `file name` | C:\\Windows\\system32\\rsaenh.dll
+action_result.data.\*.results.behavior.summary.keys | string | | HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{6C72B11B-DBE0-4C87-B1A8-7C8A36BD563D}
+action_result.data.\*.results.debug.log | string | |
+action_result.data.\*.results.dropped.\*.crc32 | string | | 7CCFDEB6
+action_result.data.\*.results.dropped.\*.md5 | string | | e2817febfede77b8cc498c4833098742
+action_result.data.\*.results.dropped.\*.name | string | | invalidcert[1]
+action_result.data.\*.results.dropped.\*.path | string | | /opt/ts_sandbox/cuckoo/storage/analyses/2036/files/9088658753/invalidcert[1]
+action_result.data.\*.results.dropped.\*.sha1 | string | | 6ab7cc3e5c14221cd349a932d56c6bd1acefed70
+action_result.data.\*.results.dropped.\*.sha256 | string | | aab4f5b4bdd02b66b46643b0bbd40761c694b14857e6943f3ac03b692fd08047
+action_result.data.\*.results.dropped.\*.sha512 | string | | 10e93a02799d727584621ab0852f864e1e9875e6a68d6dce4eee3f454cc253672a74859dd078c1779b88e26f44bd410a6c173dcd86ec49effb119d56e01bc977
+action_result.data.\*.results.dropped.\*.size | numeric | | 4922
+action_result.data.\*.results.dropped.\*.ssdeep | string | | 96:UUHUD0Ws5PFkiGjUpEajPCMCz27BS4bLAi:3UIWsnkdjoFDd57BS4bMi
+action_result.data.\*.results.dropped.\*.type | string | | HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
+action_result.data.\*.results.info.category | string | | file
+action_result.data.\*.results.info.custom | string | |
+action_result.data.\*.results.info.duration | numeric | | 1765
+action_result.data.\*.results.info.ended | string | | 2018-08-17 18:21:40
+action_result.data.\*.results.info.id | numeric | | 189200
+action_result.data.\*.results.info.machine.id | numeric | | 188372
+action_result.data.\*.results.info.machine.label | string | | WINDOWS7_4
+action_result.data.\*.results.info.machine.manager | string | | KVM
+action_result.data.\*.results.info.machine.name | string | | WINDOWS7_4
+action_result.data.\*.results.info.machine.shutdown_on | string | | 2018-08-17 18:21:40
+action_result.data.\*.results.info.machine.started_on | string | | 2018-08-17 17:52:15
+action_result.data.\*.results.info.package | string | |
+action_result.data.\*.results.info.started | string | | 2018-08-17 17:52:15
+action_result.data.\*.results.info.version | string | | 1.3-dev
+action_result.data.\*.results.network.dns.\*.answers.\*.data | string | | 216.58.193.142
+action_result.data.\*.results.network.dns.\*.answers.\*.type | string | | A
+action_result.data.\*.results.network.dns.\*.request | string | | test.com
+action_result.data.\*.results.network.dns.\*.type | string | | A
+action_result.data.\*.results.network.domains.\*.domain | string | | test.com
+action_result.data.\*.results.network.domains.\*.ip | string | | 172.217.2.238
+action_result.data.\*.results.network.hosts | string | `ip` | 122.122.122.122
+action_result.data.\*.results.network.pcap_sha256 | string | `sha256` | f6d7241fa1c3c47cec2169d11a7899d642383f15e23e325ade8677b7417a1539
+action_result.data.\*.results.network.sorted_pcap_sha256 | string | `sha256` | 89152c1836bd3444227ad29fafd1c8cb492d2f904966c154cd3dd8497133052e
+action_result.data.\*.results.network.tcp.\*.dport | numeric | | 139
+action_result.data.\*.results.network.tcp.\*.dst | string | `ip` | 122.122.122.122
+action_result.data.\*.results.network.tcp.\*.offset | numeric | | 466
+action_result.data.\*.results.network.tcp.\*.sport | numeric | | 1038
+action_result.data.\*.results.network.tcp.\*.src | string | `ip` | 122.122.122.122
+action_result.data.\*.results.network.tcp.\*.time | numeric | | 6.429862976074219
+action_result.data.\*.results.network.udp.\*.dport | numeric | | 137
+action_result.data.\*.results.network.udp.\*.dst | string | `ip` | 122.122.122.122
+action_result.data.\*.results.network.udp.\*.offset | numeric | | 7218
+action_result.data.\*.results.network.udp.\*.sport | numeric | | 137
+action_result.data.\*.results.network.udp.\*.src | string | `ip` | 122.122.122.122
+action_result.data.\*.results.network.udp.\*.time | numeric | | 6.429553985595703
+action_result.data.\*.results.signatures.\*.alert | boolean | | True False
+action_result.data.\*.results.signatures.\*.data.\*.process.process_name | string | | test.exe
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.type | string | | api
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.value.category | string | | filesystem
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.value.return | string | |
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.value.status | boolean | | True False
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.value.thread_id | string | | 1840
+action_result.data.\*.results.signatures.\*.data.\*.signs.\*.value.timestamp | string | | 2019-08-19 19:38:38,843
+action_result.data.\*.results.signatures.\*.name | string | | antisandbox_sleep
+action_result.data.\*.results.signatures.\*.severity | numeric | | 3
+action_result.data.\*.results.target.category | string | | file
+action_result.data.\*.results.target.file.crc32 | string | | 1EC6C6C8
+action_result.data.\*.results.target.file.md5 | string | `md5` | f0216e2697dc24e71777811c6c0c5858
+action_result.data.\*.results.target.file.name | string | | box.png
+action_result.data.\*.results.target.file.path | string | |
+action_result.data.\*.results.target.file.sha1 | string | `sha1` | 7fa1c75071fcb3efe0089cc1b78cf9a121a313cd
+action_result.data.\*.results.target.file.sha256 | string | `sha256` |
+action_result.data.\*.results.target.file.sha512 | string | | 99479dda2a5334d3f4894c063d7d0147cc8d3dad1e48f3db1130fabad13b65141cfd54831984143a39840161130884b53260c60360b529afe0a7a4f4f7904882
+action_result.data.\*.results.target.file.size | numeric | | 7707
+action_result.data.\*.results.target.file.ssdeep | string | |
+action_result.data.\*.results.target.file.type | string | | PNG image data, 400 x 220, 8-bit gray+alpha, non-interlaced
+action_result.data.\*.results.target.url | string | | https://test.com
+action_result.data.\*.screenshots | string | `url` |
+action_result.data.\*.success | boolean | | True False
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved detonation report
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'on poll'
-Callback action for the on\_poll ingest functionality
+Callback action for the on_poll ingest functionality
Type: **ingest**
Read only: **True**
@@ -2165,11 +2355,11 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**container\_id** | optional | Parameter ignored in this app | numeric |
-**start\_time** | optional | Parameter ignored in this app | numeric |
-**end\_time** | optional | Parameter ignored in this app | numeric |
-**container\_count** | optional | Maximum number of container records \(incidents\) to query for | numeric |
-**artifact\_count** | optional | Parameter ignored in this app | numeric |
+**container_id** | optional | Parameter ignored in this app | numeric |
+**start_time** | optional | Parameter ignored in this app | numeric |
+**end_time** | optional | Parameter ignored in this app | numeric |
+**container_count** | optional | Maximum number of container records (incidents) to query for | numeric |
+**artifact_count** | optional | Parameter ignored in this app | numeric |
#### Action Output
No Output
@@ -2180,86 +2370,86 @@ Run observables query in ThreatStream
Type: **investigate**
Read only: **True**
-For providing the query parameter, please form a valid search string using the Anomali filter language \(as seen on the advanced search page\) and then convert it into a valid JSON string as shown in the example here\. e\.g\. Anomali filter language\-based search string = modifed\_ts\_\_gt=2018\-01\-10&status=active has to be provided in the query parameter as \{ "modifed\_ts\_\_gt"\: "2018\-01\-10", "status"\: "active" \}
If offset is provided in the 'query' parameter, it will be overwritten by the offset value provided in the 'offset' parameter\.
+For providing the query parameter, please form a valid search string using the Anomali filter language (as seen on the advanced search page) and then convert it into a valid JSON string as shown in the example here. e.g. Anomali filter language-based search string = modifed_ts__gt=2018-01-10&status=active has to be provided in the query parameter as { "modifed_ts__gt": "2018-01-10", "status": "active" }
If offset is provided in the 'query' parameter, it will be overwritten by the offset value provided in the 'offset' parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**query** | required | Search string in JSON format using the Anomali filter language \(as seen on the advanced search page\) | string |
-**order\_by** | optional | Field by which the query results will be ordered | string |
-**offset** | optional | Record offset \(used with paging, when returning many results\) | numeric |
+**query** | required | Search string in JSON format using the Anomali filter language (as seen on the advanced search page) | string |
+**order_by** | optional | Field by which the query results will be ordered | string |
+**offset** | optional | Record offset (used with paging, when returning many results) | numeric |
**limit** | optional | Record limit | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.offset | numeric |
-action\_result\.parameter\.order\_by | string |
-action\_result\.parameter\.query | string |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.limit | numeric |
-action\_result\.data\.\*\.meta\.maltype | string |
-action\_result\.data\.\*\.meta\.registrant\_address | string |
-action\_result\.data\.\*\.meta\.registrant\_email | string |
-action\_result\.data\.\*\.meta\.registrant\_name | string |
-action\_result\.data\.\*\.meta\.registrant\_org | string |
-action\_result\.data\.\*\.meta\.registrant\_phone | string |
-action\_result\.data\.\*\.meta\.registration\_created | string |
-action\_result\.data\.\*\.meta\.registration\_updated | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string |
-action\_result\.summary\.records\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 1000
+action_result.parameter.offset | numeric | | 0
+action_result.parameter.order_by | string | | itype value
+action_result.parameter.query | string | |
+action_result.data.\*.asn | string | | 11426
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.confidence | numeric | | 11
+action_result.data.\*.country | string | | US
+action_result.data.\*.created_by | string | |
+action_result.data.\*.created_ts | string | | 2018-03-29T23:31:34.986Z
+action_result.data.\*.description | string | |
+action_result.data.\*.expiration_ts | string | | 2018-06-27T23:31:35.004Z
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream intelligence id` | 50630233146
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | `ip` | 122.122.122.122
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.itype | string | | actor_ip
+action_result.data.\*.latitude | string | | 35.293600
+action_result.data.\*.longitude | string | | -80.735000
+action_result.data.\*.meta.detail | string | | smbd
+action_result.data.\*.meta.detail2 | string | | imported by user 13487 Confirmed as false positive
+action_result.data.\*.meta.limit | numeric | | 25
+action_result.data.\*.meta.maltype | string | |
+action_result.data.\*.meta.registrant_address | string | | DomainsByProxy.com|14455 N. Hayden Road, Scottsdale, Arizona, UNITED STATES, 85260
+action_result.data.\*.meta.registrant_email | string | | gfdf.com@domainsbyproxy.com
+action_result.data.\*.meta.registrant_name | string | | Registration Private
+action_result.data.\*.meta.registrant_org | string | | Domains By Proxy, LLC
+action_result.data.\*.meta.registrant_phone | string | | 14806242599
+action_result.data.\*.meta.registration_created | string | | 2004-06-18T18:16:16+00:00
+action_result.data.\*.meta.registration_updated | string | | 2020-11-13T23:57:39+00:00
+action_result.data.\*.meta.severity | string | | low
+action_result.data.\*.modified_ts | string | | 2018-03-29T23:31:34.986Z
+action_result.data.\*.org | string | | Test org
+action_result.data.\*.owner_organization_id | numeric | | 2342
+action_result.data.\*.rdns | string | | user-0c99mbe.test.test.com
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v2/intelligence/50630233146/
+action_result.data.\*.retina_confidence | numeric | | -1
+action_result.data.\*.source | string | | test_source.us
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | | 50
+action_result.data.\*.status | string | | falsepos
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags | string | |
+action_result.data.\*.tags.\*.id | string | | tpp
+action_result.data.\*.tags.\*.name | string | | smbd
+action_result.data.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | | p2p
+action_result.data.\*.threatscore | numeric | | 3
+action_result.data.\*.tlp | string | |
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.type | string | | ip
+action_result.data.\*.update_id | numeric | | 1736852157
+action_result.data.\*.uuid | string | | 094074ec-3acc-4639-8eb9-982eb002a33b
+action_result.data.\*.value | string | | 24.148.217.110
+action_result.summary.records_returned | numeric | | 950
+action_result.message | string | | Records returned: 950
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list import sessions'
List all the import sessions
@@ -2267,101 +2457,101 @@ List all the import sessions
Type: **investigate**
Read only: **True**
-- For a Hybrid instance, this action will return both remote and local data based on the input parameters\.
- The user can use the list imports action to fetch only remote or local data in the response\.
+- For a Hybrid instance, this action will return both remote and local data based on the input parameters.
- The user can use the list imports action to fetch only remote or local data in the response.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**date\_modified\_gte** | optional | Import sessions with greater than or equal to the provided modified date will be returned | string | `threatstream date`
+**date_modified_gte** | optional | Import sessions with greater than or equal to the provided modified date will be returned | string | `threatstream date`
**limit** | optional | Total number of import sessions to return | numeric |
-**offset** | optional | Record offset \(used with paging, when returning many results\) | numeric |
-**status\_in** | optional | Status to filter the records | string |
+**offset** | optional | Record offset (used with paging, when returning many results) | numeric |
+**status_in** | optional | Status to filter the records | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.date\_modified\_gte | string | `threatstream date`
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.offset | numeric |
-action\_result\.parameter\.status\_in | string |
-action\_result\.data\.\*\.approved\_by\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.approved\_by\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.approved\_by\.email | string | `email`
-action\_result\.data\.\*\.approved\_by\.id | string |
-action\_result\.data\.\*\.approved\_by\.is\_active | boolean |
-action\_result\.data\.\*\.approved\_by\.is\_readonly | boolean |
-action\_result\.data\.\*\.approved\_by\.must\_change\_password | boolean |
-action\_result\.data\.\*\.approved\_by\.name | string |
-action\_result\.data\.\*\.approved\_by\.nickname | string |
-action\_result\.data\.\*\.approved\_by\.organization\.id | string |
-action\_result\.data\.\*\.approved\_by\.organization\.name | string |
-action\_result\.data\.\*\.approved\_by\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.approved\_by\.resource\_uri | string |
-action\_result\.data\.\*\.approved\_by\_id | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.date | string |
-action\_result\.data\.\*\.date\_modified | string |
-action\_result\.data\.\*\.default\_comment | string |
-action\_result\.data\.\*\.email | string | `email`
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.fileName | string | `url`
-action\_result\.data\.\*\.fileType | string |
-action\_result\.data\.\*\.file\_name\_label | string |
-action\_result\.data\.\*\.id | numeric | `threatstream import session id`
-action\_result\.data\.\*\.intelligence\_source | string | `url`
-action\_result\.data\.\*\.investigations\.\*\.id | string |
-action\_result\.data\.\*\.investigations\.\*\.name | string |
-action\_result\.data\.\*\.investigations\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.jobID | string |
-action\_result\.data\.\*\.messages | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.notes | string |
-action\_result\.data\.\*\.numIndicators | numeric |
-action\_result\.data\.\*\.numRejected | numeric |
-action\_result\.data\.\*\.num\_private | numeric |
-action\_result\.data\.\*\.num\_public | numeric |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.orginal\_intelligence | string |
-action\_result\.data\.\*\.processed\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.sandbox\_submit | string |
-action\_result\.data\.\*\.source\_confidence\_weight | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.anonymous\_sharing | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.can\_override\_confidence | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.description | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.id | numeric |
-action\_result\.data\.\*\.trusted\_circles\.\*\.is\_freemium | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.mattermost\_team\_id | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.name | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.openinvite | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.partner | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.premium\_channel | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.public | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.restricted\_publishing | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.subscription\_model | string |
-action\_result\.data\.\*\.trusted\_circles\.\*\.use\_chat | boolean |
-action\_result\.data\.\*\.trusted\_circles\.\*\.validate\_subscriptions | boolean |
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.data\.\*\.visibleForReview | boolean |
-action\_result\.summary\.import\_sessions\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.date_modified_gte | string | `threatstream date` | 2020-11-05T17:30:00.130822
+action_result.parameter.limit | numeric | | 10
+action_result.parameter.offset | numeric | | 0
+action_result.parameter.status_in | string | | approved errors done deleted processing
+action_result.data.\*.approved_by.avatar_s3_url | string | |
+action_result.data.\*.approved_by.can_share_intelligence | boolean | | True False
+action_result.data.\*.approved_by.email | string | `email` | test@test.com
+action_result.data.\*.approved_by.id | string | | 142
+action_result.data.\*.approved_by.is_active | boolean | | True False
+action_result.data.\*.approved_by.is_readonly | boolean | | True False
+action_result.data.\*.approved_by.must_change_password | boolean | | True False
+action_result.data.\*.approved_by.name | string | | testname
+action_result.data.\*.approved_by.nickname | string | | TestIntegrationLab
+action_result.data.\*.approved_by.organization.id | string | | 70
+action_result.data.\*.approved_by.organization.name | string | | test
+action_result.data.\*.approved_by.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.approved_by.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.approved_by_id | string | | 142
+action_result.data.\*.confidence | numeric | | 50
+action_result.data.\*.date | string | | 2020-10-08T10:49:07.546945
+action_result.data.\*.date_modified | string | | 2020-10-08T11:38:29.563295
+action_result.data.\*.default_comment | string | | test comment
+action_result.data.\*.email | string | `email` | test@test.com
+action_result.data.\*.expiration_ts | string | | 2021-01-06T10:41:08.444000
+action_result.data.\*.fileName | string | `url` | https://test.com/https%3A/test.com?Signature=19pJrM2OyY3wqiKi%2FDwPRThLq%2Bs%3D&Expires=1602227603&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.fileType | string | | html
+action_result.data.\*.file_name_label | string | |
+action_result.data.\*.id | numeric | `threatstream import session id` | 875
+action_result.data.\*.intelligence_source | string | `url` | https://test.com/test
+action_result.data.\*.investigations.\*.id | string | | 34
+action_result.data.\*.investigations.\*.name | string | | Test_y
+action_result.data.\*.investigations.\*.resource_uri | string | | /api/v1/investigation/34/
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.jobID | string | |
+action_result.data.\*.messages | string | |
+action_result.data.\*.name | string | | test
+action_result.data.\*.notes | string | |
+action_result.data.\*.numIndicators | numeric | | 125
+action_result.data.\*.numRejected | numeric | | 1412
+action_result.data.\*.num_private | numeric | | 125
+action_result.data.\*.num_public | numeric | | 0
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.orginal_intelligence | string | |
+action_result.data.\*.processed_ts | string | | 2020-10-08T10:54:01.965978
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/importsession/875/
+action_result.data.\*.sandbox_submit | string | |
+action_result.data.\*.source_confidence_weight | numeric | | 0
+action_result.data.\*.status | string | | approved
+action_result.data.\*.tags.\*.id | string | | tmh
+action_result.data.\*.tags.\*.name | string | | test
+action_result.data.\*.tags.\*.org_id | numeric | | 70
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | | malware
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.trusted_circles.\*.anonymous_sharing | boolean | | True False
+action_result.data.\*.trusted_circles.\*.can_override_confidence | boolean | | True False
+action_result.data.\*.trusted_circles.\*.description | string | | Test circle
+action_result.data.\*.trusted_circles.\*.id | numeric | | 10017
+action_result.data.\*.trusted_circles.\*.is_freemium | boolean | | True False
+action_result.data.\*.trusted_circles.\*.mattermost_team_id | string | |
+action_result.data.\*.trusted_circles.\*.name | string | | Test circle
+action_result.data.\*.trusted_circles.\*.openinvite | boolean | | True False
+action_result.data.\*.trusted_circles.\*.partner | string | |
+action_result.data.\*.trusted_circles.\*.premium_channel | string | |
+action_result.data.\*.trusted_circles.\*.public | boolean | | True False
+action_result.data.\*.trusted_circles.\*.remote_api | boolean | | True False
+action_result.data.\*.trusted_circles.\*.restricted_publishing | boolean | | True False
+action_result.data.\*.trusted_circles.\*.subscription_model | string | |
+action_result.data.\*.trusted_circles.\*.use_chat | boolean | | True False
+action_result.data.\*.trusted_circles.\*.validate_subscriptions | boolean | | True False
+action_result.data.\*.user_id | numeric | | 142
+action_result.data.\*.visibleForReview | boolean | | True False
+action_result.summary.import_sessions_returned | numeric | | 9
+action_result.message | string | | Import sessions returned: 9
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update import session'
This action updates the fields of the provided item id
@@ -2369,133 +2559,133 @@ This action updates the fields of the provided item id
Type: **generic**
Read only: **False**
-If "null" is provided in the expire time parameter, then expiration time will be set to "9999\-12\-31T00\:00\:00"\.
+If "null" is provided in the expire time parameter, then expiration time will be set to "9999-12-31T00:00:00".
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**item\_id** | required | ID of the import session to update | numeric | `threatstream import session id`
-**intelligence\_source** | optional | Intelligence Source to update | string |
+**item_id** | required | ID of the import session to update | numeric | `threatstream import session id`
+**intelligence_source** | optional | Intelligence Source to update | string |
**tlp** | optional | Traffic Light Protocol value to update | string | `threatstream tlp`
-**tags** | optional | Comma\-separated list of tags to update | string | `threatstream tags`
+**tags** | optional | Comma-separated list of tags to update | string | `threatstream tags`
**comment** | optional | Comment to update | string |
-**expire\_time** | optional | Expiration time to update \(Format \: YYYY\-MM\-DD HH\:MM\[\:ss\[\.uuuuuu\]\]\[TZ\]\) | string | `threatstream date`
-**threat\_model\_type** | optional | Comma\-separated list of threat model types to associate | string |
-**threat\_model\_to\_associate** | optional | Comma\-separated list of threat model IDs to associate | string |
+**expire_time** | optional | Expiration time to update (Format : YYYY-MM-DD HH:MM[:ss[.uuuuuu]][TZ]) | string | `threatstream date`
+**threat_model_type** | optional | Comma-separated list of threat model types to associate | string |
+**threat_model_to_associate** | optional | Comma-separated list of threat model IDs to associate | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.comment | string |
-action\_result\.parameter\.expire\_time | string | `threatstream date`
-action\_result\.parameter\.intelligence\_source | string |
-action\_result\.parameter\.item\_id | numeric | `threatstream import session id`
-action\_result\.parameter\.tags | string | `threatstream tags`
-action\_result\.parameter\.threat\_model\_to\_associate | string |
-action\_result\.parameter\.threat\_model\_type | string |
-action\_result\.parameter\.tlp | string | `threatstream tlp`
-action\_result\.data\.\*\.approved\_by\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.approved\_by\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.approved\_by\.email | string |
-action\_result\.data\.\*\.approved\_by\.id | string |
-action\_result\.data\.\*\.approved\_by\.is\_active | boolean |
-action\_result\.data\.\*\.approved\_by\.is\_readonly | boolean |
-action\_result\.data\.\*\.approved\_by\.must\_change\_password | boolean |
-action\_result\.data\.\*\.approved\_by\.name | string |
-action\_result\.data\.\*\.approved\_by\.nickname | string |
-action\_result\.data\.\*\.approved\_by\.organization\.id | string |
-action\_result\.data\.\*\.approved\_by\.organization\.name | string |
-action\_result\.data\.\*\.approved\_by\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.approved\_by\.resource\_uri | string |
-action\_result\.data\.\*\.approved\_by\_id | numeric |
-action\_result\.data\.\*\.associations\.actors\.\*\.id | string |
-action\_result\.data\.\*\.associations\.actors\.\*\.name | string |
-action\_result\.data\.\*\.associations\.actors\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.associations\.incidents\.\*\.id | string |
-action\_result\.data\.\*\.associations\.incidents\.\*\.name | string |
-action\_result\.data\.\*\.associations\.incidents\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.associations\.malware\.\*\.id | string |
-action\_result\.data\.\*\.associations\.malware\.\*\.name | string |
-action\_result\.data\.\*\.associations\.malware\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.associations\.tip\_reports\.\*\.id | string |
-action\_result\.data\.\*\.associations\.tip\_reports\.\*\.name | string |
-action\_result\.data\.\*\.associations\.tip\_reports\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.associations\.ttps\.\*\.id | string |
-action\_result\.data\.\*\.associations\.ttps\.\*\.name | string |
-action\_result\.data\.\*\.associations\.ttps\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.associations\.vulnerabilities\.\*\.id | string |
-action\_result\.data\.\*\.associations\.vulnerabilities\.\*\.name | string |
-action\_result\.data\.\*\.associations\.vulnerabilities\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.date | string |
-action\_result\.data\.\*\.date\_modified | string |
-action\_result\.data\.\*\.default\_comment | string |
-action\_result\.data\.\*\.email | string | `email`
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.fileName | string |
-action\_result\.data\.\*\.fileType | string |
-action\_result\.data\.\*\.file\_name\_label | string |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\_source | string | `url`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.jobID | string |
-action\_result\.data\.\*\.messages | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.notes | string |
-action\_result\.data\.\*\.numIndicators | numeric |
-action\_result\.data\.\*\.numRejected | numeric |
-action\_result\.data\.\*\.num\_private | numeric |
-action\_result\.data\.\*\.num\_public | numeric |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.orginal\_intelligence | string |
-action\_result\.data\.\*\.processed\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.created\_ts | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.end\_date | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.id | numeric |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.name | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.publication\_status | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.source\_created | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.source\_modified | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.start\_date | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.tlp | string |
-action\_result\.data\.\*\.remote\_associations\.incidents\.\*\.uuid | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.sandbox\_submit | string |
-action\_result\.data\.\*\.source\_confidence\_weight | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string | `threatstream tlp`
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.data\.\*\.visibleForReview | boolean |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.comment | string | |
+action_result.parameter.expire_time | string | `threatstream date` | 2022-01-03T18:30:00
+action_result.parameter.intelligence_source | string | | https://test.com
+action_result.parameter.item_id | numeric | `threatstream import session id` | 869
+action_result.parameter.tags | string | `threatstream tags` | test_tag_4
+action_result.parameter.threat_model_to_associate | string | |
+action_result.parameter.threat_model_type | string | |
+action_result.parameter.tlp | string | `threatstream tlp` | Green
+action_result.data.\*.approved_by.avatar_s3_url | string | |
+action_result.data.\*.approved_by.can_share_intelligence | boolean | | True False
+action_result.data.\*.approved_by.email | string | | qa+testuser2@test.data.com
+action_result.data.\*.approved_by.id | string | | 136
+action_result.data.\*.approved_by.is_active | boolean | | True False
+action_result.data.\*.approved_by.is_readonly | boolean | | True False
+action_result.data.\*.approved_by.must_change_password | boolean | | True False
+action_result.data.\*.approved_by.name | string | | testuser2
+action_result.data.\*.approved_by.nickname | string | |
+action_result.data.\*.approved_by.organization.id | string | | 67
+action_result.data.\*.approved_by.organization.name | string | | org.test.com
+action_result.data.\*.approved_by.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.approved_by.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.approved_by_id | numeric | |
+action_result.data.\*.associations.actors.\*.id | string | | 10909
+action_result.data.\*.associations.actors.\*.name | string | | MANDRA
+action_result.data.\*.associations.actors.\*.resource_uri | string | | /api/v1/actor/10909/
+action_result.data.\*.associations.incidents.\*.id | string | | 725
+action_result.data.\*.associations.incidents.\*.name | string | | Incident on Cloud
+action_result.data.\*.associations.incidents.\*.resource_uri | string | | /api/v1/incident/725/
+action_result.data.\*.associations.malware.\*.id | string | | 188
+action_result.data.\*.associations.malware.\*.name | string | | TestMal
+action_result.data.\*.associations.malware.\*.resource_uri | string | | /api/v1/malware/188/
+action_result.data.\*.associations.tip_reports.\*.id | string | | 9479
+action_result.data.\*.associations.tip_reports.\*.name | string | | Test 103
+action_result.data.\*.associations.tip_reports.\*.resource_uri | string | | /api/v1/tipreport/9479/
+action_result.data.\*.associations.ttps.\*.id | string | | 1573
+action_result.data.\*.associations.ttps.\*.name | string | | TestTTP
+action_result.data.\*.associations.ttps.\*.resource_uri | string | | /api/v1/ttp/1573/
+action_result.data.\*.associations.vulnerabilities.\*.id | string | | 15657
+action_result.data.\*.associations.vulnerabilities.\*.name | string | | TestVuln
+action_result.data.\*.associations.vulnerabilities.\*.resource_uri | string | | /api/v1/vulnerability/15657/
+action_result.data.\*.confidence | numeric | | 50
+action_result.data.\*.date | string | | 2020-10-06T05:53:45.585213
+action_result.data.\*.date_modified | string | | 2020-10-25T10:08:03.990333
+action_result.data.\*.default_comment | string | | this is a test comment
+action_result.data.\*.email | string | `email` | test@test.com
+action_result.data.\*.expiration_ts | string | | 2022-01-03T18:30:00
+action_result.data.\*.fileName | string | |
+action_result.data.\*.fileType | string | | analyst
+action_result.data.\*.file_name_label | string | |
+action_result.data.\*.id | numeric | | 869
+action_result.data.\*.intelligence_source | string | `url` | https://test.com
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.jobID | string | |
+action_result.data.\*.messages | string | |
+action_result.data.\*.name | string | | test
+action_result.data.\*.notes | string | |
+action_result.data.\*.numIndicators | numeric | | 1
+action_result.data.\*.numRejected | numeric | | 0
+action_result.data.\*.num_private | numeric | | 1
+action_result.data.\*.num_public | numeric | | 0
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.orginal_intelligence | string | | ['1000000138']
+action_result.data.\*.processed_ts | string | | 2020-10-06T05:53:45.907751
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.remote_associations.incidents.\*.assignee_user | string | |
+action_result.data.\*.remote_associations.incidents.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.remote_associations.incidents.\*.created_ts | string | | 2020-05-25T11:27:38.203866
+action_result.data.\*.remote_associations.incidents.\*.end_date | string | |
+action_result.data.\*.remote_associations.incidents.\*.feed_id | numeric | | 0
+action_result.data.\*.remote_associations.incidents.\*.id | numeric | | 730
+action_result.data.\*.remote_associations.incidents.\*.is_anonymous | boolean | | True False
+action_result.data.\*.remote_associations.incidents.\*.is_cloneable | string | | yes
+action_result.data.\*.remote_associations.incidents.\*.is_public | boolean | | True False
+action_result.data.\*.remote_associations.incidents.\*.modified_ts | string | | 2020-05-25T12:10:11.244851
+action_result.data.\*.remote_associations.incidents.\*.name | string | | Incident: public on-prem 2
+action_result.data.\*.remote_associations.incidents.\*.organization_id | numeric | | 67
+action_result.data.\*.remote_associations.incidents.\*.owner_user_id | numeric | | 136
+action_result.data.\*.remote_associations.incidents.\*.publication_status | string | | published
+action_result.data.\*.remote_associations.incidents.\*.published_ts | string | | 2020-05-25T12:10:11.129180
+action_result.data.\*.remote_associations.incidents.\*.remote_api | boolean | | True False
+action_result.data.\*.remote_associations.incidents.\*.resource_uri | string | | /api/v1/incident/730/?remote_api=true
+action_result.data.\*.remote_associations.incidents.\*.source_created | string | |
+action_result.data.\*.remote_associations.incidents.\*.source_modified | string | |
+action_result.data.\*.remote_associations.incidents.\*.start_date | string | |
+action_result.data.\*.remote_associations.incidents.\*.status.display_name | string | | New
+action_result.data.\*.remote_associations.incidents.\*.status.id | numeric | | 1
+action_result.data.\*.remote_associations.incidents.\*.status.resource_uri | string | | /api/v1/incidentstatustype/1/
+action_result.data.\*.remote_associations.incidents.\*.tlp | string | |
+action_result.data.\*.remote_associations.incidents.\*.uuid | string | | c46abbc8-9645-49ae-8da5-d85d805e0a57
+action_result.data.\*.resource_uri | string | | /api/v1/importsession/869/
+action_result.data.\*.sandbox_submit | string | |
+action_result.data.\*.source_confidence_weight | numeric | | 0
+action_result.data.\*.status | string | | done
+action_result.data.\*.tags.\*.id | string | | nak
+action_result.data.\*.tags.\*.name | string | | test_tag
+action_result.data.\*.tags.\*.org_id | numeric | | 70
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | `threatstream tlp` | white
+action_result.data.\*.threat_type | string | | malware
+action_result.data.\*.tlp | string | | Green
+action_result.data.\*.user_id | numeric | | 142
+action_result.data.\*.visibleForReview | boolean | | True False
+action_result.summary | string | |
+action_result.message | string | | Successfully updated ['expiration_ts', 'tlp', 'intelligence_source']. Successfully updated tags
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list threat models'
List all the threat models
@@ -2506,65 +2696,65 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**modified\_ts\_\_gte** | optional | Threat models with greater than or equal to the provided modified time stamp will be returned | string |
+**modified_ts__gte** | optional | Threat models with greater than or equal to the provided modified time stamp will be returned | string |
**limit** | optional | Total number of threat models to return | numeric |
-**model\_type** | optional | Model type to filter the records | string |
-**tags\_name** | optional | Tag name to filter the records | string | `threatstream tags`
-**publication\_status** | optional | Publication status to filter the records | string |
+**model_type** | optional | Model type to filter the records | string |
+**tags_name** | optional | Tag name to filter the records | string | `threatstream tags`
+**publication_status** | optional | Publication status to filter the records | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.model\_type | string |
-action\_result\.parameter\.modified\_ts\_\_gte | string |
-action\_result\.parameter\.publication\_status | string |
-action\_result\.parameter\.tags\_name | string | `threatstream tags`
-action\_result\.data\.\*\.aliases | string |
-action\_result\.data\.\*\.assignee\_user\.email | string |
-action\_result\.data\.\*\.assignee\_user\.id | numeric |
-action\_result\.data\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.circles\.\*\.id | numeric |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.cvss2\_score | string |
-action\_result\.data\.\*\.cvss3\_score | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.data\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.model\_type | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string | `email`
-action\_result\.data\.\*\.organization\.id | numeric |
-action\_result\.data\.\*\.organization\.title | string |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | numeric |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.sort | numeric |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.summary\.threat\_models\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 681
+action_result.parameter.model_type | string | | tipreport
+action_result.parameter.modified_ts__gte | string | |
+action_result.parameter.publication_status | string | | new
+action_result.parameter.tags_name | string | `threatstream tags` | test_tag
+action_result.data.\*.aliases | string | | test
+action_result.data.\*.assignee_user.email | string | | gita@verizon2.com
+action_result.data.\*.assignee_user.id | numeric | | 12
+action_result.data.\*.assignee_user.name | string | |
+action_result.data.\*.circles.\*.id | numeric | | 10017
+action_result.data.\*.circles.\*.name | string | | Test circle
+action_result.data.\*.circles.\*.remote_api | boolean | | True False
+action_result.data.\*.created_ts | string | | 2020-09-02T07:21:35.440102+00:00
+action_result.data.\*.cvss2_score | string | |
+action_result.data.\*.cvss3_score | string | |
+action_result.data.\*.end_date | string | |
+action_result.data.\*.feed_id | numeric | | 131
+action_result.data.\*.id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 9479
+action_result.data.\*.is_email | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.model_type | string | | tipreport
+action_result.data.\*.modified_ts | string | | 2020-10-06T12:06:53.021601+00:00
+action_result.data.\*.name | string | `email` | Test 103
+action_result.data.\*.organization.id | numeric | | 70
+action_result.data.\*.organization.title | string | | test
+action_result.data.\*.owner_user.email | string | `email` | test@test.com
+action_result.data.\*.owner_user.id | numeric | | 142
+action_result.data.\*.owner_user.name | string | | test
+action_result.data.\*.publication_status | string | | published
+action_result.data.\*.published_ts | string | | 2020-09-06T10:45:56.790629+00:00
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/tipreport/9479/
+action_result.data.\*.sort | numeric | | 1601966535004
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.start_date | string | |
+action_result.data.\*.status | string | |
+action_result.data.\*.tags.\*.id | string | | w4z
+action_result.data.\*.tags.\*.name | string | | tip-tag1
+action_result.data.\*.tags.\*.org_id | numeric | | 70
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.tlp | string | | white
+action_result.data.\*.type | string | | botnet
+action_result.data.\*.uuid | string | | 1f3f4c9e-9fb9-4914-b365-8bf3f17f8f76
+action_result.summary.threat_models_returned | numeric | | 681
+action_result.message | string | | Threat models returned: 681
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create threat bulletin'
Create a threat bulletin in ThreatStream
@@ -2572,7 +2762,7 @@ Create a threat bulletin in ThreatStream
Type: **generic**
Read only: **False**
-- Circles parameter will only be applicable when a threat bulletin will be created on the cloud\.
- If the body\_content\_type parameter is not provided, then the default value \(markdown\) will be considered as the value of the body\_content\_type parameter\. Once created, body\_content\_type cannot be modified\.
+- Circles parameter will only be applicable when a threat bulletin will be created on the cloud.
- If the body_content_type parameter is not provided, then the default value (markdown) will be considered as the value of the body_content_type parameter. Once created, body_content_type cannot be modified.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -2580,166 +2770,166 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**name** | required | Name to give the threat bulletin | string |
**status** | optional | Status to give the threat bulletin | string |
**source** | optional | Source of the threat bulletin | string |
-**tags** | optional | Comma\-separated list of tags for the threat bulletin | string |
+**tags** | optional | Comma-separated list of tags for the threat bulletin | string |
**tlp** | optional | Tlp to give the threat bulletin | string |
-**assignee\_user\_id** | optional | Assignee to give the threat bulletin | numeric |
+**assignee_user_id** | optional | Assignee to give the threat bulletin | numeric |
**body** | optional | Body content to give the threat bulletin | string |
-**body\_content\_type** | optional | Body content type to give the threat bulletin \(Once specified, body\_content\_type cannot be modified, Default is 'markdown'\) | string |
-**comments** | optional | Comments to give the threat bulletin\(JSON format containing body, title, etc\.\) | string |
+**body_content_type** | optional | Body content type to give the threat bulletin (Once specified, body_content_type cannot be modified, Default is 'markdown') | string |
+**comments** | optional | Comments to give the threat bulletin(JSON format containing body, title, etc.) | string |
**attachments** | optional | Vault id of an attachment to add on the threat bulletin | string | `vault id` `sha1`
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the threat bulletin \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the threat bulletin \- Note that this appends | string | `threatstream intelligence id`
-**circles** | optional | Comma\-separated list of circles to give the threat bulletin \(Applicable only when a cloud threat bulletin will be created\) | string |
-**import\_sessions** | optional | Comma\-separated list of sessions to give the threat bulletin | string |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
-**is\_public** | optional | Classification designation | boolean |
-**is\_anonymous** | optional | Whether the threat bulletin user and organization information is anonymized | boolean |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the threat bulletin - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the threat bulletin - Note that this appends | string | `threatstream intelligence id`
+**circles** | optional | Comma-separated list of circles to give the threat bulletin (Applicable only when a cloud threat bulletin will be created) | string |
+**import_sessions** | optional | Comma-separated list of sessions to give the threat bulletin | string |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
+**is_public** | optional | Classification designation | boolean |
+**is_anonymous** | optional | Whether the threat bulletin user and organization information is anonymized | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.assignee\_user\_id | numeric |
-action\_result\.parameter\.attachments | string | `vault id` `sha1`
-action\_result\.parameter\.body | string |
-action\_result\.parameter\.body\_content\_type | string |
-action\_result\.parameter\.circles | string |
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comments | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.import\_sessions | string |
-action\_result\.parameter\.is\_anonymous | boolean |
-action\_result\.parameter\.is\_public | boolean |
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.name | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.status | string |
-action\_result\.parameter\.tags | string |
-action\_result\.parameter\.tlp | string |
-action\_result\.data\.\*\.all\_circles\_visible | boolean |
-action\_result\.data\.\*\.assignee\_org | string |
-action\_result\.data\.\*\.assignee\_org\_id | string |
-action\_result\.data\.\*\.assignee\_org\_name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.assignee\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.assignee\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.assignee\_user\.email | string | `email`
-action\_result\.data\.\*\.assignee\_user\.id | string |
-action\_result\.data\.\*\.assignee\_user\.is\_active | boolean |
-action\_result\.data\.\*\.assignee\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.assignee\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.assignee\_user\.nickname | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.id | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.name | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\_id | numeric |
-action\_result\.data\.\*\.assignee\_user\_name | string |
-action\_result\.data\.\*\.attachments | string |
-action\_result\.data\.\*\.body | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaign | string |
-action\_result\.data\.\*\.comments\.body | string |
-action\_result\.data\.\*\.comments\.created\_ts | string |
-action\_result\.data\.\*\.comments\.id | string |
-action\_result\.data\.\*\.comments\.modified\_ts | string |
-action\_result\.data\.\*\.comments\.remote\_api | boolean |
-action\_result\.data\.\*\.comments\.tip\_report | numeric |
-action\_result\.data\.\*\.comments\.title | string |
-action\_result\.data\.\*\.comments\.tlp | string |
-action\_result\.data\.\*\.comments\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comments\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comments\.user\.email | string | `email`
-action\_result\.data\.\*\.comments\.user\.id | string |
-action\_result\.data\.\*\.comments\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comments\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comments\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comments\.user\.name | string |
-action\_result\.data\.\*\.comments\.user\.nickname | string |
-action\_result\.data\.\*\.comments\.user\.organization\.id | string |
-action\_result\.data\.\*\.comments\.user\.organization\.name | string |
-action\_result\.data\.\*\.comments\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.user\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.history\.\*\.action | string |
-action\_result\.data\.\*\.history\.\*\.detail | string |
-action\_result\.data\.\*\.history\.\*\.id | string |
-action\_result\.data\.\*\.history\.\*\.quantity | string |
-action\_result\.data\.\*\.history\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.history\.\*\.tip\_report | numeric |
-action\_result\.data\.\*\.history\.\*\.ts | string |
-action\_result\.data\.\*\.history\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.history\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.email | string | `email`
-action\_result\.data\.\*\.history\.\*\.user\.id | string |
-action\_result\.data\.\*\.history\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.name | string |
-action\_result\.data\.\*\.history\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.history\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.id | string | `threatstream threatbulletin id`
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.original\_source | string |
-action\_result\.data\.\*\.original\_source\_id | string |
-action\_result\.data\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\_id | numeric |
-action\_result\.data\.\*\.owner\_org\_name | string |
-action\_result\.data\.\*\.owner\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.owner\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.is\_active | boolean |
-action\_result\.data\.\*\.owner\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.owner\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.nickname | string |
-action\_result\.data\.\*\.owner\_user\.organization\.id | string |
-action\_result\.data\.\*\.owner\_user\.organization\.name | string |
-action\_result\.data\.\*\.owner\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.owner\_user\_name | string |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.private\_status\_id | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.threat\_actor | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.assignee_user_id | numeric | | 22
+action_result.parameter.attachments | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.body | string | | test body
+action_result.parameter.body_content_type | string | | richtext
+action_result.parameter.circles | string | | 10022,10020
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` | 229717444
+action_result.parameter.comments | string | | {"body":"test comment1","title":"test comment2"}
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.import_sessions | string | | 10899,170994
+action_result.parameter.is_anonymous | boolean | | True False
+action_result.parameter.is_public | boolean | | True False
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` | 1000000298
+action_result.parameter.name | string | | test name
+action_result.parameter.source | string | | test source
+action_result.parameter.status | string | | new
+action_result.parameter.tags | string | | test tag1, test tag2
+action_result.parameter.tlp | string | | amber
+action_result.data.\*.all_circles_visible | boolean | | True False
+action_result.data.\*.assignee_org | string | |
+action_result.data.\*.assignee_org_id | string | |
+action_result.data.\*.assignee_org_name | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.assignee_user.avatar_s3_url | string | |
+action_result.data.\*.assignee_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.assignee_user.email | string | `email` | mark@domaintools.com
+action_result.data.\*.assignee_user.id | string | | 22
+action_result.data.\*.assignee_user.is_active | boolean | | True False
+action_result.data.\*.assignee_user.is_readonly | boolean | | True False
+action_result.data.\*.assignee_user.must_change_password | boolean | | True False
+action_result.data.\*.assignee_user.name | string | |
+action_result.data.\*.assignee_user.nickname | string | |
+action_result.data.\*.assignee_user.organization.id | string | | 11
+action_result.data.\*.assignee_user.organization.name | string | | DomainTools
+action_result.data.\*.assignee_user.organization.resource_uri | string | | /api/v1/userorganization/11/
+action_result.data.\*.assignee_user.resource_uri | string | | /api/v1/user/22/
+action_result.data.\*.assignee_user_id | numeric | | 22
+action_result.data.\*.assignee_user_name | string | |
+action_result.data.\*.attachments | string | | id
+action_result.data.\*.body | string | | test body
+action_result.data.\*.body_content_type | string | | richtext
+action_result.data.\*.campaign | string | |
+action_result.data.\*.comments.body | string | | test comment1
+action_result.data.\*.comments.created_ts | string | | 2021-04-06T08:09:33.924401
+action_result.data.\*.comments.id | string | | 57
+action_result.data.\*.comments.modified_ts | string | | 2021-04-06T08:09:33.924401
+action_result.data.\*.comments.remote_api | boolean | | True False
+action_result.data.\*.comments.tip_report | numeric | | 10890
+action_result.data.\*.comments.title | string | | test comment2
+action_result.data.\*.comments.tlp | string | | red
+action_result.data.\*.comments.user.avatar_s3_url | string | |
+action_result.data.\*.comments.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comments.user.email | string | `email` | test@testuser.com
+action_result.data.\*.comments.user.id | string | | 136
+action_result.data.\*.comments.user.is_active | boolean | | True False
+action_result.data.\*.comments.user.is_readonly | boolean | | True False
+action_result.data.\*.comments.user.must_change_password | boolean | | True False
+action_result.data.\*.comments.user.name | string | | testuser2
+action_result.data.\*.comments.user.nickname | string | |
+action_result.data.\*.comments.user.organization.id | string | | 67
+action_result.data.\*.comments.user.organization.name | string | | test.org.com
+action_result.data.\*.comments.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.comments.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.created_ts | string | | 2021-04-06T08:09:31.778085
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.history.\*.action | string | | created-report
+action_result.data.\*.history.\*.detail | string | |
+action_result.data.\*.history.\*.id | string | | 33822
+action_result.data.\*.history.\*.quantity | string | |
+action_result.data.\*.history.\*.remote_api | boolean | | True False
+action_result.data.\*.history.\*.tip_report | numeric | | 10890
+action_result.data.\*.history.\*.ts | string | | 2021-04-06T08:09:31.778085
+action_result.data.\*.history.\*.user.avatar_s3_url | string | |
+action_result.data.\*.history.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.history.\*.user.email | string | `email` | test@testuser.com
+action_result.data.\*.history.\*.user.id | string | | 136
+action_result.data.\*.history.\*.user.is_active | boolean | | True False
+action_result.data.\*.history.\*.user.is_readonly | boolean | | True False
+action_result.data.\*.history.\*.user.must_change_password | boolean | | True False
+action_result.data.\*.history.\*.user.name | string | | testuser2
+action_result.data.\*.history.\*.user.nickname | string | |
+action_result.data.\*.history.\*.user.organization.id | string | | 67
+action_result.data.\*.history.\*.user.organization.name | string | | test.org.com
+action_result.data.\*.history.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.history.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.id | string | `threatstream threatbulletin id` | 10890
+action_result.data.\*.intelligence.\*.id | numeric | | 229717582
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_email | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2021-04-06T08:09:31.801690
+action_result.data.\*.name | string | | test name
+action_result.data.\*.original_source | string | |
+action_result.data.\*.original_source_id | string | |
+action_result.data.\*.owner_org.id | string | | 67
+action_result.data.\*.owner_org.name | string | | test.org.com
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_org_id | numeric | | 67
+action_result.data.\*.owner_org_name | string | | test.org.com
+action_result.data.\*.owner_user.avatar_s3_url | string | |
+action_result.data.\*.owner_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.owner_user.email | string | `email` | test@testuser.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.is_active | boolean | | True False
+action_result.data.\*.owner_user.is_readonly | boolean | | True False
+action_result.data.\*.owner_user.must_change_password | boolean | | True False
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.nickname | string | |
+action_result.data.\*.owner_user.organization.id | string | | 67
+action_result.data.\*.owner_user.organization.name | string | | test.org.com
+action_result.data.\*.owner_user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.owner_user_name | string | | testuser2
+action_result.data.\*.parent | string | |
+action_result.data.\*.private_status_id | string | |
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/tipreport/10890/?remote_api=true
+action_result.data.\*.source | string | | test source
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.status | string | | new
+action_result.data.\*.threat_actor | string | |
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.ttp | string | |
+action_result.data.\*.uuid | string | | 3c566c79-e3c5-4c02-bb8c-acff8182b100
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Threat bulletin created successfully. Associated intelligence : 229717582, 229717444, 1000000298, 1000000001
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update threat bulletin'
Update a threat bulletin in ThreatStream
@@ -2747,7 +2937,7 @@ Update a threat bulletin in ThreatStream
Type: **generic**
Read only: **False**
-Circles parameter will only be applicable when a cloud threat bulletin will be updated\.
+Circles parameter will only be applicable when a cloud threat bulletin will be updated.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -2755,230 +2945,230 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**id** | required | ID of the threat bulletin | string | `threatstream threatbulletin id`
**status** | optional | Status to give the threat bulletin | string |
**source** | optional | Source of the threat bulletin | string |
-**tags** | optional | Comma\-separated list of tags for the threat bulletin | string |
+**tags** | optional | Comma-separated list of tags for the threat bulletin | string |
**tlp** | optional | Tlp to give the threat bulletin | string |
-**assignee\_user\_id** | optional | Assignee to give the threat bulletin | numeric |
+**assignee_user_id** | optional | Assignee to give the threat bulletin | numeric |
**body** | optional | Body content to give the threat bulletin | string |
-**comments** | optional | Comments to give the threat bulletin\(JSON format containing body, title, etc\.\) | string |
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the threat bulletin \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the threat bulletin \- Note that this appends | string | `threatstream intelligence id`
+**comments** | optional | Comments to give the threat bulletin(JSON format containing body, title, etc.) | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the threat bulletin - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the threat bulletin - Note that this appends | string | `threatstream intelligence id`
**attachments** | optional | Vault id of an attachment to add on the threat bulletin | string | `vault id` `sha1`
-**circles** | optional | Comma\-separated list of circles to give the threat bulletin \(Applicable only when a cloud threat bulletin will be updated\) | string |
-**import\_sessions** | optional | Comma\-separated list of sessions to give the threat bulletin | string |
-**is\_public** | optional | Classification designation | boolean |
-**is\_anonymous** | optional | Whether the threat bulletin user and organization information is anonymized | boolean |
+**circles** | optional | Comma-separated list of circles to give the threat bulletin (Applicable only when a cloud threat bulletin will be updated) | string |
+**import_sessions** | optional | Comma-separated list of sessions to give the threat bulletin | string |
+**is_public** | optional | Classification designation | boolean |
+**is_anonymous** | optional | Whether the threat bulletin user and organization information is anonymized | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.assignee\_user\_id | numeric |
-action\_result\.parameter\.attachments | string | `vault id` `sha1`
-action\_result\.parameter\.body | string |
-action\_result\.parameter\.circles | string |
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comments | string |
-action\_result\.parameter\.id | string | `threatstream threatbulletin id`
-action\_result\.parameter\.import\_sessions | string |
-action\_result\.parameter\.is\_anonymous | boolean |
-action\_result\.parameter\.is\_public | boolean |
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.status | string |
-action\_result\.parameter\.tags | string |
-action\_result\.parameter\.tlp | string |
-action\_result\.data\.\*\.all\_circles\_visible | boolean |
-action\_result\.data\.\*\.assignee\_org | string |
-action\_result\.data\.\*\.assignee\_org\_id | string |
-action\_result\.data\.\*\.assignee\_org\_name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.assignee\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.assignee\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.assignee\_user\.email | string |
-action\_result\.data\.\*\.assignee\_user\.id | string |
-action\_result\.data\.\*\.assignee\_user\.is\_active | boolean |
-action\_result\.data\.\*\.assignee\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.assignee\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.assignee\_user\.nickname | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.id | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.name | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\_id | string |
-action\_result\.data\.\*\.assignee\_user\_name | string |
-action\_result\.data\.\*\.attachments\.\*\.content\_type | string |
-action\_result\.data\.\*\.attachments\.\*\.created\_ts | string |
-action\_result\.data\.\*\.attachments\.\*\.filename | string |
-action\_result\.data\.\*\.attachments\.\*\.id | string |
-action\_result\.data\.\*\.attachments\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.attachments\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.\*\.s3\_thumbnail\_url | string |
-action\_result\.data\.\*\.attachments\.\*\.s3\_url | string |
-action\_result\.data\.\*\.attachments\.\*\.signed\_thumbnail\_url | string |
-action\_result\.data\.\*\.attachments\.\*\.signed\_url | string |
-action\_result\.data\.\*\.attachments\.\*\.tip\_report | numeric |
-action\_result\.data\.\*\.attachments\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.attachments\.\*\.user\.email | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.id | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.attachments\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.attachments\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.attachments\.\*\.user\.name | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.content\_type | string |
-action\_result\.data\.\*\.attachments\.created\_ts | string |
-action\_result\.data\.\*\.attachments\.filename | string |
-action\_result\.data\.\*\.attachments\.id | string |
-action\_result\.data\.\*\.attachments\.modified\_ts | string |
-action\_result\.data\.\*\.attachments\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.s3\_thumbnail\_url | string |
-action\_result\.data\.\*\.attachments\.s3\_url | string | `url`
-action\_result\.data\.\*\.attachments\.signed\_thumbnail\_url | string |
-action\_result\.data\.\*\.attachments\.signed\_url | string | `url`
-action\_result\.data\.\*\.attachments\.tip\_report | numeric |
-action\_result\.data\.\*\.attachments\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.attachments\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.attachments\.user\.email | string | `email`
-action\_result\.data\.\*\.attachments\.user\.id | string |
-action\_result\.data\.\*\.attachments\.user\.is\_active | boolean |
-action\_result\.data\.\*\.attachments\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.attachments\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.attachments\.user\.name | string |
-action\_result\.data\.\*\.attachments\.user\.nickname | string |
-action\_result\.data\.\*\.attachments\.user\.organization\.id | string |
-action\_result\.data\.\*\.attachments\.user\.organization\.name | string |
-action\_result\.data\.\*\.attachments\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.user\.resource\_uri | string |
-action\_result\.data\.\*\.body | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaign | string |
-action\_result\.data\.\*\.comments\.\*\.body | string |
-action\_result\.data\.\*\.comments\.\*\.created\_ts | string |
-action\_result\.data\.\*\.comments\.\*\.id | string |
-action\_result\.data\.\*\.comments\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.comments\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.comments\.\*\.tip\_report | numeric |
-action\_result\.data\.\*\.comments\.\*\.title | string |
-action\_result\.data\.\*\.comments\.\*\.tlp | string |
-action\_result\.data\.\*\.comments\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comments\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comments\.\*\.user\.email | string |
-action\_result\.data\.\*\.comments\.\*\.user\.id | string |
-action\_result\.data\.\*\.comments\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comments\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comments\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comments\.\*\.user\.name | string |
-action\_result\.data\.\*\.comments\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.comments\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.comments\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.comments\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.body | string |
-action\_result\.data\.\*\.comments\.created\_ts | string |
-action\_result\.data\.\*\.comments\.id | string |
-action\_result\.data\.\*\.comments\.modified\_ts | string |
-action\_result\.data\.\*\.comments\.remote\_api | boolean |
-action\_result\.data\.\*\.comments\.tip\_report | numeric |
-action\_result\.data\.\*\.comments\.title | string |
-action\_result\.data\.\*\.comments\.tlp | string |
-action\_result\.data\.\*\.comments\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comments\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comments\.user\.email | string | `email`
-action\_result\.data\.\*\.comments\.user\.id | string |
-action\_result\.data\.\*\.comments\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comments\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comments\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comments\.user\.name | string |
-action\_result\.data\.\*\.comments\.user\.nickname | string |
-action\_result\.data\.\*\.comments\.user\.organization\.id | string |
-action\_result\.data\.\*\.comments\.user\.organization\.name | string |
-action\_result\.data\.\*\.comments\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.user\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | string |
-action\_result\.data\.\*\.history\.\*\.action | string |
-action\_result\.data\.\*\.history\.\*\.detail | string |
-action\_result\.data\.\*\.history\.\*\.id | string |
-action\_result\.data\.\*\.history\.\*\.quantity | string |
-action\_result\.data\.\*\.history\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.history\.\*\.tip\_report | numeric |
-action\_result\.data\.\*\.history\.\*\.ts | string |
-action\_result\.data\.\*\.history\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.history\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.email | string | `email`
-action\_result\.data\.\*\.history\.\*\.user\.id | string |
-action\_result\.data\.\*\.history\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.history\.\*\.user\.name | string |
-action\_result\.data\.\*\.history\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.history\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.history\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.id | string | `threatstream threatbulletin id`
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.original\_source | string |
-action\_result\.data\.\*\.original\_source\_id | string |
-action\_result\.data\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\_id | numeric |
-action\_result\.data\.\*\.owner\_org\_name | string |
-action\_result\.data\.\*\.owner\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.owner\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.is\_active | boolean |
-action\_result\.data\.\*\.owner\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.owner\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.nickname | string |
-action\_result\.data\.\*\.owner\_user\.organization\.id | string |
-action\_result\.data\.\*\.owner\_user\.organization\.name | string |
-action\_result\.data\.\*\.owner\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.owner\_user\_name | string |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.private\_status\_id | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.threat\_actor | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.assignee_user_id | numeric | | 10
+action_result.parameter.attachments | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.body | string | | test body
+action_result.parameter.circles | string | | 10022,10020
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` | 229717444
+action_result.parameter.comments | string | | {"body":"test comment","title":"test comment"}
+action_result.parameter.id | string | `threatstream threatbulletin id` | 1000000014
+action_result.parameter.import_sessions | string | | 10899,170994
+action_result.parameter.is_anonymous | boolean | | True False
+action_result.parameter.is_public | boolean | | True False
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` | 1000000298
+action_result.parameter.source | string | | test source
+action_result.parameter.status | string | | published
+action_result.parameter.tags | string | | test tag
+action_result.parameter.tlp | string | | red
+action_result.data.\*.all_circles_visible | boolean | | True False
+action_result.data.\*.assignee_org | string | |
+action_result.data.\*.assignee_org_id | string | |
+action_result.data.\*.assignee_org_name | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.assignee_user.avatar_s3_url | string | |
+action_result.data.\*.assignee_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.assignee_user.email | string | | admin-idefense@idefense.com
+action_result.data.\*.assignee_user.id | string | | 44
+action_result.data.\*.assignee_user.is_active | boolean | | True False
+action_result.data.\*.assignee_user.is_readonly | boolean | | True False
+action_result.data.\*.assignee_user.must_change_password | boolean | | True False
+action_result.data.\*.assignee_user.name | string | |
+action_result.data.\*.assignee_user.nickname | string | |
+action_result.data.\*.assignee_user.organization.id | string | | 20
+action_result.data.\*.assignee_user.organization.name | string | | iDefense
+action_result.data.\*.assignee_user.organization.resource_uri | string | | /api/v1/userorganization/20/
+action_result.data.\*.assignee_user.resource_uri | string | | /api/v1/user/44/
+action_result.data.\*.assignee_user_id | string | |
+action_result.data.\*.assignee_user_name | string | |
+action_result.data.\*.attachments.\*.content_type | string | |
+action_result.data.\*.attachments.\*.created_ts | string | | 2021-03-26T10:31:45.712609
+action_result.data.\*.attachments.\*.filename | string | | abcd.txt
+action_result.data.\*.attachments.\*.id | string | | 9001
+action_result.data.\*.attachments.\*.modified_ts | string | | 2021-03-26T10:31:45.712609
+action_result.data.\*.attachments.\*.remote_api | boolean | | True False
+action_result.data.\*.attachments.\*.s3_thumbnail_url | string | |
+action_result.data.\*.attachments.\*.s3_url | string | | http://ui-threatstream.s3.test.com/userUploads/2021-03-26/20210326_103145_userId-136_abcd.txt
+action_result.data.\*.attachments.\*.signed_thumbnail_url | string | |
+action_result.data.\*.attachments.\*.signed_url | string | | https://test-optic.s3.ui.com/userUploads/2021-03-26/20210326_103145_userId-136_abcd.txt?Signature=p5I5tJOrB242TAOSA39eYxL7dr4%3D&Expires=1616756070&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.attachments.\*.tip_report | numeric | | 10787
+action_result.data.\*.attachments.\*.user.avatar_s3_url | string | |
+action_result.data.\*.attachments.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.attachments.\*.user.email | string | | testuser2@test.user.com
+action_result.data.\*.attachments.\*.user.id | string | | 136
+action_result.data.\*.attachments.\*.user.is_active | boolean | | True False
+action_result.data.\*.attachments.\*.user.is_readonly | boolean | | True False
+action_result.data.\*.attachments.\*.user.must_change_password | boolean | | True False
+action_result.data.\*.attachments.\*.user.name | string | | testuser2
+action_result.data.\*.attachments.\*.user.nickname | string | |
+action_result.data.\*.attachments.\*.user.organization.id | string | | 67
+action_result.data.\*.attachments.\*.user.organization.name | string | | test.user.com
+action_result.data.\*.attachments.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.attachments.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.attachments.content_type | string | | application/octet-stream
+action_result.data.\*.attachments.created_ts | string | | 2021-04-06T08:02:48.025223
+action_result.data.\*.attachments.filename | string | | Bien sûr.rtf
+action_result.data.\*.attachments.id | string | | 1000000009
+action_result.data.\*.attachments.modified_ts | string | | 2021-04-06T08:02:48.025223
+action_result.data.\*.attachments.remote_api | boolean | | True False
+action_result.data.\*.attachments.s3_thumbnail_url | string | |
+action_result.data.\*.attachments.s3_url | string | `url` | http://52.52.79.127/ts-optic-appliance/userUploads/2021-04-06/20210406_080247_userId-136_Biensur.rtf
+action_result.data.\*.attachments.signed_thumbnail_url | string | |
+action_result.data.\*.attachments.signed_url | string | `url` | https://52.52.79.127/ts-optic-appliance/userUploads/2021-04-06/20210406_080247_userId-136_Biensur.rtf?Signature=x8Yz2TkHXGvo616DTDC5ngO%2F740%3D&Expires=1617697068&AWSAccessKeyId=MKL12IRRH2NRCOHN7QB0
+action_result.data.\*.attachments.tip_report | numeric | | 1000000014
+action_result.data.\*.attachments.user.avatar_s3_url | string | |
+action_result.data.\*.attachments.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.attachments.user.email | string | `email` | test@testuser.com
+action_result.data.\*.attachments.user.id | string | | 136
+action_result.data.\*.attachments.user.is_active | boolean | | True False
+action_result.data.\*.attachments.user.is_readonly | boolean | | True False
+action_result.data.\*.attachments.user.must_change_password | boolean | | True False
+action_result.data.\*.attachments.user.name | string | | testuser2
+action_result.data.\*.attachments.user.nickname | string | |
+action_result.data.\*.attachments.user.organization.id | string | | 67
+action_result.data.\*.attachments.user.organization.name | string | | test.org.com
+action_result.data.\*.attachments.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.attachments.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.body | string | | test body
+action_result.data.\*.body_content_type | string | | richtext
+action_result.data.\*.campaign | string | |
+action_result.data.\*.comments.\*.body | string | | test123
+action_result.data.\*.comments.\*.created_ts | string | | 2021-03-26T10:31:46.122309
+action_result.data.\*.comments.\*.id | string | | 33
+action_result.data.\*.comments.\*.modified_ts | string | | 2021-03-26T10:31:46.173656
+action_result.data.\*.comments.\*.remote_api | boolean | | True False
+action_result.data.\*.comments.\*.tip_report | numeric | | 10787
+action_result.data.\*.comments.\*.title | string | | test123
+action_result.data.\*.comments.\*.tlp | string | |
+action_result.data.\*.comments.\*.user.avatar_s3_url | string | |
+action_result.data.\*.comments.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comments.\*.user.email | string | | testuser2@test.user.com
+action_result.data.\*.comments.\*.user.id | string | | 136
+action_result.data.\*.comments.\*.user.is_active | boolean | | True False
+action_result.data.\*.comments.\*.user.is_readonly | boolean | | True False
+action_result.data.\*.comments.\*.user.must_change_password | boolean | | True False
+action_result.data.\*.comments.\*.user.name | string | | testuser2
+action_result.data.\*.comments.\*.user.nickname | string | |
+action_result.data.\*.comments.\*.user.organization.id | string | | 67
+action_result.data.\*.comments.\*.user.organization.name | string | | test.user.com
+action_result.data.\*.comments.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.comments.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.comments.body | string | | test comment
+action_result.data.\*.comments.created_ts | string | | 2021-04-06T08:02:48.184466
+action_result.data.\*.comments.id | string | | 1000000014
+action_result.data.\*.comments.modified_ts | string | | 2021-04-06T08:02:48.184466
+action_result.data.\*.comments.remote_api | boolean | | True False
+action_result.data.\*.comments.tip_report | numeric | | 1000000014
+action_result.data.\*.comments.title | string | | test comment
+action_result.data.\*.comments.tlp | string | | red
+action_result.data.\*.comments.user.avatar_s3_url | string | |
+action_result.data.\*.comments.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comments.user.email | string | `email` | test@testuser.com
+action_result.data.\*.comments.user.id | string | | 136
+action_result.data.\*.comments.user.is_active | boolean | | True False
+action_result.data.\*.comments.user.is_readonly | boolean | | True False
+action_result.data.\*.comments.user.must_change_password | boolean | | True False
+action_result.data.\*.comments.user.name | string | | testuser2
+action_result.data.\*.comments.user.nickname | string | |
+action_result.data.\*.comments.user.organization.id | string | | 67
+action_result.data.\*.comments.user.organization.name | string | | test.org.com
+action_result.data.\*.comments.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.comments.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.created_ts | string | | 2021-03-30T06:02:14.276627
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | string | | 0
+action_result.data.\*.history.\*.action | string | | updated-report
+action_result.data.\*.history.\*.detail | string | |
+action_result.data.\*.history.\*.id | string | | 1000000078
+action_result.data.\*.history.\*.quantity | string | |
+action_result.data.\*.history.\*.remote_api | boolean | | True False
+action_result.data.\*.history.\*.tip_report | numeric | | 1000000014
+action_result.data.\*.history.\*.ts | string | | 2021-04-06T08:02:47.206202
+action_result.data.\*.history.\*.user.avatar_s3_url | string | |
+action_result.data.\*.history.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.history.\*.user.email | string | `email` | test@testuser.com
+action_result.data.\*.history.\*.user.id | string | | 136
+action_result.data.\*.history.\*.user.is_active | boolean | | True False
+action_result.data.\*.history.\*.user.is_readonly | boolean | | True False
+action_result.data.\*.history.\*.user.must_change_password | boolean | | True False
+action_result.data.\*.history.\*.user.name | string | | testuser2
+action_result.data.\*.history.\*.user.nickname | string | |
+action_result.data.\*.history.\*.user.organization.id | string | | 67
+action_result.data.\*.history.\*.user.organization.name | string | | test.org.com
+action_result.data.\*.history.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.history.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.id | string | `threatstream threatbulletin id` | 1000000014
+action_result.data.\*.intelligence.\*.id | numeric | | 1000000001
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_email | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2021-04-06T08:02:47.133081
+action_result.data.\*.name | string | | 1
+action_result.data.\*.original_source | string | |
+action_result.data.\*.original_source_id | string | |
+action_result.data.\*.owner_org.id | string | | 67
+action_result.data.\*.owner_org.name | string | | test.org.com
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_org_id | numeric | | 67
+action_result.data.\*.owner_org_name | string | | test.org.com
+action_result.data.\*.owner_user.avatar_s3_url | string | |
+action_result.data.\*.owner_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.owner_user.email | string | `email` | test@testuser.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.is_active | boolean | | True False
+action_result.data.\*.owner_user.is_readonly | boolean | | True False
+action_result.data.\*.owner_user.must_change_password | boolean | | True False
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.nickname | string | |
+action_result.data.\*.owner_user.organization.id | string | | 67
+action_result.data.\*.owner_user.organization.name | string | | test.org.com
+action_result.data.\*.owner_user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.owner_user_name | string | | testuser2
+action_result.data.\*.parent | string | |
+action_result.data.\*.private_status_id | string | |
+action_result.data.\*.published_ts | string | | 2021-04-06T08:02:47.079317
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/tipreport/1000000014/
+action_result.data.\*.source | string | | test source
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.status | string | | published
+action_result.data.\*.threat_actor | string | |
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.ttp | string | |
+action_result.data.\*.uuid | string | | d4027da6-c694-4b22-8396-e43154331eb0
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully updated threat bulletin. Associated intelligence : 1000000298, 1000000001, 229717582, 229717444
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list threat bulletins'
List threat bulletins present in ThreatStream
@@ -2986,7 +3176,7 @@ List threat bulletins present in ThreatStream
Type: **investigate**
Read only: **True**
-- This action will list the threat bulletins in oldest first format\.
- is\_public parameter will only be applicable as filter when its value will be set to "true" or "false"\. It wont be applied as a filter and will list all the threat bulletins when the value of is\_public parameter is set to "all"\.
+- This action will list the threat bulletins in oldest first format.
- is_public parameter will only be applicable as filter when its value will be set to "true" or "false". It wont be applied as a filter and will list all the threat bulletins when the value of is_public parameter is set to "all".
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -2995,208 +3185,208 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**name** | optional | Name to filter the threat bulletins | string |
**status** | optional | Status to filter the threat bulletins | string |
**source** | optional | Source to filter the threat bulletins | string |
-**assignee\_user\_id** | optional | Assignee to filter the threat bulletins | numeric |
-**is\_public** | optional | Classification designation | string |
+**assignee_user_id** | optional | Assignee to filter the threat bulletins | numeric |
+**is_public** | optional | Classification designation | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.assignee\_user\_id | numeric |
-action\_result\.parameter\.is\_public | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.name | string |
-action\_result\.parameter\.source | string |
-action\_result\.parameter\.status | string |
-action\_result\.data\.\*\.\*\.all\_circles\_visible | boolean |
-action\_result\.data\.\*\.\*\.assignee\_org | string |
-action\_result\.data\.\*\.\*\.assignee\_org\_id | string |
-action\_result\.data\.\*\.\*\.assignee\_org\_name | string |
-action\_result\.data\.\*\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.\*\.assignee\_user\.email | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.id | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.is\_active | boolean |
-action\_result\.data\.\*\.\*\.assignee\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.\*\.assignee\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.nickname | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.organization\.id | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.organization\.name | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.assignee\_user\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.assignee\_user\_id | numeric |
-action\_result\.data\.\*\.\*\.assignee\_user\_name | string |
-action\_result\.data\.\*\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.\*\.campaign | string |
-action\_result\.data\.\*\.\*\.can\_add\_public\_tags | string |
-action\_result\.data\.\*\.\*\.created\_ts | string |
-action\_result\.data\.\*\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.\*\.id | string |
-action\_result\.data\.\*\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.\*\.name | string |
-action\_result\.data\.\*\.\*\.original\_source | string |
-action\_result\.data\.\*\.\*\.original\_source\_id | string |
-action\_result\.data\.\*\.\*\.owner\_org | string |
-action\_result\.data\.\*\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.owner\_org\.title | string |
-action\_result\.data\.\*\.\*\.owner\_org\_id | string |
-action\_result\.data\.\*\.\*\.owner\_org\_name | string |
-action\_result\.data\.\*\.\*\.owner\_user | string |
-action\_result\.data\.\*\.\*\.owner\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.\*\.owner\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.\*\.owner\_user\.email | string |
-action\_result\.data\.\*\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.\*\.owner\_user\.is\_active | boolean |
-action\_result\.data\.\*\.\*\.owner\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.\*\.owner\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.\*\.owner\_user\.nickname | string |
-action\_result\.data\.\*\.\*\.owner\_user\.organization\.id | string |
-action\_result\.data\.\*\.\*\.owner\_user\.organization\.name | string |
-action\_result\.data\.\*\.\*\.owner\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.owner\_user\_id | string |
-action\_result\.data\.\*\.\*\.owner\_user\_name | string |
-action\_result\.data\.\*\.\*\.parent | string |
-action\_result\.data\.\*\.\*\.published\_ts | string |
-action\_result\.data\.\*\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.\*\.source | string |
-action\_result\.data\.\*\.\*\.source\_created | string |
-action\_result\.data\.\*\.\*\.source\_modified | string |
-action\_result\.data\.\*\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.\*\.status | string |
-action\_result\.data\.\*\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.\*\.threat\_actor | string |
-action\_result\.data\.\*\.\*\.tlp | string |
-action\_result\.data\.\*\.\*\.ttp | string |
-action\_result\.data\.\*\.\*\.uuid | string |
-action\_result\.data\.\*\.\*\.votes\.me | string |
-action\_result\.data\.\*\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.\*\.watched\_total\_count | numeric |
-action\_result\.data\.\*\.all\_circles\_visible | boolean |
-action\_result\.data\.\*\.assignee\_org | string |
-action\_result\.data\.\*\.assignee\_org\_id | string |
-action\_result\.data\.\*\.assignee\_org\_name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.assignee\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.assignee\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.assignee\_user\.email | string | `email`
-action\_result\.data\.\*\.assignee\_user\.id | string |
-action\_result\.data\.\*\.assignee\_user\.is\_active | boolean |
-action\_result\.data\.\*\.assignee\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.assignee\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.assignee\_user\.nickname | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.id | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.name | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\_id | numeric |
-action\_result\.data\.\*\.assignee\_user\_name | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaign | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.anonymous\_sharing | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_edit | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_invite | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_override\_confidence | boolean |
-action\_result\.data\.\*\.circles\.\*\.description | string |
-action\_result\.data\.\*\.circles\.\*\.disable\_vendor\_emails | string |
-action\_result\.data\.\*\.circles\.\*\.id | numeric |
-action\_result\.data\.\*\.circles\.\*\.is\_freemium | boolean |
-action\_result\.data\.\*\.circles\.\*\.mattermost\_team\_id | string |
-action\_result\.data\.\*\.circles\.\*\.member | boolean |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.num\_administrators | numeric |
-action\_result\.data\.\*\.circles\.\*\.num\_members | numeric |
-action\_result\.data\.\*\.circles\.\*\.openinvite | boolean |
-action\_result\.data\.\*\.circles\.\*\.pending | boolean |
-action\_result\.data\.\*\.circles\.\*\.public | boolean |
-action\_result\.data\.\*\.circles\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.circles\.\*\.restricted\_publishing | boolean |
-action\_result\.data\.\*\.circles\.\*\.subscription\_model | string |
-action\_result\.data\.\*\.circles\.\*\.use\_chat | boolean |
-action\_result\.data\.\*\.circles\.\*\.validate\_subscriptions | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | string | `threatstream threatbulletin id`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.original\_source | string |
-action\_result\.data\.\*\.original\_source\_id | string |
-action\_result\.data\.\*\.owner\_org | string |
-action\_result\.data\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\.title | string |
-action\_result\.data\.\*\.owner\_org\_id | numeric |
-action\_result\.data\.\*\.owner\_org\_name | string |
-action\_result\.data\.\*\.owner\_user | string |
-action\_result\.data\.\*\.owner\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.owner\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.is\_active | boolean |
-action\_result\.data\.\*\.owner\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.owner\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.nickname | string |
-action\_result\.data\.\*\.owner\_user\.organization\.id | string |
-action\_result\.data\.\*\.owner\_user\.organization\.name | string |
-action\_result\.data\.\*\.owner\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.owner\_user\_name | string |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_actor | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttp | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.threat\_bulletins\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.assignee_user_id | numeric | | 22
+action_result.parameter.is_public | string | | true false all
+action_result.parameter.limit | numeric | | 1000
+action_result.parameter.name | string | | test name
+action_result.parameter.source | string | | test source
+action_result.parameter.status | string | | new
+action_result.data.\*.\*.all_circles_visible | boolean | | True False
+action_result.data.\*.\*.assignee_org | string | |
+action_result.data.\*.\*.assignee_org_id | string | |
+action_result.data.\*.\*.assignee_org_name | string | |
+action_result.data.\*.\*.assignee_user | string | |
+action_result.data.\*.\*.assignee_user.avatar_s3_url | string | |
+action_result.data.\*.\*.assignee_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.\*.assignee_user.email | string | | tkng@anomali.com
+action_result.data.\*.\*.assignee_user.id | string | | 3
+action_result.data.\*.\*.assignee_user.is_active | boolean | | True False
+action_result.data.\*.\*.assignee_user.is_readonly | boolean | | True False
+action_result.data.\*.\*.assignee_user.must_change_password | boolean | | True False
+action_result.data.\*.\*.assignee_user.name | string | |
+action_result.data.\*.\*.assignee_user.nickname | string | |
+action_result.data.\*.\*.assignee_user.organization.id | string | | 2
+action_result.data.\*.\*.assignee_user.organization.name | string | | Anomali
+action_result.data.\*.\*.assignee_user.organization.resource_uri | string | | /api/v1/userorganization/2/
+action_result.data.\*.\*.assignee_user.resource_uri | string | | /api/v1/user/3/
+action_result.data.\*.\*.assignee_user_id | numeric | | 3
+action_result.data.\*.\*.assignee_user_name | string | |
+action_result.data.\*.\*.body_content_type | string | | markdown
+action_result.data.\*.\*.campaign | string | |
+action_result.data.\*.\*.can_add_public_tags | string | |
+action_result.data.\*.\*.created_ts | string | | 2021-03-25T09:05:07.105073
+action_result.data.\*.\*.feed_id | numeric | | 0
+action_result.data.\*.\*.id | string | | 10768
+action_result.data.\*.\*.is_anonymous | boolean | | True False
+action_result.data.\*.\*.is_cloneable | string | | yes
+action_result.data.\*.\*.is_editable | boolean | | True False
+action_result.data.\*.\*.is_email | boolean | | True False
+action_result.data.\*.\*.is_public | boolean | | True False
+action_result.data.\*.\*.modified_ts | string | | 2021-03-25T09:05:07.110410
+action_result.data.\*.\*.name | string | | tag
+action_result.data.\*.\*.original_source | string | |
+action_result.data.\*.\*.original_source_id | string | |
+action_result.data.\*.\*.owner_org | string | |
+action_result.data.\*.\*.owner_org.id | string | | 67
+action_result.data.\*.\*.owner_org.name | string | | test.user.com
+action_result.data.\*.\*.owner_org.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.\*.owner_org.title | string | | Analyst
+action_result.data.\*.\*.owner_org_id | string | |
+action_result.data.\*.\*.owner_org_name | string | |
+action_result.data.\*.\*.owner_user | string | |
+action_result.data.\*.\*.owner_user.avatar_s3_url | string | |
+action_result.data.\*.\*.owner_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.\*.owner_user.email | string | | testuser2@qa.test.com
+action_result.data.\*.\*.owner_user.id | string | | 136
+action_result.data.\*.\*.owner_user.is_active | boolean | | True False
+action_result.data.\*.\*.owner_user.is_readonly | boolean | | True False
+action_result.data.\*.\*.owner_user.must_change_password | boolean | | True False
+action_result.data.\*.\*.owner_user.name | string | | testuser
+action_result.data.\*.\*.owner_user.nickname | string | |
+action_result.data.\*.\*.owner_user.organization.id | string | | 67
+action_result.data.\*.\*.owner_user.organization.name | string | | qa.test.com
+action_result.data.\*.\*.owner_user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.\*.owner_user_id | string | |
+action_result.data.\*.\*.owner_user_name | string | |
+action_result.data.\*.\*.parent | string | |
+action_result.data.\*.\*.published_ts | string | |
+action_result.data.\*.\*.remote_api | boolean | | True False
+action_result.data.\*.\*.resource_uri | string | | /api/v1/tipreport/10768/?remote_api=true
+action_result.data.\*.\*.source | string | | test
+action_result.data.\*.\*.source_created | string | |
+action_result.data.\*.\*.source_modified | string | |
+action_result.data.\*.\*.starred_by_me | boolean | | True False
+action_result.data.\*.\*.starred_total_count | numeric | | 0
+action_result.data.\*.\*.status | string | | new
+action_result.data.\*.\*.tags_v2.\*.id | string | | rb6
+action_result.data.\*.\*.tags_v2.\*.name | string | | file
+action_result.data.\*.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.\*.threat_actor | string | |
+action_result.data.\*.\*.tlp | string | | white
+action_result.data.\*.\*.ttp | string | |
+action_result.data.\*.\*.uuid | string | | f0ae413e-9967-4b32-bd52-810fbebfb421
+action_result.data.\*.\*.votes.me | string | |
+action_result.data.\*.\*.votes.total | numeric | | 0
+action_result.data.\*.\*.watched_by_me | boolean | | True False
+action_result.data.\*.\*.watched_total_count | numeric | | 0
+action_result.data.\*.all_circles_visible | boolean | | True False
+action_result.data.\*.assignee_org | string | |
+action_result.data.\*.assignee_org_id | string | |
+action_result.data.\*.assignee_org_name | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.assignee_user.avatar_s3_url | string | |
+action_result.data.\*.assignee_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.assignee_user.email | string | `email` | mark@domaintools.com
+action_result.data.\*.assignee_user.id | string | | 22
+action_result.data.\*.assignee_user.is_active | boolean | | True False
+action_result.data.\*.assignee_user.is_readonly | boolean | | True False
+action_result.data.\*.assignee_user.must_change_password | boolean | | True False
+action_result.data.\*.assignee_user.name | string | |
+action_result.data.\*.assignee_user.nickname | string | |
+action_result.data.\*.assignee_user.organization.id | string | | 11
+action_result.data.\*.assignee_user.organization.name | string | | DomainTools
+action_result.data.\*.assignee_user.organization.resource_uri | string | | /api/v1/userorganization/11/
+action_result.data.\*.assignee_user.resource_uri | string | | /api/v1/user/22/
+action_result.data.\*.assignee_user_id | numeric | | 22
+action_result.data.\*.assignee_user_name | string | |
+action_result.data.\*.body_content_type | string | | richtext
+action_result.data.\*.campaign | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.anonymous_sharing | boolean | | True False
+action_result.data.\*.circles.\*.can_edit | boolean | | True False
+action_result.data.\*.circles.\*.can_invite | boolean | | True False
+action_result.data.\*.circles.\*.can_override_confidence | boolean | | True False
+action_result.data.\*.circles.\*.description | string | | For testing...
+action_result.data.\*.circles.\*.disable_vendor_emails | string | |
+action_result.data.\*.circles.\*.id | numeric | | 10018
+action_result.data.\*.circles.\*.is_freemium | boolean | | True False
+action_result.data.\*.circles.\*.mattermost_team_id | string | |
+action_result.data.\*.circles.\*.member | boolean | | True False
+action_result.data.\*.circles.\*.name | string | | Test circle 2
+action_result.data.\*.circles.\*.num_administrators | numeric | | 1
+action_result.data.\*.circles.\*.num_members | numeric | | 1
+action_result.data.\*.circles.\*.openinvite | boolean | | True False
+action_result.data.\*.circles.\*.pending | boolean | | True False
+action_result.data.\*.circles.\*.public | boolean | | True False
+action_result.data.\*.circles.\*.remote_api | boolean | | True False
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/basetrustedcircle/10018/?remote_api=true
+action_result.data.\*.circles.\*.restricted_publishing | boolean | | True False
+action_result.data.\*.circles.\*.subscription_model | string | |
+action_result.data.\*.circles.\*.use_chat | boolean | | True False
+action_result.data.\*.circles.\*.validate_subscriptions | boolean | | True False
+action_result.data.\*.created_ts | string | | 2021-04-06T08:09:31.778085
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | string | `threatstream threatbulletin id` | 10890
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_email | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.modified_ts | string | | 2021-04-06T08:09:33.982053
+action_result.data.\*.name | string | | test name
+action_result.data.\*.original_source | string | |
+action_result.data.\*.original_source_id | string | |
+action_result.data.\*.owner_org | string | |
+action_result.data.\*.owner_org.id | string | | 67
+action_result.data.\*.owner_org.name | string | | test.org.com
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_org.title | string | | Analyst
+action_result.data.\*.owner_org_id | numeric | | 67
+action_result.data.\*.owner_org_name | string | | test.org.com
+action_result.data.\*.owner_user | string | |
+action_result.data.\*.owner_user.avatar_s3_url | string | |
+action_result.data.\*.owner_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.owner_user.email | string | `email` | test@testuser.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.is_active | boolean | | True False
+action_result.data.\*.owner_user.is_readonly | boolean | | True False
+action_result.data.\*.owner_user.must_change_password | boolean | | True False
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.nickname | string | |
+action_result.data.\*.owner_user.organization.id | string | | 67
+action_result.data.\*.owner_user.organization.name | string | | test.org.com
+action_result.data.\*.owner_user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.owner_user_name | string | | testuser2
+action_result.data.\*.parent | string | |
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/tipreport/10890/?remote_api=true
+action_result.data.\*.source | string | | test source
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.status | string | | new
+action_result.data.\*.tags | string | | test tag2
+action_result.data.\*.tags_v2.\*.id | string | | i45
+action_result.data.\*.tags_v2.\*.name | string | | test tag1
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.threat_actor | string | |
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.ttp | string | |
+action_result.data.\*.uuid | string | | 3c566c79-e3c5-4c02-bb8c-acff8182b100
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.threat_bulletins_returned | numeric | | 1
+action_result.message | string | | Threat bulletins returned: 1
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list associations'
List associations of an entity present in ThreatStream
@@ -3207,174 +3397,174 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**entity\_id** | required | ID of the entity | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
+**entity_id** | required | ID of the entity | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
**limit** | optional | Total number of associations to return | numeric |
-**entity\_type** | required | Type of threat model entity to list the associations | string |
-**associated\_entity\_type** | required | Type of associations of the enitity to list | string |
+**entity_type** | required | Type of threat model entity to list the associations | string |
+**associated_entity_type** | required | Type of associations of the enitity to list | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.associated\_entity\_type | string |
-action\_result\.parameter\.entity\_id | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.parameter\.entity\_type | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.all\_circles\_visible | boolean |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.assignee\_org | string |
-action\_result\.data\.\*\.assignee\_org\_id | string |
-action\_result\.data\.\*\.assignee\_org\_name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.assignee\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.assignee\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.assignee\_user\.email | string |
-action\_result\.data\.\*\.assignee\_user\.id | string |
-action\_result\.data\.\*\.assignee\_user\.is\_active | boolean |
-action\_result\.data\.\*\.assignee\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.assignee\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.assignee\_user\.name | string |
-action\_result\.data\.\*\.assignee\_user\.nickname | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.id | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.name | string |
-action\_result\.data\.\*\.assignee\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user\_id | string |
-action\_result\.data\.\*\.assignee\_user\_name | string |
-action\_result\.data\.\*\.association\_info\.\*\.comment | string |
-action\_result\.data\.\*\.association\_info\.\*\.created | string |
-action\_result\.data\.\*\.association\_info\.\*\.from\_id | string |
-action\_result\.data\.\*\.association\_info\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaign | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.anonymous\_sharing | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_edit | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_invite | boolean |
-action\_result\.data\.\*\.circles\.\*\.can\_override\_confidence | boolean |
-action\_result\.data\.\*\.circles\.\*\.description | string |
-action\_result\.data\.\*\.circles\.\*\.disable\_vendor\_emails | string |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.is\_freemium | boolean |
-action\_result\.data\.\*\.circles\.\*\.mattermost\_team\_id | string |
-action\_result\.data\.\*\.circles\.\*\.member | boolean |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.num\_administrators | numeric |
-action\_result\.data\.\*\.circles\.\*\.num\_members | numeric |
-action\_result\.data\.\*\.circles\.\*\.openinvite | boolean |
-action\_result\.data\.\*\.circles\.\*\.pending | boolean |
-action\_result\.data\.\*\.circles\.\*\.public | boolean |
-action\_result\.data\.\*\.circles\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.circles\.\*\.restricted\_publishing | boolean |
-action\_result\.data\.\*\.circles\.\*\.subscription\_model | string |
-action\_result\.data\.\*\.circles\.\*\.use\_chat | boolean |
-action\_result\.data\.\*\.circles\.\*\.validate\_subscriptions | boolean |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string | `email`
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.data\.\*\.import\_session\_id | numeric |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string | `ip`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_category | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_email | boolean |
-action\_result\.data\.\*\.is\_mitre | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_system | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.objective | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.original\_source | string |
-action\_result\.data\.\*\.original\_source\_id | string |
-action\_result\.data\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\_id | numeric |
-action\_result\.data\.\*\.owner\_org\_name | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.owner\_user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.owner\_user\.email | string |
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.is\_active | boolean |
-action\_result\.data\.\*\.owner\_user\.is\_readonly | boolean |
-action\_result\.data\.\*\.owner\_user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.nickname | string |
-action\_result\.data\.\*\.owner\_user\.organization\.id | string |
-action\_result\.data\.\*\.owner\_user\.organization\.name | string |
-action\_result\.data\.\*\.owner\_user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.owner\_user\_name | string |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.s\_type | string |
-action\_result\.data\.\*\.sort | string |
-action\_result\.data\.\*\.source | string | `email`
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.status\.display\_name | string |
-action\_result\.data\.\*\.status\.id | numeric |
-action\_result\.data\.\*\.status\.resource\_uri | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_actor | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.ttp | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string | `email` `ip` `sha256`
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.associations\_returned | numeric |
-action\_result\.summary\.threat\_bulletin\_observables\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.associated_entity_type | string | | vulnerability
+action_result.parameter.entity_id | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 1000000001
+action_result.parameter.entity_type | string | | tipreport
+action_result.parameter.limit | numeric | | 2
+action_result.data.\*.all_circles_visible | boolean | | True False
+action_result.data.\*.asn | string | |
+action_result.data.\*.assignee_org | string | |
+action_result.data.\*.assignee_org_id | string | |
+action_result.data.\*.assignee_org_name | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.assignee_user.avatar_s3_url | string | |
+action_result.data.\*.assignee_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.assignee_user.email | string | | gita@verizon2.com
+action_result.data.\*.assignee_user.id | string | | 12
+action_result.data.\*.assignee_user.is_active | boolean | | True False
+action_result.data.\*.assignee_user.is_readonly | boolean | | True False
+action_result.data.\*.assignee_user.must_change_password | boolean | | True False
+action_result.data.\*.assignee_user.name | string | |
+action_result.data.\*.assignee_user.nickname | string | |
+action_result.data.\*.assignee_user.organization.id | string | | 6
+action_result.data.\*.assignee_user.organization.name | string | | Verizon2
+action_result.data.\*.assignee_user.organization.resource_uri | string | | /api/v1/userorganization/6/
+action_result.data.\*.assignee_user.resource_uri | string | | /api/v1/user/12/
+action_result.data.\*.assignee_user_id | string | |
+action_result.data.\*.assignee_user_name | string | |
+action_result.data.\*.association_info.\*.comment | string | |
+action_result.data.\*.association_info.\*.created | string | | 2021-04-09T07:44:13.750043
+action_result.data.\*.association_info.\*.from_id | string | | 10940
+action_result.data.\*.association_info.\*.remote_api | boolean | | True False
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.campaign | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.anonymous_sharing | boolean | | True False
+action_result.data.\*.circles.\*.can_edit | boolean | | True False
+action_result.data.\*.circles.\*.can_invite | boolean | | True False
+action_result.data.\*.circles.\*.can_override_confidence | boolean | | True False
+action_result.data.\*.circles.\*.description | string | | For testing...
+action_result.data.\*.circles.\*.disable_vendor_emails | string | |
+action_result.data.\*.circles.\*.id | string | | 10019
+action_result.data.\*.circles.\*.is_freemium | boolean | | True False
+action_result.data.\*.circles.\*.mattermost_team_id | string | |
+action_result.data.\*.circles.\*.member | boolean | | True False
+action_result.data.\*.circles.\*.name | string | | test circle local
+action_result.data.\*.circles.\*.num_administrators | numeric | | 1
+action_result.data.\*.circles.\*.num_members | numeric | | 1
+action_result.data.\*.circles.\*.openinvite | boolean | | True False
+action_result.data.\*.circles.\*.pending | boolean | | True False
+action_result.data.\*.circles.\*.public | boolean | | True False
+action_result.data.\*.circles.\*.remote_api | boolean | | True False
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/10019/?remote_api=true
+action_result.data.\*.circles.\*.restricted_publishing | boolean | | True False
+action_result.data.\*.circles.\*.subscription_model | string | |
+action_result.data.\*.circles.\*.use_chat | boolean | | True False
+action_result.data.\*.circles.\*.validate_subscriptions | boolean | | True False
+action_result.data.\*.confidence | numeric | | 70
+action_result.data.\*.country | string | |
+action_result.data.\*.created_by | string | `email` | test@testuser.com
+action_result.data.\*.created_ts | string | | 2021-04-09T06:45:23.627 2021-04-13T06:44:32.259632
+action_result.data.\*.description | string | |
+action_result.data.\*.end_date | string | |
+action_result.data.\*.expiration_ts | string | | 2021-06-21T14:30:03.799
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 27933
+action_result.data.\*.import_session_id | numeric | | 1000000024
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | `ip` |
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_category | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_email | boolean | | True False
+action_result.data.\*.is_mitre | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_system | boolean | | True False
+action_result.data.\*.itype | string | | mal_email
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail2 | string | | imported by user 136
+action_result.data.\*.meta.severity | string | | low
+action_result.data.\*.modified_ts | string | | 2021-04-09T06:45:37.010
+action_result.data.\*.name | string | | xyztest7
+action_result.data.\*.objective | string | |
+action_result.data.\*.org | string | |
+action_result.data.\*.organization_id | numeric | | 67
+action_result.data.\*.original_source | string | |
+action_result.data.\*.original_source_id | string | |
+action_result.data.\*.owner_org.id | string | | 67
+action_result.data.\*.owner_org.name | string | | test.qa.com
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_org_id | numeric | | 67
+action_result.data.\*.owner_org_name | string | | qa.test.com
+action_result.data.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.owner_user.avatar_s3_url | string | |
+action_result.data.\*.owner_user.can_share_intelligence | boolean | | True False
+action_result.data.\*.owner_user.email | string | | testuser2@qa.user.com
+action_result.data.\*.owner_user.id | string | | 136
+action_result.data.\*.owner_user.is_active | boolean | | True False
+action_result.data.\*.owner_user.is_readonly | boolean | | True False
+action_result.data.\*.owner_user.must_change_password | boolean | | True False
+action_result.data.\*.owner_user.name | string | | testuser2
+action_result.data.\*.owner_user.nickname | string | |
+action_result.data.\*.owner_user.organization.id | string | | 67
+action_result.data.\*.owner_user.organization.name | string | | qa.user.com
+action_result.data.\*.owner_user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.owner_user_id | numeric | | 136
+action_result.data.\*.owner_user_name | string | | testuser2
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | review_requested
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.rdns | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/vulnerability/27933/?remote_api=true
+action_result.data.\*.retina_confidence | numeric | | -1
+action_result.data.\*.s_type | string | | Suricata
+action_result.data.\*.sort | string | | 232202446
+action_result.data.\*.source | string | `email` | test@testuser.com
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:55
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | | -1
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | |
+action_result.data.\*.status | string | | active
+action_result.data.\*.status.display_name | string | | New
+action_result.data.\*.status.id | numeric | | 1
+action_result.data.\*.status.resource_uri | string | | /api/v1/incidentstatustype/1/
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags | string | | testing
+action_result.data.\*.tags.\*.id | string | | vjw
+action_result.data.\*.tags.\*.name | string | | test name
+action_result.data.\*.tags.\*.org_id | numeric | | 67
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.source_user_id | string | | 1234
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.tags_v2.\*.id | string | | 6pd
+action_result.data.\*.tags_v2.\*.name | string | | test
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.remote_api | boolean | | True False
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.threat_actor | string | |
+action_result.data.\*.threat_type | string | | malware
+action_result.data.\*.threatscore | numeric | | 14
+action_result.data.\*.tlp | string | | white
+action_result.data.\*.trusted_circle_ids | string | |
+action_result.data.\*.ttp | string | |
+action_result.data.\*.type | string | | email
+action_result.data.\*.update_id | string | | 335089
+action_result.data.\*.uuid | string | | fb24da3a-429a-49f9-a409-95dcf8752447
+action_result.data.\*.value | string | `email` `ip` `sha256` | mailabc@xyz.com
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.associations_returned | numeric | | 2
+action_result.summary.threat_bulletin_observables_returned | numeric | | 4
+action_result.message | string | | Associations returned: 4
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create rule'
Creates a new rule in Threatstream
@@ -3382,92 +3572,92 @@ Creates a new rule in Threatstream
Type: **generic**
Read only: **False**
- In the field param, tags, actors, malware, campaigns, incidents, signature, tips, ttps, vulnerabilities accepts list of IDs as an example\: \{“incidents”\: \[1000000001\], “actors”\: \[1000000001\], “vulnerabilities”\: \[1000000001, 1000000002\], “campaigns”\: \[1000000001\], “signatures”\: \[1000000001\], “tags”\: \[\{“name”\:“test\_tag”,“tlp”\:“white”\}\], “match\_impacts”\: \[ “actor\_ip”, “actor\_ipv6” \]\} In field param, at least one Match Within parameter \(match\_observables, match\_reportedfiles, match\_signatures, match\_tips, or match\_vulnerabilities\) should be true\. Otherwise, the action will pass and a rule will be created but it will throw an error while updating it from the UI\. Do not specify values for both match\_impacts and exclude\_impacts in the same request\. Indicator types specified in match\_impacts are filtered out if also specified in exclude\_impacts\.
+ In the field param, tags, actors, malware, campaigns, incidents, signature, tips, ttps, vulnerabilities accepts list of IDs as an example: {“incidents”: [1000000001], “actors”: [1000000001], “vulnerabilities”: [1000000001, 1000000002], “campaigns”: [1000000001], “signatures”: [1000000001], “tags”: [{“name”:“test_tag”,“tlp”:“white”}], “match_impacts”: [ “actor_ip”, “actor_ipv6” ]} In field param, at least one Match Within parameter (match_observables, match_reportedfiles, match_signatures, match_tips, or match_vulnerabilities) should be true. Otherwise, the action will pass and a rule will be created but it will throw an error while updating it from the UI. Do not specify values for both match_impacts and exclude_impacts in the same request. Indicator types specified in match_impacts are filtered out if also specified in exclude_impacts.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**name** | required | Name of the rule | string |
-**keywords** | required | List of keywords for which you want the rule to match\. i\.e \["keyword1", "keyword2"\] | string |
+**keywords** | required | List of keywords for which you want the rule to match. i.e ["keyword1", "keyword2"] | string |
**fields** | optional | JSON formatted string of fields to include with the rule | string |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.keywords | string |
-action\_result\.parameter\.name | string |
-action\_result\.data\.\*\.actors\.\*\.id | string | `threatstream actor id`
-action\_result\.data\.\*\.actors\.\*\.name | string |
-action\_result\.data\.\*\.actors\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.actors\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | string | `threatstream campaign id`
-action\_result\.data\.\*\.campaigns\.\*\.name | string |
-action\_result\.data\.\*\.campaigns\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.campaigns\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.create\_investigation | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.exclude\_notify\_org\_whitelisted | boolean |
-action\_result\.data\.\*\.exclude\_notify\_owner\_org | boolean |
-action\_result\.data\.\*\.id | numeric | `threatstream rule id`
-action\_result\.data\.\*\.investigation | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_enabled | boolean |
-action\_result\.data\.\*\.keyword | string |
-action\_result\.data\.\*\.keywords | string |
-action\_result\.data\.\*\.match\_actors | boolean |
-action\_result\.data\.\*\.match\_campaigns | boolean |
-action\_result\.data\.\*\.match\_impact | string |
-action\_result\.data\.\*\.match\_incidents | boolean |
-action\_result\.data\.\*\.match\_malware | boolean |
-action\_result\.data\.\*\.match\_observables | boolean |
-action\_result\.data\.\*\.match\_reportedfiles | boolean |
-action\_result\.data\.\*\.match\_signatures | boolean |
-action\_result\.data\.\*\.match\_tips | boolean |
-action\_result\.data\.\*\.match\_ttps | boolean |
-action\_result\.data\.\*\.match\_vulnerabilities | boolean |
-action\_result\.data\.\*\.matches | numeric |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.notify\_me | boolean |
-action\_result\.data\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.org\_shared | boolean |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.user\.email | string | `email`
-action\_result\.data\.\*\.user\.id | string |
-action\_result\.data\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.user\.name | string |
-action\_result\.data\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.data\.\*\.vulnerabilities\.\*\.id | string | `threatstream vulnerability id`
-action\_result\.data\.\*\.vulnerabilities\.\*\.name | string |
-action\_result\.data\.\*\.vulnerabilities\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.vulnerabilities\.\*\.resource\_uri | string |
-action\_result\.summary\.id | numeric |
-action\_result\.summary\.message | string |
-action\_result\.message | string |
-summary\.message | numeric |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.create_on_cloud | boolean | | False True
+action_result.parameter.fields | string | | { "actors": [ 1000000001 ], "vulnerabilities": [ 1000000001 ], "campaigns": [ 1000000001 ], "tags": [ "test", "tag1" ], "match_impacts": [ "actor_ip", "actor_ipv6" ] }
+action_result.parameter.keywords | string | | key1, testing
+action_result.parameter.name | string | | test name
+action_result.data.\*.actors.\*.id | string | `threatstream actor id` | 1000000001
+action_result.data.\*.actors.\*.name | string | | local actor01
+action_result.data.\*.actors.\*.remote_api | boolean | | True False
+action_result.data.\*.actors.\*.resource_uri | string | | /api/v1/actor/1000000001/
+action_result.data.\*.campaigns.\*.id | string | `threatstream campaign id` | 1000000001
+action_result.data.\*.campaigns.\*.name | string | | testing for common action create campaign on prem
+action_result.data.\*.campaigns.\*.remote_api | boolean | | True False
+action_result.data.\*.campaigns.\*.resource_uri | string | | /api/v1/campaign/1000000001/
+action_result.data.\*.create_investigation | boolean | | False True
+action_result.data.\*.created_ts | string | | 2021-04-01T12:06:14.296703
+action_result.data.\*.exclude_notify_org_whitelisted | boolean | | True False
+action_result.data.\*.exclude_notify_owner_org | boolean | | True False
+action_result.data.\*.id | numeric | `threatstream rule id` | 1000000026
+action_result.data.\*.investigation | string | |
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_enabled | boolean | | True False
+action_result.data.\*.keyword | string | | key1, testing
+action_result.data.\*.keywords | string | | testing
+action_result.data.\*.match_actors | boolean | | True False
+action_result.data.\*.match_campaigns | boolean | | True False
+action_result.data.\*.match_impact | string | | actor_ipv6
+action_result.data.\*.match_incidents | boolean | | True False
+action_result.data.\*.match_malware | boolean | | True False
+action_result.data.\*.match_observables | boolean | | True False
+action_result.data.\*.match_reportedfiles | boolean | | True False
+action_result.data.\*.match_signatures | boolean | | True False
+action_result.data.\*.match_tips | boolean | | True False
+action_result.data.\*.match_ttps | boolean | | True False
+action_result.data.\*.match_vulnerabilities | boolean | | True False
+action_result.data.\*.matches | numeric | | 0
+action_result.data.\*.modified_ts | string | | 2021-04-01T12:06:14.296721
+action_result.data.\*.name | string | | test0
+action_result.data.\*.notify_me | boolean | | True False
+action_result.data.\*.org_id | numeric | | 67
+action_result.data.\*.org_shared | boolean | | False True
+action_result.data.\*.organization.id | string | | 67
+action_result.data.\*.organization.name | string | | test.org.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/rule/1000000026/
+action_result.data.\*.tags | string | | tag1
+action_result.data.\*.tags.\*.name | string | | test
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | white
+action_result.data.\*.user.avatar_s3_url | string | |
+action_result.data.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.user.email | string | `email` | test@testuser.com
+action_result.data.\*.user.id | string | | 136
+action_result.data.\*.user.is_active | boolean | | True False
+action_result.data.\*.user.is_readonly | boolean | | True False
+action_result.data.\*.user.must_change_password | boolean | | False True
+action_result.data.\*.user.name | string | | testuser2
+action_result.data.\*.user.nickname | string | |
+action_result.data.\*.user.organization.id | string | | 67
+action_result.data.\*.user.organization.name | string | | test.org.com
+action_result.data.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.user_id | numeric | | 136
+action_result.data.\*.vulnerabilities.\*.id | string | `threatstream vulnerability id` | 1000000001
+action_result.data.\*.vulnerabilities.\*.name | string | | test_vulnerability
+action_result.data.\*.vulnerabilities.\*.remote_api | boolean | | True False
+action_result.data.\*.vulnerabilities.\*.resource_uri | string | | /api/v1/vulnerability/1000000001/
+action_result.summary.id | numeric | | 1000000026
+action_result.summary.message | string | | Rule is created successfully
+action_result.message | string | | Rule is created successfully
+summary.message | numeric | | 1
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update rule'
Update a rule in ThreatStream by ID number
@@ -3479,94 +3669,94 @@ Read only: **False**
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**fields** | required | JSON formatted string of fields to update on the incident | string |
-**rule\_id** | required | ID number of rule to update | string | `threatstream rule id`
+**rule_id** | required | ID number of rule to update | string | `threatstream rule id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.rule\_id | string | `threatstream rule id`
-action\_result\.data\.\*\.actors\.\*\.id | string | `threatstream actor id`
-action\_result\.data\.\*\.actors\.\*\.name | string |
-action\_result\.data\.\*\.actors\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.actors\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | string | `threatstream campaign id`
-action\_result\.data\.\*\.campaigns\.\*\.name | string |
-action\_result\.data\.\*\.campaigns\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.campaigns\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.create\_investigation | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.exclude\_notify\_org\_whitelisted | boolean |
-action\_result\.data\.\*\.exclude\_notify\_owner\_org | boolean |
-action\_result\.data\.\*\.id | numeric | `threatstream rule id`
-action\_result\.data\.\*\.incidents\.\*\.id | string | `threatstream incident id`
-action\_result\.data\.\*\.incidents\.\*\.name | string |
-action\_result\.data\.\*\.incidents\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.incidents\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.investigation | string |
-action\_result\.data\.\*\.investigation\.id | string |
-action\_result\.data\.\*\.investigation\.name | string |
-action\_result\.data\.\*\.investigation\.resource\_uri | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_enabled | boolean |
-action\_result\.data\.\*\.keyword | string |
-action\_result\.data\.\*\.keywords | string |
-action\_result\.data\.\*\.match\_actors | boolean |
-action\_result\.data\.\*\.match\_campaigns | boolean |
-action\_result\.data\.\*\.match\_impact | string |
-action\_result\.data\.\*\.match\_impacts | string |
-action\_result\.data\.\*\.match\_incidents | boolean |
-action\_result\.data\.\*\.match\_malware | boolean |
-action\_result\.data\.\*\.match\_observables | boolean |
-action\_result\.data\.\*\.match\_reportedfiles | boolean |
-action\_result\.data\.\*\.match\_signatures | boolean |
-action\_result\.data\.\*\.match\_tips | boolean |
-action\_result\.data\.\*\.match\_ttps | boolean |
-action\_result\.data\.\*\.match\_vulnerabilities | boolean |
-action\_result\.data\.\*\.matches | numeric |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.notify\_me | boolean |
-action\_result\.data\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.org\_shared | boolean |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.ttps\.\*\.id | string | `threatstream ttp id`
-action\_result\.data\.\*\.ttps\.\*\.name | string |
-action\_result\.data\.\*\.ttps\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.user\.email | string | `email`
-action\_result\.data\.\*\.user\.id | string |
-action\_result\.data\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.user\.name | string |
-action\_result\.data\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.data\.\*\.vulnerabilities\.\*\.id | string | `threatstream vulnerability id`
-action\_result\.data\.\*\.vulnerabilities\.\*\.name | string |
-action\_result\.data\.\*\.vulnerabilities\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.vulnerabilities\.\*\.resource\_uri | string |
-action\_result\.summary | string |
-action\_result\.summary\.id | numeric |
-action\_result\.summary\.message | string |
-action\_result\.message | string |
-summary\.message | numeric |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.fields | string | | { "actors": [ ], "vulnerabilities": [ ], "match_observables": True, "match_reportedfiles": False, "match_signatures": True, "match_tips": True, "match_vulnerabilities": True, "tags": [ "test", "tag1" ], "create_investigation": True, "match_impacts": [ "actor_ip", "actor_ipv6" ], "exclude_notify_org_whitelisted": True, "exclude_notify_owner_org": True , "incidents": [1000000184], "ttps": [119]}
+action_result.parameter.rule_id | string | `threatstream rule id` | 1000000030
+action_result.data.\*.actors.\*.id | string | `threatstream actor id` | 1000000001
+action_result.data.\*.actors.\*.name | string | | local actor01
+action_result.data.\*.actors.\*.remote_api | boolean | | True
+action_result.data.\*.actors.\*.resource_uri | string | | /api/v1/actor/1000000001/
+action_result.data.\*.campaigns.\*.id | string | `threatstream campaign id` | 1000000001
+action_result.data.\*.campaigns.\*.name | string | | testing for common action create campaign on prem
+action_result.data.\*.campaigns.\*.remote_api | boolean | | True
+action_result.data.\*.campaigns.\*.resource_uri | string | | /api/v1/campaign/1000000001/
+action_result.data.\*.create_investigation | boolean | | True False
+action_result.data.\*.created_ts | string | | 2021-04-01T12:24:18.067618
+action_result.data.\*.exclude_notify_org_whitelisted | boolean | | True False
+action_result.data.\*.exclude_notify_owner_org | boolean | | True False
+action_result.data.\*.id | numeric | `threatstream rule id` | 1000000030
+action_result.data.\*.incidents.\*.id | string | `threatstream incident id` | 1000000184
+action_result.data.\*.incidents.\*.name | string | | Test incident name
+action_result.data.\*.incidents.\*.remote_api | boolean | | True
+action_result.data.\*.incidents.\*.resource_uri | string | | /api/v1/incident/1000000184/
+action_result.data.\*.investigation | string | |
+action_result.data.\*.investigation.id | string | | 1000000005
+action_result.data.\*.investigation.name | string | | Matched Rule [key, key1] by test.org.com
+action_result.data.\*.investigation.resource_uri | string | | /api/v1/investigation/1000000005/
+action_result.data.\*.is_editable | boolean | | True
+action_result.data.\*.is_enabled | boolean | | True
+action_result.data.\*.keyword | string | | key1, testing
+action_result.data.\*.keywords | string | | testing
+action_result.data.\*.match_actors | boolean | | True False
+action_result.data.\*.match_campaigns | boolean | | True False
+action_result.data.\*.match_impact | string | | actor_ip
+action_result.data.\*.match_impacts | string | | actor_ipv6
+action_result.data.\*.match_incidents | boolean | | True False
+action_result.data.\*.match_malware | boolean | | False
+action_result.data.\*.match_observables | boolean | | True False
+action_result.data.\*.match_reportedfiles | boolean | | False True
+action_result.data.\*.match_signatures | boolean | | True False
+action_result.data.\*.match_tips | boolean | | True False
+action_result.data.\*.match_ttps | boolean | | True False
+action_result.data.\*.match_vulnerabilities | boolean | | True False
+action_result.data.\*.matches | numeric | | 0
+action_result.data.\*.modified_ts | string | | 2021-04-05T08:16:23.916064
+action_result.data.\*.name | string | | test4
+action_result.data.\*.notify_me | boolean | | True
+action_result.data.\*.org_id | numeric | | 67
+action_result.data.\*.org_shared | boolean | | False True
+action_result.data.\*.organization.id | string | | 67
+action_result.data.\*.organization.name | string | | test.org.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.remote_api | boolean | | True
+action_result.data.\*.resource_uri | string | | /api/v1/rule/1000000030/
+action_result.data.\*.tags | string | | tag1
+action_result.data.\*.tags.\*.name | string | | test
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | white
+action_result.data.\*.ttps.\*.id | string | `threatstream ttp id` | 119
+action_result.data.\*.ttps.\*.name | string | | Deplete Resources [CAPEC 119]
+action_result.data.\*.ttps.\*.resource_uri | string | | /api/v1/ttp/119/
+action_result.data.\*.user.avatar_s3_url | string | |
+action_result.data.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.user.email | string | `email` | test@testuser.com
+action_result.data.\*.user.id | string | | 136
+action_result.data.\*.user.is_active | boolean | | True False
+action_result.data.\*.user.is_readonly | boolean | | False True
+action_result.data.\*.user.must_change_password | boolean | | False True
+action_result.data.\*.user.name | string | | testuser2
+action_result.data.\*.user.nickname | string | |
+action_result.data.\*.user.organization.id | string | | 67
+action_result.data.\*.user.organization.name | string | | test.org.com
+action_result.data.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.user_id | numeric | | 136
+action_result.data.\*.vulnerabilities.\*.id | string | `threatstream vulnerability id` | 1000000001
+action_result.data.\*.vulnerabilities.\*.name | string | | test_vulnerability
+action_result.data.\*.vulnerabilities.\*.remote_api | boolean | | True
+action_result.data.\*.vulnerabilities.\*.resource_uri | string | | /api/v1/vulnerability/1000000001/
+action_result.summary | string | |
+action_result.summary.id | numeric | | 1000000033
+action_result.summary.message | string | | Successfully updated rule
+action_result.message | string | | Successfully updated rule
+summary.message | numeric | | 1
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list rules'
List rules present in ThreatStream
@@ -3574,7 +3764,7 @@ List rules present in ThreatStream
Type: **investigate**
Read only: **True**
-- The rules will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The rules will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -3582,67 +3772,67 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**limit** | optional | Total number of rules to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.create\_investigation | boolean |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.exclude\_notify\_org\_whitelisted | boolean |
-action\_result\.data\.\*\.exclude\_notify\_owner\_org | boolean |
-action\_result\.data\.\*\.has\_associations | boolean |
-action\_result\.data\.\*\.id | numeric | `threatstream rule id`
-action\_result\.data\.\*\.investigation | string |
-action\_result\.data\.\*\.investigation\.id | string |
-action\_result\.data\.\*\.investigation\.name | string |
-action\_result\.data\.\*\.investigation\.resource\_uri | string |
-action\_result\.data\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.is\_enabled | boolean |
-action\_result\.data\.\*\.keyword | string |
-action\_result\.data\.\*\.keywords | string |
-action\_result\.data\.\*\.match\_actors | boolean |
-action\_result\.data\.\*\.match\_campaigns | boolean |
-action\_result\.data\.\*\.match\_incidents | boolean |
-action\_result\.data\.\*\.match\_malware | boolean |
-action\_result\.data\.\*\.match\_observables | boolean |
-action\_result\.data\.\*\.match\_reportedfiles | boolean |
-action\_result\.data\.\*\.match\_signatures | boolean |
-action\_result\.data\.\*\.match\_tips | boolean |
-action\_result\.data\.\*\.match\_ttps | boolean |
-action\_result\.data\.\*\.match\_vulnerabilities | boolean |
-action\_result\.data\.\*\.matches | numeric |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.notify\_me | boolean |
-action\_result\.data\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.org\_shared | boolean |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.user\.email | string | `email`
-action\_result\.data\.\*\.user\.id | string |
-action\_result\.data\.\*\.user\.is\_active | boolean |
-action\_result\.data\.\*\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.user\.name | string |
-action\_result\.data\.\*\.user\.nickname | string |
-action\_result\.data\.\*\.user\.organization\.id | string |
-action\_result\.data\.\*\.user\.organization\.name | string |
-action\_result\.data\.\*\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.user\.resource\_uri | string |
-action\_result\.data\.\*\.user\_id | numeric |
-action\_result\.summary\.rules\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 10 1000
+action_result.data.\*.create_investigation | boolean | | False True
+action_result.data.\*.created_ts | string | | 2021-04-09T08:27:04.162790
+action_result.data.\*.exclude_notify_org_whitelisted | boolean | | False True
+action_result.data.\*.exclude_notify_owner_org | boolean | | False True
+action_result.data.\*.has_associations | boolean | | True False
+action_result.data.\*.id | numeric | `threatstream rule id` | 1000000036
+action_result.data.\*.investigation | string | |
+action_result.data.\*.investigation.id | string | | 1000000005
+action_result.data.\*.investigation.name | string | | Matched Rule [key, key1] by test.org.com
+action_result.data.\*.investigation.resource_uri | string | | /api/v1/investigation/1000000005/
+action_result.data.\*.is_editable | boolean | | True False
+action_result.data.\*.is_enabled | boolean | | True False
+action_result.data.\*.keyword | string | | key5,key6
+action_result.data.\*.keywords | string | | testRule
+action_result.data.\*.match_actors | boolean | | True False
+action_result.data.\*.match_campaigns | boolean | | True False
+action_result.data.\*.match_incidents | boolean | | True False
+action_result.data.\*.match_malware | boolean | | False True
+action_result.data.\*.match_observables | boolean | | True False
+action_result.data.\*.match_reportedfiles | boolean | | False True
+action_result.data.\*.match_signatures | boolean | | False True
+action_result.data.\*.match_tips | boolean | | False True
+action_result.data.\*.match_ttps | boolean | | True False
+action_result.data.\*.match_vulnerabilities | boolean | | False True
+action_result.data.\*.matches | numeric | | 0
+action_result.data.\*.modified_ts | string | | 2021-04-09T11:19:56.898430
+action_result.data.\*.name | string | | tetsting1
+action_result.data.\*.notify_me | boolean | | True False
+action_result.data.\*.org_id | numeric | | 67
+action_result.data.\*.org_shared | boolean | | False True
+action_result.data.\*.organization.id | string | | 67
+action_result.data.\*.organization.name | string | | test.org.com
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/rule/1000000036/
+action_result.data.\*.tags | string | | tag1
+action_result.data.\*.tags.\*.name | string | | test
+action_result.data.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.tags.\*.tlp | string | | white
+action_result.data.\*.user.avatar_s3_url | string | |
+action_result.data.\*.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.user.email | string | `email` | test@testuser.com
+action_result.data.\*.user.id | string | | 136
+action_result.data.\*.user.is_active | boolean | | True False
+action_result.data.\*.user.is_readonly | boolean | | False True
+action_result.data.\*.user.must_change_password | boolean | | False True
+action_result.data.\*.user.name | string | | testuser2
+action_result.data.\*.user.nickname | string | |
+action_result.data.\*.user.organization.id | string | | 67
+action_result.data.\*.user.organization.name | string | | test.org.com
+action_result.data.\*.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.user_id | numeric | | 136
+action_result.summary.rules_returned | numeric | | 22
+action_result.message | string | | Rules returned: 22
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete rule'
Delete rule in ThreatStream by ID number
@@ -3653,18 +3843,18 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**rule\_id** | required | ID number of rule to delete | string | `threatstream rule id`
+**rule_id** | required | ID number of rule to delete | string | `threatstream rule id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.rule\_id | string | `threatstream rule id`
-action\_result\.data | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.rule_id | string | `threatstream rule id` | 15518 1000000030
+action_result.data | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted rule
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'add association'
Create associations between threat model entities on the ThreatStream platform
@@ -3675,26 +3865,26 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**entity\_type** | required | The type of the threat model entity on which want to add the association | string |
-**entity\_id** | required | The ID of the threat model entity on which want to add the association | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-**associated\_entity\_type** | required | The type of threat model entity which will associate the initial entity | string |
-**local\_ids** | optional | Comma\-separated list of local entity IDs to associate with the entity \(this will appends on the existing\) | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-**remote\_ids** | optional | Comma\-separated list of remote enitity IDs to associate with the entity \(this will appends on the existing\) | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
+**entity_type** | required | The type of the threat model entity on which want to add the association | string |
+**entity_id** | required | The ID of the threat model entity on which want to add the association | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
+**associated_entity_type** | required | The type of threat model entity which will associate the initial entity | string |
+**local_ids** | optional | Comma-separated list of local entity IDs to associate with the entity (this will appends on the existing) | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
+**remote_ids** | optional | Comma-separated list of remote enitity IDs to associate with the entity (this will appends on the existing) | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.associated\_entity\_type | string |
-action\_result\.parameter\.entity\_id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.parameter\.entity\_type | string |
-action\_result\.parameter\.local\_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-action\_result\.parameter\.remote\_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-action\_result\.data\.\* | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.associated_entity_type | string | | actor
+action_result.parameter.entity_id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 10911
+action_result.parameter.entity_type | string | | tipreport
+action_result.parameter.local_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id` | 1000000006
+action_result.parameter.remote_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id` | 11783
+action_result.data.\* | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 11783
+action_result.summary | string | |
+action_result.message | string | | Successfully updated associations. Modified entities : 10909. Please check for the non-modified ids as they would be already associated or invalid
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'remove association'
Remove associations between threat model entities on the ThreatStream platform
@@ -3705,26 +3895,26 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**entity\_type** | required | Type of threat model entity from which you are removing the association | string |
-**entity\_id** | required | ID of the threat model entity from which you are removing the association | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-**associated\_entity\_type** | required | Type of threat model entity with which you are associating the initial entity | string |
-**local\_ids** | optional | Comma\-separated list of local enitity IDs to associate with the entity \- Note that this appends | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-**remote\_ids** | optional | Comma\-separated list of remote enitity IDs to associate with the entity \- Note that this appends | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
+**entity_type** | required | Type of threat model entity from which you are removing the association | string |
+**entity_id** | required | ID of the threat model entity from which you are removing the association | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
+**associated_entity_type** | required | Type of threat model entity with which you are associating the initial entity | string |
+**local_ids** | optional | Comma-separated list of local enitity IDs to associate with the entity - Note that this appends | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
+**remote_ids** | optional | Comma-separated list of remote enitity IDs to associate with the entity - Note that this appends | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.associated\_entity\_type | string |
-action\_result\.parameter\.entity\_id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.parameter\.entity\_type | string |
-action\_result\.parameter\.local\_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-action\_result\.parameter\.remote\_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id`
-action\_result\.data\.\* | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id`
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.associated_entity_type | string | | actor
+action_result.parameter.entity_id | numeric | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 10911
+action_result.parameter.entity_type | string | | tipreport
+action_result.parameter.local_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id` | 1000000006
+action_result.parameter.remote_ids | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` `threatstream intelligence id` | 11783
+action_result.data.\* | string | `threatstream actor id` `threatstream campaign id` `threatstream incident id` `threatstream vulnerability id` `threatstream ttp id` `threatstream threatbulletin id` `threatstream signature id` | 11783
+action_result.summary | string | |
+action_result.message | string | | Successfully updated associations. Modified entities : 10909. Please check for the non-modified ids as they would be already associated or invalid
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list actors'
List actors present in ThreatStream
@@ -3732,7 +3922,7 @@ List actors present in ThreatStream
Type: **investigate**
Read only: **True**
-- The actors will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The actors will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
@@ -3740,60 +3930,60 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**limit** | optional | Total number of actors to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.aliases\.\*\.name | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | numeric |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.end\_date | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream actor id`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_email | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_team | boolean |
-action\_result\.data\.\*\.model\_type | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | numeric |
-action\_result\.data\.\*\.organization\.title | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | numeric |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.primary\_motivation | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.resource\_level | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.sort | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.summary\.actors\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 1000 1
+action_result.data.\*.aliases.\*.name | string | | testin
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | numeric | | 10022
+action_result.data.\*.circles.\*.name | string | | test circle 4
+action_result.data.\*.created_ts | string | | 2021-04-08T13:04:00.932459 2021-04-20T08:39:20.368888+00:00
+action_result.data.\*.end_date | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream actor id` | 11795 11930
+action_result.data.\*.is_anonymous | boolean | | False True
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_email | string | |
+action_result.data.\*.is_public | boolean | | False True
+action_result.data.\*.is_team | boolean | | False True
+action_result.data.\*.model_type | string | | actor
+action_result.data.\*.modified_ts | string | | 2021-04-23T08:42:51.176628+00:00
+action_result.data.\*.name | string | | actor_test_2
+action_result.data.\*.organization.id | numeric | | 70
+action_result.data.\*.organization.title | string | | test title
+action_result.data.\*.organization_id | numeric | | 70
+action_result.data.\*.owner_user.email | string | `email` | useremail@test.com
+action_result.data.\*.owner_user.id | numeric | | 142
+action_result.data.\*.owner_user.name | string | | matt
+action_result.data.\*.owner_user_id | numeric | | 142
+action_result.data.\*.primary_motivation | string | |
+action_result.data.\*.publication_status | string | | new reviewed
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.resource_level | string | |
+action_result.data.\*.resource_uri | string | | /api/v1/actor/11930/
+action_result.data.\*.sort | string | | actor-11930
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:00+00:00
+action_result.data.\*.source_modified | string | | 2019-05-19T10:15:00+00:00
+action_result.data.\*.start_date | string | | 2019-06-05T04:15:00+00:00
+action_result.data.\*.status | string | |
+action_result.data.\*.tags | string | | aliases:TA505 (BAE Systems)
+action_result.data.\*.tags.\*.id | string | | bwf
+action_result.data.\*.tags.\*.name | string | | testing
+action_result.data.\*.tags.\*.org_id | numeric | | 70
+action_result.data.\*.tags.\*.tlp | string | | white
+action_result.data.\*.tags_v2.\*.id | string | | afk
+action_result.data.\*.tags_v2.\*.name | string | | Remote Origin
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 70
+action_result.data.\*.tags_v2.\*.tlp | string | | red
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.type | string | | competitor
+action_result.data.\*.uuid | string | | 4681da86-ac0a-4d21-bd3f-156904886f66 b58939d4-21b0-427b-bb62-6dc42391bef0
+action_result.summary.actors_returned | numeric | | 13 1
+action_result.message | string | | Actors returned: 13
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list imports'
List imports present in ThreatStream
@@ -3801,55 +3991,55 @@ List imports present in ThreatStream
Type: **investigate**
Read only: **True**
-- The imports will be listed in the latest first order on the basis of created\_ts\.
- If the limit parameter is not provided, then the default value \(1000\) will be considered as the value of the limit parameter\.
+- The imports will be listed in the latest first order on the basis of created_ts.
- If the limit parameter is not provided, then the default value (1000) will be considered as the value of the limit parameter.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**limit** | optional | Total number of imports to return | numeric |
**status** | optional | Status of imports | string |
-**list\_from\_remote** | optional | List from remote? \(applicable only for hybrid on\-prem instances\) | boolean |
+**list_from_remote** | optional | List from remote? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.parameter\.list\_from\_remote | boolean |
-action\_result\.parameter\.status | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.data | string |
-action\_result\.data\.\*\.date | string |
-action\_result\.data\.\*\.date\_modified | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.fileName | string | `sha1` `url`
-action\_result\.data\.\*\.fileType | string |
-action\_result\.data\.\*\.file\_name\_label | string |
-action\_result\.data\.\*\.id | numeric | `threatstream import session id`
-action\_result\.data\.\*\.intelligence\_source | string | `sha1` `url`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.jobID | string |
-action\_result\.data\.\*\.messages | string |
-action\_result\.data\.\*\.notes | string |
-action\_result\.data\.\*\.numIndicators | numeric |
-action\_result\.data\.\*\.numRejected | numeric |
-action\_result\.data\.\*\.num\_private | numeric |
-action\_result\.data\.\*\.num\_public | numeric |
-action\_result\.data\.\*\.orginal\_intelligence | string |
-action\_result\.data\.\*\.processed\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.source\_confidence\_weight | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.visibleForReview | boolean |
-action\_result\.summary\.import\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 100
+action_result.parameter.list_from_remote | boolean | | True False
+action_result.parameter.status | string | |
+action_result.data.\*.confidence | numeric | | 100
+action_result.data.\*.data | string | | {u'remote_malware': [], u'signatures': [], u'remote_tipreports': [], u'intrusionsets': [], u'classification': u'public', u'comment_ip_addr': u'52.52.79.127', u'infrastructure': [], u'url_mapping': None, u'identities': [], u'datatext': u'4.63.2.45', u'remote_vulnerabilities': [], u'md5_mapping': None, u'malware': [], u'benign_is_public': False, u'tools': [], u'email_mapping': None, u'source': u'Analyst', u'remote_intrusionsets': [], u'actors': [], u'remote_infrastructure': [], u'remote_attackpatterns': [], u'tipreports': [], u'domain_mapping': None, u'circles': [], u'ipv6_mapping': None, u'attackpatterns': [], u'courseofaction': [], u'confidence': u'100', u'ip_mapping': u'mal_ip', u'campaigns': [], u'remote_ttps': [], u'customtms': [], u'reject_benign': True, u'remote_identities': [], u'remote_campaigns': [], u'remote_tools': [], u'ttps': [], u'remote_courseofaction': [], u'incidents': [], u'vulnerabilities': [], u'remote_customtms': [], u'remote_incidents': [], u'remote_signatures': [], u'remote_actors': []}
+action_result.data.\*.date | string | | 2021-04-08T10:48:12.610620
+action_result.data.\*.date_modified | string | | 2021-04-08T10:48:12.793995
+action_result.data.\*.expiration_ts | string | | 2021-07-07T10:48:12.609350
+action_result.data.\*.fileName | string | `sha1` `url` |
+action_result.data.\*.fileType | string | | analyst
+action_result.data.\*.file_name_label | string | |
+action_result.data.\*.id | numeric | `threatstream import session id` | 1161
+action_result.data.\*.intelligence_source | string | `sha1` `url` |
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.jobID | string | |
+action_result.data.\*.messages | string | |
+action_result.data.\*.notes | string | |
+action_result.data.\*.numIndicators | numeric | | 1
+action_result.data.\*.numRejected | numeric | | 0
+action_result.data.\*.num_private | numeric | | 0
+action_result.data.\*.num_public | numeric | | 0
+action_result.data.\*.orginal_intelligence | string | |
+action_result.data.\*.processed_ts | string | | 2021-04-08T10:48:12.796620
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/import/1161/?remote_api=true
+action_result.data.\*.source_confidence_weight | numeric | | 0
+action_result.data.\*.status | string | | done
+action_result.data.\*.tags | string | |
+action_result.data.\*.threat_type | string | |
+action_result.data.\*.tlp | string | |
+action_result.data.\*.visibleForReview | boolean | | True False
+action_result.summary.import_returned | numeric | | 100
+action_result.message | string | | Import returned: 100
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create vulnerability'
Create a vulnerability in ThreatStream
@@ -3857,124 +4047,124 @@ Create a vulnerability in ThreatStream
Type: **generic**
Read only: **False**
-- The "is\_public" parameter can not be set as "true" if the "create\_on\_cloud" parameter is "false" for hybride on\-prem instances\.
+- The "is_public" parameter can not be set as "true" if the "create_on_cloud" parameter is "false" for hybride on-prem instances.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**name** | required | Name to give the vulnerability | string |
**fields** | optional | JSON formatted string of fields to include with the vulnerability | string |
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the vulnerability \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the vulnerability \- Note that this appends | string | `threatstream intelligence id`
-**comment** | optional | Comment to give the vulnerability \(JSON format containing body, title, etc\.\) | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the vulnerability - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the vulnerability - Note that this appends | string | `threatstream intelligence id`
+**comment** | optional | Comment to give the vulnerability (JSON format containing body, title, etc.) | string |
**attachment** | optional | Vault id of an attachment to add on the vulnerability | string | `vault id` `sha1`
-**is\_public** | optional | Classification designation | boolean |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
+**is_public** | optional | Classification designation | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.attachment | string | `vault id` `sha1`
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comment | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.is\_public | boolean |
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.name | string |
-action\_result\.data\.\*\.aliases | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.attachment | string |
-action\_result\.data\.\*\.attachments\.filename | string |
-action\_result\.data\.\*\.attachments\.id | numeric |
-action\_result\.data\.\*\.attachments\.r\_type | string |
-action\_result\.data\.\*\.attachments\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.s3\_url | string |
-action\_result\.data\.\*\.attachments\.title | string |
-action\_result\.data\.\*\.attachments\.url | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | numeric |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.\!\@\#$%^ | string |
-action\_result\.data\.\*\.comment\.body | string |
-action\_result\.data\.\*\.comment\.created\_ts | string |
-action\_result\.data\.\*\.comment\.id | numeric |
-action\_result\.data\.\*\.comment\.invalid | string |
-action\_result\.data\.\*\.comment\.modified\_ts | string |
-action\_result\.data\.\*\.comment\.remote\_api | boolean |
-action\_result\.data\.\*\.comment\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.title | string |
-action\_result\.data\.\*\.comment\.tlp | string |
-action\_result\.data\.\*\.comment\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comment\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comment\.user\.email | string | `email`
-action\_result\.data\.\*\.comment\.user\.id | string |
-action\_result\.data\.\*\.comment\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comment\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comment\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comment\.user\.name | string |
-action\_result\.data\.\*\.comment\.user\.nickname | string |
-action\_result\.data\.\*\.comment\.user\.organization\.id | string |
-action\_result\.data\.\*\.comment\.user\.organization\.name | string |
-action\_result\.data\.\*\.comment\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.user\.resource\_uri | string |
-action\_result\.data\.\*\.comments | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.cvss2\_score | string |
-action\_result\.data\.\*\.cvss3\_score | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.incidents\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_system | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.mitre\_cve\_url | string | `url`
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.signatures\.\*\.id | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttps\.\*\.id | numeric |
-action\_result\.data\.\*\.update\_id | string |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.vulnerability\.\*\.id | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.attachment | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` | 232202446
+action_result.parameter.comment | string | | {"title": "comment title", "body": "This is a comment."}
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.fields | string | | {'circles': [10025, 10022], 'campaigns': [218680], 'incidents': [171066], 'vulnerability': [29891], 'signatures': [632], 'ttps': [1573], 'description': 'for analysis','comments': ['this', 'is comment'],'is_system': True, 'publication_status': 'reviewed', 'source': 'from action','source_created': '2019-04-10T10:10:55','source_modified': '2019-05-19T10:15:23','tags': ['testing', 'vulnerability'],'tlp': 'amber'}
+action_result.parameter.is_public | boolean | | True False
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` |
+action_result.parameter.name | string | | abc_test_111
+action_result.data.\*.aliases | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.attachment | string | | url
+action_result.data.\*.attachments.filename | string | | PDF_All%20valid_invalid.pdf
+action_result.data.\*.attachments.id | numeric | | 26649
+action_result.data.\*.attachments.r_type | string | | A
+action_result.data.\*.attachments.remote_api | boolean | | True False
+action_result.data.\*.attachments.resource_uri | string | | /api/v1/vulnerabilityexternalreference/26649/?remote_api=true
+action_result.data.\*.attachments.s3_url | string | | https://test-optic.s3.user.com/userUploads/2021-05-27/20210527_133407_userId-136_69e3a3d6-b499-4ba1-b918-769a4b74463a_PDF_All20valid_invalid.pdf?Signature=uk%2FY5YOrBVwpxv0xs6sKvyXULrg%3D&Expires=1622126047&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.attachments.title | string | | PDF_All%20valid_invalid.pdf
+action_result.data.\*.attachments.url | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.campaigns.\*.id | numeric | | 218680
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 10022
+action_result.data.\*.circles.\*.name | string | | test circle 4
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/10022/
+action_result.data.\*.comment.!@#$%^ | string | | This is a comment.
+action_result.data.\*.comment.body | string | | This is a comment.
+action_result.data.\*.comment.created_ts | string | | 2021-04-20T09:02:34.945588
+action_result.data.\*.comment.id | numeric | | 18
+action_result.data.\*.comment.invalid | string | | comment title
+action_result.data.\*.comment.modified_ts | string | | 2021-04-20T09:02:34.945603
+action_result.data.\*.comment.remote_api | boolean | | True False
+action_result.data.\*.comment.resource_uri | string | | /api/v1/vulnerability/30274/comment/18/
+action_result.data.\*.comment.title | string | | comment title
+action_result.data.\*.comment.tlp | string | |
+action_result.data.\*.comment.user.avatar_s3_url | string | |
+action_result.data.\*.comment.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comment.user.email | string | `email` | test@test.com
+action_result.data.\*.comment.user.id | string | | 142
+action_result.data.\*.comment.user.is_active | boolean | | True False
+action_result.data.\*.comment.user.is_readonly | boolean | | True False
+action_result.data.\*.comment.user.must_change_password | boolean | | True False
+action_result.data.\*.comment.user.name | string | | test
+action_result.data.\*.comment.user.nickname | string | | testnickname
+action_result.data.\*.comment.user.organization.id | string | | 70
+action_result.data.\*.comment.user.organization.name | string | | test
+action_result.data.\*.comment.user.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.comment.user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.comments | string | | is comment
+action_result.data.\*.created_ts | string | | 2021-04-20T09:02:33.703401
+action_result.data.\*.cvss2_score | string | |
+action_result.data.\*.cvss3_score | string | |
+action_result.data.\*.description | string | | for analysis
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | | 30274
+action_result.data.\*.incidents.\*.id | numeric | | 171066
+action_result.data.\*.intelligence.\*.id | numeric | | 232202446
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_system | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.mitre_cve_url | string | `url` |
+action_result.data.\*.modified_ts | string | | 2021-04-20T09:02:33.704376
+action_result.data.\*.name | string | | abc_test_111
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.organization_id | numeric | | 70
+action_result.data.\*.owner_user.email | string | `email` | test@test.com
+action_result.data.\*.owner_user.id | string | | 142
+action_result.data.\*.owner_user.name | string | | test
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.owner_user_id | numeric | | 142
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | reviewed
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/vulnerability/30274/
+action_result.data.\*.signatures.\*.id | numeric | | 632
+action_result.data.\*.source | string | | from action
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:55
+action_result.data.\*.source_modified | string | | 2019-05-19T10:15:23
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.ttps.\*.id | numeric | | 1573
+action_result.data.\*.update_id | string | |
+action_result.data.\*.uuid | string | | fe06d084-a63b-4536-a748-3232ce650e85
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.vulnerability.\*.id | numeric | | 29891
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Vulnerability created successfully. Associated intelligence : 232202446
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update vulnerability'
Update the vulnerability in ThreatStream
@@ -3987,163 +4177,163 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**id** | required | ID of the vulnerability | string | `threatstream vulnerability id`
**fields** | optional | JSON formatted string of fields to include with the vulnerability | string |
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with the vulnerability \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with the vulnerability \- Note that this appends | string | `threatstream intelligence id`
-**comment** | optional | Comment to give the vulnerability \(JSON format containing body, title, etc\.\) | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with the vulnerability - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with the vulnerability - Note that this appends | string | `threatstream intelligence id`
+**comment** | optional | Comment to give the vulnerability (JSON format containing body, title, etc.) | string |
**attachment** | optional | Vault id of an attachment to add on the vulnerability | string | `vault id` `sha1`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.attachment | string | `vault id` `sha1`
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comment | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.id | string | `threatstream vulnerability id`
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.data\.\*\.aliases | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.attachment | string |
-action\_result\.data\.\*\.attachments\.filename | string |
-action\_result\.data\.\*\.attachments\.id | numeric |
-action\_result\.data\.\*\.attachments\.r\_type | string |
-action\_result\.data\.\*\.attachments\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.s3\_url | string |
-action\_result\.data\.\*\.attachments\.title | string |
-action\_result\.data\.\*\.attachments\.url | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | numeric |
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.body | string |
-action\_result\.data\.\*\.comment\.created\_ts | string |
-action\_result\.data\.\*\.comment\.id | numeric |
-action\_result\.data\.\*\.comment\.modified\_ts | string |
-action\_result\.data\.\*\.comment\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.title | string |
-action\_result\.data\.\*\.comment\.tlp | string |
-action\_result\.data\.\*\.comment\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comment\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comment\.user\.email | string | `email`
-action\_result\.data\.\*\.comment\.user\.id | string |
-action\_result\.data\.\*\.comment\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comment\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comment\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comment\.user\.name | string |
-action\_result\.data\.\*\.comment\.user\.nickname | string |
-action\_result\.data\.\*\.comment\.user\.organization\.id | string |
-action\_result\.data\.\*\.comment\.user\.organization\.name | string |
-action\_result\.data\.\*\.comment\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.user\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.cvss2\_score | string |
-action\_result\.data\.\*\.cvss3\_score | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.external\_references\.\*\.filename | string |
-action\_result\.data\.\*\.external\_references\.\*\.id | numeric |
-action\_result\.data\.\*\.external\_references\.\*\.r\_type | string |
-action\_result\.data\.\*\.external\_references\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.external\_references\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.external\_references\.\*\.s3\_url | string | `url`
-action\_result\.data\.\*\.external\_references\.\*\.title | string |
-action\_result\.data\.\*\.external\_references\.\*\.url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric |
-action\_result\.data\.\*\.incidents\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.asn | string |
-action\_result\.data\.\*\.intelligence\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.country | string |
-action\_result\.data\.\*\.intelligence\.\*\.created\_by | string |
-action\_result\.data\.\*\.intelligence\.\*\.created\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.description | string |
-action\_result\.data\.\*\.intelligence\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.import\_source | string |
-action\_result\.data\.\*\.intelligence\.\*\.ip | string |
-action\_result\.data\.\*\.intelligence\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.itype | string |
-action\_result\.data\.\*\.intelligence\.\*\.latitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.longitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.intelligence\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.org | string |
-action\_result\.data\.\*\.intelligence\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.rdns | string |
-action\_result\.data\.\*\.intelligence\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.intelligence\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.source | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_created | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_modified | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.status | string |
-action\_result\.data\.\*\.intelligence\.\*\.subtype | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.threat\_type | string |
-action\_result\.data\.\*\.intelligence\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.intelligence\.\*\.type | string |
-action\_result\.data\.\*\.intelligence\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.uuid | string |
-action\_result\.data\.\*\.intelligence\.\*\.value | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_system | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.mitre\_cve\_url | string | `url`
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.signatures\.\*\.id | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttps\.\*\.id | numeric |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.vulnerability\.\*\.id | numeric |
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.attachment | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` |
+action_result.parameter.comment | string | | {"title": "comment title", "body": "This is a comment."}
+action_result.parameter.fields | string | | {'name': 'updated_test_111', 'circles': [10022], 'campaigns': [218680], 'incidents': [171066], 'vulnerability': [29891], 'signatures': [632], 'ttps': [1573], 'description': 'for analysis','is_system': True, 'publication_status': 'reviewed', 'source': 'from action','source_created': '2019-04-10T10:10:55','source_modified': '2019-05-19T10:15:23','tags': ['testing', 'vulnerability'],'tlp': 'red'}
+action_result.parameter.id | string | `threatstream vulnerability id` | 30274
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` |
+action_result.data.\*.aliases | string | |
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.attachment | string | | url
+action_result.data.\*.attachments.filename | string | | HTML%20-%20All%20valid_invalid.html
+action_result.data.\*.attachments.id | numeric | | 26653
+action_result.data.\*.attachments.r_type | string | | A
+action_result.data.\*.attachments.remote_api | boolean | | True False
+action_result.data.\*.attachments.resource_uri | string | | /api/v1/vulnerabilityexternalreference/26653/?remote_api=true
+action_result.data.\*.attachments.s3_url | string | | https://test-optic.s3.user.com/userUploads/2021-05-27/20210527_133417_userId-136_2b5d20a5-4d12-4ff8-961c-847b5766440c_HTML20-20All20valid_invalid.html?Signature=Ymp0ntZu5HNAuoK9%2FCVPE6x3Dqw%3D&Expires=1622126057&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.attachments.title | string | | HTML%20-%20All%20valid_invalid.html
+action_result.data.\*.attachments.url | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.campaigns.\*.id | numeric | | 218680
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 10022
+action_result.data.\*.circles.\*.name | string | | test circle 4
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/10022/
+action_result.data.\*.comment.body | string | | This is a comment.
+action_result.data.\*.comment.created_ts | string | | 2021-04-20T09:04:26.124839
+action_result.data.\*.comment.id | numeric | | 19
+action_result.data.\*.comment.modified_ts | string | | 2021-04-20T09:04:26.124854
+action_result.data.\*.comment.resource_uri | string | | /api/v1/vulnerability/30274/comment/19/
+action_result.data.\*.comment.title | string | | comment title
+action_result.data.\*.comment.tlp | string | |
+action_result.data.\*.comment.user.avatar_s3_url | string | |
+action_result.data.\*.comment.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comment.user.email | string | `email` | test@test.com
+action_result.data.\*.comment.user.id | string | | 142
+action_result.data.\*.comment.user.is_active | boolean | | True False
+action_result.data.\*.comment.user.is_readonly | boolean | | True False
+action_result.data.\*.comment.user.must_change_password | boolean | | True False
+action_result.data.\*.comment.user.name | string | | test
+action_result.data.\*.comment.user.nickname | string | | testnickname
+action_result.data.\*.comment.user.organization.id | string | | 70
+action_result.data.\*.comment.user.organization.name | string | | test
+action_result.data.\*.comment.user.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.comment.user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.created_ts | string | | 2021-04-20T09:02:33.703401
+action_result.data.\*.cvss2_score | string | |
+action_result.data.\*.cvss3_score | string | |
+action_result.data.\*.description | string | | for analysis
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.external_references.\*.filename | string | | Bien sûr.rtf
+action_result.data.\*.external_references.\*.id | numeric | | 16545
+action_result.data.\*.external_references.\*.r_type | string | | A
+action_result.data.\*.external_references.\*.remote_api | boolean | | True False
+action_result.data.\*.external_references.\*.resource_uri | string | | /api/v1/vulnerabilityexternalreference/16545/
+action_result.data.\*.external_references.\*.s3_url | string | `url` |
+action_result.data.\*.external_references.\*.title | string | | Bien sûr.rtf
+action_result.data.\*.external_references.\*.url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | | 30274
+action_result.data.\*.incidents.\*.id | numeric | | 171066
+action_result.data.\*.intelligence.\*.asn | string | |
+action_result.data.\*.intelligence.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.intelligence.\*.confidence | numeric | | -1
+action_result.data.\*.intelligence.\*.country | string | |
+action_result.data.\*.intelligence.\*.created_by | string | |
+action_result.data.\*.intelligence.\*.created_ts | string | | 2021-05-27T12:23:59.162Z
+action_result.data.\*.intelligence.\*.description | string | |
+action_result.data.\*.intelligence.\*.expiration_ts | string | | 2021-08-25T12:23:59.083Z
+action_result.data.\*.intelligence.\*.feed_id | numeric | | 0
+action_result.data.\*.intelligence.\*.id | numeric | | 240070494
+action_result.data.\*.intelligence.\*.import_session_id | string | |
+action_result.data.\*.intelligence.\*.import_source | string | |
+action_result.data.\*.intelligence.\*.ip | string | |
+action_result.data.\*.intelligence.\*.is_anonymous | boolean | | True False
+action_result.data.\*.intelligence.\*.is_editable | boolean | | True False
+action_result.data.\*.intelligence.\*.is_public | boolean | | True False
+action_result.data.\*.intelligence.\*.itype | string | | mal_domain
+action_result.data.\*.intelligence.\*.latitude | string | |
+action_result.data.\*.intelligence.\*.longitude | string | |
+action_result.data.\*.intelligence.\*.meta.detail2 | string | | imported by user 136
+action_result.data.\*.intelligence.\*.meta.severity | string | | very-high
+action_result.data.\*.intelligence.\*.modified_ts | string | | 2021-05-27T12:24:57.292Z
+action_result.data.\*.intelligence.\*.org | string | |
+action_result.data.\*.intelligence.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.intelligence.\*.rdns | string | |
+action_result.data.\*.intelligence.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.resource_uri | string | | /api/v2/intelligence/240070494/?remote_api=true
+action_result.data.\*.intelligence.\*.retina_confidence | numeric | | -1
+action_result.data.\*.intelligence.\*.source | string | | qa.test.com
+action_result.data.\*.intelligence.\*.source_created | string | |
+action_result.data.\*.intelligence.\*.source_modified | string | |
+action_result.data.\*.intelligence.\*.source_reported_confidence | numeric | | -1
+action_result.data.\*.intelligence.\*.status | string | | active
+action_result.data.\*.intelligence.\*.subtype | string | |
+action_result.data.\*.intelligence.\*.tags.\*.id | string | | pe3
+action_result.data.\*.intelligence.\*.tags.\*.name | string | | test_playbook
+action_result.data.\*.intelligence.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.intelligence.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.tags.\*.tlp | string | | red
+action_result.data.\*.intelligence.\*.threat_type | string | | malware
+action_result.data.\*.intelligence.\*.threatscore | numeric | | 0
+action_result.data.\*.intelligence.\*.tlp | string | |
+action_result.data.\*.intelligence.\*.trusted_circle_ids | string | |
+action_result.data.\*.intelligence.\*.type | string | | domain
+action_result.data.\*.intelligence.\*.update_id | numeric | | 482449579
+action_result.data.\*.intelligence.\*.uuid | string | | 04179036-e714-4525-9ce2-b2b0d234073c
+action_result.data.\*.intelligence.\*.value | string | | www.testingtest8093.com
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_system | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.mitre_cve_url | string | `url` |
+action_result.data.\*.modified_ts | string | | 2021-04-20T09:04:24.429285
+action_result.data.\*.name | string | | updated_test_111
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.organization_id | numeric | | 70
+action_result.data.\*.owner_user.email | string | `email` | test@test.com
+action_result.data.\*.owner_user.id | string | | 142
+action_result.data.\*.owner_user.name | string | | test
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.owner_user_id | numeric | | 142
+action_result.data.\*.parent | string | |
+action_result.data.\*.publication_status | string | | reviewed
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_uri | string | | /api/v1/vulnerability/30274/
+action_result.data.\*.signatures.\*.id | numeric | | 632
+action_result.data.\*.source | string | | from action
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:55
+action_result.data.\*.source_modified | string | | 2019-05-19T10:15:23
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.ttps.\*.id | numeric | | 1573
+action_result.data.\*.update_id | numeric | | 416539
+action_result.data.\*.uuid | string | | fe06d084-a63b-4536-a748-3232ce650e85
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.vulnerability.\*.id | numeric | | 29891
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully updated vulnerability
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create actor'
Create an actor in ThreatStream
@@ -4156,137 +4346,137 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**name** | required | Name to give an actor | string |
**fields** | optional | JSON formatted string of fields to include with an actor | string |
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with an actor \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with an actor \- Note that this appends | string | `threatstream intelligence id`
-**comment** | optional | Comment to give an actor \(JSON format containing body, title, etc\.\) | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with an actor - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with an actor - Note that this appends | string | `threatstream intelligence id`
+**comment** | optional | Comment to give an actor (JSON format containing body, title, etc.) | string |
**attachment** | optional | Vault id of an attachment to add on the actor | string | `vault id` `sha1`
-**is\_public** | optional | Classification designation | boolean |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
+**is_public** | optional | Classification designation | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.attachment | string | `vault id` `sha1`
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comment | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.is\_public | boolean |
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.name | string |
-action\_result\.data\.\*\.aliases\.\*\.id | numeric |
-action\_result\.data\.\*\.aliases\.\*\.name | string |
-action\_result\.data\.\*\.aliases\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.attachment | string |
-action\_result\.data\.\*\.attachments\.filename | string |
-action\_result\.data\.\*\.attachments\.id | numeric |
-action\_result\.data\.\*\.attachments\.r\_type | string |
-action\_result\.data\.\*\.attachments\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.s3\_url | string |
-action\_result\.data\.\*\.attachments\.title | string |
-action\_result\.data\.\*\.attachments\.url | string |
-action\_result\.data\.\*\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | numeric | `threatstream campaign id`
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.\!\@\#$%^ | string |
-action\_result\.data\.\*\.comment\.body | string |
-action\_result\.data\.\*\.comment\.created\_ts | string |
-action\_result\.data\.\*\.comment\.id | numeric |
-action\_result\.data\.\*\.comment\.invalid | string |
-action\_result\.data\.\*\.comment\.modified\_ts | string |
-action\_result\.data\.\*\.comment\.remote\_api | boolean |
-action\_result\.data\.\*\.comment\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.title | string |
-action\_result\.data\.\*\.comment\.tlp | string |
-action\_result\.data\.\*\.comment\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comment\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comment\.user\.email | string | `email`
-action\_result\.data\.\*\.comment\.user\.id | string |
-action\_result\.data\.\*\.comment\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comment\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comment\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comment\.user\.name | string |
-action\_result\.data\.\*\.comment\.user\.nickname | string |
-action\_result\.data\.\*\.comment\.user\.organization\.id | string |
-action\_result\.data\.\*\.comment\.user\.organization\.name | string |
-action\_result\.data\.\*\.comment\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.user\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.goals | string |
-action\_result\.data\.\*\.id | numeric | `threatstream actor id`
-action\_result\.data\.\*\.incidents\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_team | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.personal\_motivations | string |
-action\_result\.data\.\*\.primary\_motivation | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_level | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.roles | string |
-action\_result\.data\.\*\.secondary\_motivations | string |
-action\_result\.data\.\*\.signatures\.\*\.id | numeric | `threatstream signature id`
-action\_result\.data\.\*\.soph\_desc | string |
-action\_result\.data\.\*\.soph\_type | string |
-action\_result\.data\.\*\.soph\_type | string |
-action\_result\.data\.\*\.soph\_type\.display\_name | string |
-action\_result\.data\.\*\.soph\_type\.id | numeric |
-action\_result\.data\.\*\.soph\_type\.resource\_uri | string |
-action\_result\.data\.\*\.soph\_type\.value | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_actor\_types | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttps\.\*\.id | numeric | `threatstream ttp id`
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.victims\.\*\.id | numeric |
-action\_result\.data\.\*\.victims\.\*\.name | string |
-action\_result\.data\.\*\.victims\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.victims\.\*\.value | numeric |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.vulnerability\.\*\.id | numeric | `threatstream vulnerability id`
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary\.created\_on\_cloud | boolean |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.attachment | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` | 232202446
+action_result.parameter.comment | string | | {"title": "comment title", "body": "This is a comment."}
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.fields | string | | {"description": "this is for test analysis", "is_team": True, "publication_status": "reviewed", "tags": ["testing", "actor"], "soph_type": 1, "soph_desc": "Testing actor soph desc", "source_created": "2019-04-10T10:10:55"}
+action_result.parameter.is_public | boolean | | True False
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` |
+action_result.parameter.name | string | | actor_test_1
+action_result.data.\*.aliases.\*.id | numeric | | 902
+action_result.data.\*.aliases.\*.name | string | | testing
+action_result.data.\*.aliases.\*.resource_uri | string | | /api/v1/actoralias/902/
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.attachment | string | | url
+action_result.data.\*.attachments.filename | string | | HTML%20-%20All%20valid_invalid.html
+action_result.data.\*.attachments.id | numeric | | 26632
+action_result.data.\*.attachments.r_type | string | | A
+action_result.data.\*.attachments.remote_api | boolean | | True False
+action_result.data.\*.attachments.resource_uri | string | | /api/v1/actorexternalreference/26632/?remote_api=true
+action_result.data.\*.attachments.s3_url | string | | https://test-optic.s3.user.com/userUploads/2021-05-27/20210527_131543_userId-136_c1946412-e29e-49fa-a0ed-3316c20d76af_HTML20-20All20valid_invalid.html?Signature=Q71zTevIhJsdGfPdhKZuHy4bu14%3D&Expires=1622124943&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.attachments.title | string | | HTML%20-%20All%20valid_invalid.html
+action_result.data.\*.attachments.url | string | |
+action_result.data.\*.avatar_s3_url | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.campaigns.\*.id | numeric | `threatstream campaign id` | 218680
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 10022
+action_result.data.\*.circles.\*.name | string | | test circle 4
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/10022/
+action_result.data.\*.comment.!@#$%^ | string | | This is a comment.
+action_result.data.\*.comment.body | string | | This is a comment.
+action_result.data.\*.comment.created_ts | string | | 2021-04-20T08:39:21.756188
+action_result.data.\*.comment.id | numeric | | 15
+action_result.data.\*.comment.invalid | string | | comment title
+action_result.data.\*.comment.modified_ts | string | | 2021-04-20T08:39:21.756205
+action_result.data.\*.comment.remote_api | boolean | | True False
+action_result.data.\*.comment.resource_uri | string | | /api/v1/actor/11930/comment/15/
+action_result.data.\*.comment.title | string | | comment title
+action_result.data.\*.comment.tlp | string | |
+action_result.data.\*.comment.user.avatar_s3_url | string | |
+action_result.data.\*.comment.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comment.user.email | string | `email` | test@test.com
+action_result.data.\*.comment.user.id | string | | 142
+action_result.data.\*.comment.user.is_active | boolean | | True False
+action_result.data.\*.comment.user.is_readonly | boolean | | True False
+action_result.data.\*.comment.user.must_change_password | boolean | | True False
+action_result.data.\*.comment.user.name | string | | test
+action_result.data.\*.comment.user.nickname | string | | testnickname
+action_result.data.\*.comment.user.organization.id | string | | 70
+action_result.data.\*.comment.user.organization.name | string | | test
+action_result.data.\*.comment.user.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.comment.user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.created_ts | string | | 2021-04-20T08:39:20.368888
+action_result.data.\*.description | string | | for analysis
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.goals | string | |
+action_result.data.\*.id | numeric | `threatstream actor id` | 11930
+action_result.data.\*.incidents.\*.id | numeric | `threatstream incident id` | 171066
+action_result.data.\*.intelligence.\*.id | numeric | `threatstream intelligence id` | 232202446
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_team | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2021-04-20T08:39:20.369940
+action_result.data.\*.name | string | | actor_test_1
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.organization_id | numeric | | 70
+action_result.data.\*.owner_user.email | string | `email` | test@test.com
+action_result.data.\*.owner_user.id | string | | 142
+action_result.data.\*.owner_user.name | string | | test
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.owner_user_id | numeric | | 142
+action_result.data.\*.parent | string | |
+action_result.data.\*.personal_motivations | string | |
+action_result.data.\*.primary_motivation | string | |
+action_result.data.\*.publication_status | string | | reviewed
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_level | string | |
+action_result.data.\*.resource_uri | string | | /api/v1/actor/11930/
+action_result.data.\*.roles | string | |
+action_result.data.\*.secondary_motivations | string | |
+action_result.data.\*.signatures.\*.id | numeric | `threatstream signature id` | 632
+action_result.data.\*.soph_desc | string | | Testing actor soph desc..
+action_result.data.\*.soph_type | string | |
+action_result.data.\*.soph_type | string | |
+action_result.data.\*.soph_type.display_name | string | | Innovator
+action_result.data.\*.soph_type.id | numeric | | 1
+action_result.data.\*.soph_type.resource_uri | string | | /api/v1/actorsophisticationtype/1/
+action_result.data.\*.soph_type.value | string | | I
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:55
+action_result.data.\*.source_modified | string | | 2019-05-19T10:15:23
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | | 2019-06-05T04:15:03
+action_result.data.\*.tags_v2.\*.id | string | | ywr
+action_result.data.\*.tags_v2.\*.name | string | | testing
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.threat_actor_types | string | |
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.ttps.\*.id | numeric | `threatstream ttp id` | 1573
+action_result.data.\*.uuid | string | | b58939d4-21b0-427b-bb62-6dc42391bef0
+action_result.data.\*.victims.\*.id | numeric | | 13
+action_result.data.\*.victims.\*.name | string | | Health Care
+action_result.data.\*.victims.\*.resource_uri | string | | /api/v1/victimtype/13/
+action_result.data.\*.victims.\*.value | numeric | | 12
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.vulnerability.\*.id | numeric | `threatstream vulnerability id` | 29891
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary.created_on_cloud | boolean | | True False
+action_result.message | string | | Actor created successfully. Associated intelligence : 232202446
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update actor'
Update an actor in ThreatStream
@@ -4299,212 +4489,212 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**id** | required | ID of an actor | string | `threatstream actor id`
**fields** | optional | JSON formatted string of fields to include with an actor | string |
-**local\_intelligence** | optional | Comma\-separated list of local intelligence IDs to associate with an actor \- Note that this appends | string | `threatstream intelligence id`
-**cloud\_intelligence** | optional | Comma\-separated list of remote intelligence IDs to associate with an actor \- Note that this appends | string | `threatstream intelligence id`
-**comment** | optional | Comment to give an actor \(JSON format containing body, title, etc\.\) | string |
+**local_intelligence** | optional | Comma-separated list of local intelligence IDs to associate with an actor - Note that this appends | string | `threatstream intelligence id`
+**cloud_intelligence** | optional | Comma-separated list of remote intelligence IDs to associate with an actor - Note that this appends | string | `threatstream intelligence id`
+**comment** | optional | Comment to give an actor (JSON format containing body, title, etc.) | string |
**attachment** | optional | Vault id of an attachment to add on the actor | string | `vault id` `sha1`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.attachment | string | `vault id` `sha1`
-action\_result\.parameter\.cloud\_intelligence | string | `threatstream intelligence id`
-action\_result\.parameter\.comment | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.id | string | `threatstream actor id`
-action\_result\.parameter\.local\_intelligence | string | `threatstream intelligence id`
-action\_result\.data\.\*\.aliases\.\*\.id | numeric |
-action\_result\.data\.\*\.aliases\.\*\.name | string |
-action\_result\.data\.\*\.aliases\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.assignee\_user | string |
-action\_result\.data\.\*\.attachment | string |
-action\_result\.data\.\*\.attachments\.filename | string |
-action\_result\.data\.\*\.attachments\.id | numeric |
-action\_result\.data\.\*\.attachments\.r\_type | string |
-action\_result\.data\.\*\.attachments\.remote\_api | boolean |
-action\_result\.data\.\*\.attachments\.resource\_uri | string |
-action\_result\.data\.\*\.attachments\.s3\_url | string |
-action\_result\.data\.\*\.attachments\.title | string |
-action\_result\.data\.\*\.attachments\.url | string |
-action\_result\.data\.\*\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.body\_content\_type | string |
-action\_result\.data\.\*\.campaigns\.\*\.id | numeric | `threatstream campaign id`
-action\_result\.data\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.circles\.\*\.id | string |
-action\_result\.data\.\*\.circles\.\*\.name | string |
-action\_result\.data\.\*\.circles\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.body | string |
-action\_result\.data\.\*\.comment\.created\_ts | string |
-action\_result\.data\.\*\.comment\.id | numeric |
-action\_result\.data\.\*\.comment\.modified\_ts | string |
-action\_result\.data\.\*\.comment\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.title | string |
-action\_result\.data\.\*\.comment\.tlp | string |
-action\_result\.data\.\*\.comment\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comment\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comment\.user\.email | string | `email`
-action\_result\.data\.\*\.comment\.user\.id | string |
-action\_result\.data\.\*\.comment\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comment\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comment\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comment\.user\.name | string |
-action\_result\.data\.\*\.comment\.user\.nickname | string |
-action\_result\.data\.\*\.comment\.user\.organization\.id | string |
-action\_result\.data\.\*\.comment\.user\.organization\.name | string |
-action\_result\.data\.\*\.comment\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comment\.user\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.\!\@\#$%^&\* | string |
-action\_result\.data\.\*\.comments\.body | string |
-action\_result\.data\.\*\.comments\.created\_ts | string |
-action\_result\.data\.\*\.comments\.id | numeric |
-action\_result\.data\.\*\.comments\.incorrect value | string |
-action\_result\.data\.\*\.comments\.modified\_ts | string |
-action\_result\.data\.\*\.comments\.remote\_api | boolean |
-action\_result\.data\.\*\.comments\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.title | string |
-action\_result\.data\.\*\.comments\.tlp | string |
-action\_result\.data\.\*\.comments\.user\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.comments\.user\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.comments\.user\.email | string |
-action\_result\.data\.\*\.comments\.user\.id | string |
-action\_result\.data\.\*\.comments\.user\.is\_active | boolean |
-action\_result\.data\.\*\.comments\.user\.is\_readonly | boolean |
-action\_result\.data\.\*\.comments\.user\.must\_change\_password | boolean |
-action\_result\.data\.\*\.comments\.user\.name | string |
-action\_result\.data\.\*\.comments\.user\.nickname | string |
-action\_result\.data\.\*\.comments\.user\.organization\.id | string |
-action\_result\.data\.\*\.comments\.user\.organization\.name | string |
-action\_result\.data\.\*\.comments\.user\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.comments\.user\.resource\_uri | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.embedded\_content\_type | string |
-action\_result\.data\.\*\.embedded\_content\_url | string |
-action\_result\.data\.\*\.external\_references\.\*\.filename | string |
-action\_result\.data\.\*\.external\_references\.\*\.id | numeric |
-action\_result\.data\.\*\.external\_references\.\*\.r\_type | string |
-action\_result\.data\.\*\.external\_references\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.external\_references\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.external\_references\.\*\.s3\_url | string | `url`
-action\_result\.data\.\*\.external\_references\.\*\.title | string |
-action\_result\.data\.\*\.external\_references\.\*\.url | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.goals | string |
-action\_result\.data\.\*\.id | numeric | `threatstream actor id`
-action\_result\.data\.\*\.incidents\.\*\.id | numeric | `threatstream incident id`
-action\_result\.data\.\*\.intelligence\.\*\.asn | string |
-action\_result\.data\.\*\.intelligence\.\*\.can\_add\_public\_tags | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.country | string |
-action\_result\.data\.\*\.intelligence\.\*\.created\_by | string |
-action\_result\.data\.\*\.intelligence\.\*\.created\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.description | string |
-action\_result\.data\.\*\.intelligence\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.import\_session\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.import\_source | string |
-action\_result\.data\.\*\.intelligence\.\*\.ip | string |
-action\_result\.data\.\*\.intelligence\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_editable | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.itype | string |
-action\_result\.data\.\*\.intelligence\.\*\.latitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.longitude | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.intelligence\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.intelligence\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.intelligence\.\*\.org | string |
-action\_result\.data\.\*\.intelligence\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.rdns | string |
-action\_result\.data\.\*\.intelligence\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.intelligence\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.source | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_created | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_modified | string |
-action\_result\.data\.\*\.intelligence\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.status | string |
-action\_result\.data\.\*\.intelligence\.\*\.subtype | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.category | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.org\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.tagger | string |
-action\_result\.data\.\*\.intelligence\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.threat\_type | string |
-action\_result\.data\.\*\.intelligence\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.tlp | string |
-action\_result\.data\.\*\.intelligence\.\*\.trusted\_circle\_ids | string |
-action\_result\.data\.\*\.intelligence\.\*\.type | string |
-action\_result\.data\.\*\.intelligence\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.intelligence\.\*\.uuid | string |
-action\_result\.data\.\*\.intelligence\.\*\.value | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_cloneable | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.is\_team | boolean |
-action\_result\.data\.\*\.logo\_s3\_url | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.organization\.id | string |
-action\_result\.data\.\*\.organization\.name | string |
-action\_result\.data\.\*\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.organization\_id | numeric |
-action\_result\.data\.\*\.owner\_user\.email | string | `email`
-action\_result\.data\.\*\.owner\_user\.id | string |
-action\_result\.data\.\*\.owner\_user\.name | string |
-action\_result\.data\.\*\.owner\_user\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_user\_id | numeric |
-action\_result\.data\.\*\.parent | string |
-action\_result\.data\.\*\.personal\_motivations | string |
-action\_result\.data\.\*\.primary\_motivation | string |
-action\_result\.data\.\*\.publication\_status | string |
-action\_result\.data\.\*\.published\_ts | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_level | string |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.roles | string |
-action\_result\.data\.\*\.secondary\_motivations | string |
-action\_result\.data\.\*\.signatures\.\*\.id | numeric | `threatstream signature id`
-action\_result\.data\.\*\.soph\_desc | string |
-action\_result\.data\.\*\.soph\_type | string |
-action\_result\.data\.\*\.soph\_type | string |
-action\_result\.data\.\*\.soph\_type\.display\_name | string |
-action\_result\.data\.\*\.soph\_type\.id | numeric |
-action\_result\.data\.\*\.soph\_type\.resource\_uri | string |
-action\_result\.data\.\*\.soph\_type\.value | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.starred\_by\_me | boolean |
-action\_result\.data\.\*\.starred\_total\_count | numeric |
-action\_result\.data\.\*\.start\_date | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.id | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.name | string |
-action\_result\.data\.\*\.tags\_v2\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\_v2\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_actor\_types | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.ttps\.\*\.id | numeric | `threatstream ttp id`
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.victims\.\*\.id | numeric |
-action\_result\.data\.\*\.victims\.\*\.name | string |
-action\_result\.data\.\*\.victims\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.victims\.\*\.value | numeric |
-action\_result\.data\.\*\.votes\.me | string |
-action\_result\.data\.\*\.votes\.total | numeric |
-action\_result\.data\.\*\.vulnerability\.\*\.id | numeric | `threatstream vulnerability id`
-action\_result\.data\.\*\.watched\_by\_me | boolean |
-action\_result\.data\.\*\.watched\_total\_count | numeric |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.attachment | string | `vault id` `sha1` | b10e56af7aed0446e7c87d495700118787212378
+action_result.parameter.cloud_intelligence | string | `threatstream intelligence id` |
+action_result.parameter.comment | string | | {"title": "comment title", "body": "This is a comment."}
+action_result.parameter.fields | string | | {"description": "this is for test analysis", "is_team": True, "publication_status": "reviewed", "tags": ["testing", "actor"], "soph_type": 1, "soph_desc": "Testing actor soph desc", "source_created": "2019-04-10T10:10:55"}
+action_result.parameter.id | string | `threatstream actor id` | 11930
+action_result.parameter.local_intelligence | string | `threatstream intelligence id` |
+action_result.data.\*.aliases.\*.id | numeric | | 904
+action_result.data.\*.aliases.\*.name | string | | testing
+action_result.data.\*.aliases.\*.resource_uri | string | | /api/v1/actoralias/904/
+action_result.data.\*.assignee_user | string | |
+action_result.data.\*.attachment | string | | url
+action_result.data.\*.attachments.filename | string | | unicode.zip
+action_result.data.\*.attachments.id | numeric | | 26641
+action_result.data.\*.attachments.r_type | string | | A
+action_result.data.\*.attachments.remote_api | boolean | | True False
+action_result.data.\*.attachments.resource_uri | string | | /api/v1/actorexternalreference/26641/?remote_api=true
+action_result.data.\*.attachments.s3_url | string | | https://test-optic.s3.user.com/userUploads/2021-05-27/20210527_131611_userId-136_62cde7fc-ce0b-4d74-a159-669769998dc0_unicode.zip?Signature=5e4NsfOOT8GwBc57JeNM9j0a7oU%3D&Expires=1622124971&AWSAccessKeyId=AKIAQYUTUNAKSCAMMFFH
+action_result.data.\*.attachments.title | string | | unicode.zip
+action_result.data.\*.attachments.url | string | |
+action_result.data.\*.avatar_s3_url | string | |
+action_result.data.\*.body_content_type | string | | markdown
+action_result.data.\*.campaigns.\*.id | numeric | `threatstream campaign id` | 218680
+action_result.data.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.circles.\*.id | string | | 10022
+action_result.data.\*.circles.\*.name | string | | test circle 4
+action_result.data.\*.circles.\*.resource_uri | string | | /api/v1/trustedcircle/10022/
+action_result.data.\*.comment.body | string | | This is a comment.
+action_result.data.\*.comment.created_ts | string | | 2021-04-20T08:52:19.742189
+action_result.data.\*.comment.id | numeric | | 16
+action_result.data.\*.comment.modified_ts | string | | 2021-04-20T08:52:19.742205
+action_result.data.\*.comment.resource_uri | string | | /api/v1/actor/11930/comment/16/
+action_result.data.\*.comment.title | string | | comment title
+action_result.data.\*.comment.tlp | string | |
+action_result.data.\*.comment.user.avatar_s3_url | string | |
+action_result.data.\*.comment.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comment.user.email | string | `email` | test@test.com
+action_result.data.\*.comment.user.id | string | | 142
+action_result.data.\*.comment.user.is_active | boolean | | True False
+action_result.data.\*.comment.user.is_readonly | boolean | | True False
+action_result.data.\*.comment.user.must_change_password | boolean | | True False
+action_result.data.\*.comment.user.name | string | | test
+action_result.data.\*.comment.user.nickname | string | | testnickname
+action_result.data.\*.comment.user.organization.id | string | | 70
+action_result.data.\*.comment.user.organization.name | string | | test
+action_result.data.\*.comment.user.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.comment.user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.comments.!@#$%^&\* | string | | comment title
+action_result.data.\*.comments.body | string | | This is a comment updated by user.
+action_result.data.\*.comments.created_ts | string | | 2021-05-27T13:18:34.575822
+action_result.data.\*.comments.id | numeric | | 1000000245
+action_result.data.\*.comments.incorrect value | string | | This is a comment.
+action_result.data.\*.comments.modified_ts | string | | 2021-05-27T13:18:34.575846
+action_result.data.\*.comments.remote_api | boolean | | True False
+action_result.data.\*.comments.resource_uri | string | | /api/v1/actor/1000001019/comment/1000000245/
+action_result.data.\*.comments.title | string | | updating comment title
+action_result.data.\*.comments.tlp | string | |
+action_result.data.\*.comments.user.avatar_s3_url | string | |
+action_result.data.\*.comments.user.can_share_intelligence | boolean | | True False
+action_result.data.\*.comments.user.email | string | | qa+test@qa.user.com
+action_result.data.\*.comments.user.id | string | | 136
+action_result.data.\*.comments.user.is_active | boolean | | True False
+action_result.data.\*.comments.user.is_readonly | boolean | | True False
+action_result.data.\*.comments.user.must_change_password | boolean | | True False
+action_result.data.\*.comments.user.name | string | | test
+action_result.data.\*.comments.user.nickname | string | |
+action_result.data.\*.comments.user.organization.id | string | | 67
+action_result.data.\*.comments.user.organization.name | string | | qa.test.com
+action_result.data.\*.comments.user.organization.resource_uri | string | | /api/v1/userorganization/67/
+action_result.data.\*.comments.user.resource_uri | string | | /api/v1/user/136/
+action_result.data.\*.created_ts | string | | 2021-04-20T08:39:20.368888
+action_result.data.\*.description | string | | for analysis
+action_result.data.\*.embedded_content_type | string | |
+action_result.data.\*.embedded_content_url | string | |
+action_result.data.\*.external_references.\*.filename | string | | Bien sûr.rtf
+action_result.data.\*.external_references.\*.id | numeric | | 16542
+action_result.data.\*.external_references.\*.r_type | string | | A
+action_result.data.\*.external_references.\*.remote_api | boolean | | True False
+action_result.data.\*.external_references.\*.resource_uri | string | | /api/v1/actorexternalreference/16542/
+action_result.data.\*.external_references.\*.s3_url | string | `url` |
+action_result.data.\*.external_references.\*.title | string | | Bien sûr.rtf
+action_result.data.\*.external_references.\*.url | string | |
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.goals | string | |
+action_result.data.\*.id | numeric | `threatstream actor id` | 11930
+action_result.data.\*.incidents.\*.id | numeric | `threatstream incident id` | 171066
+action_result.data.\*.intelligence.\*.asn | string | |
+action_result.data.\*.intelligence.\*.can_add_public_tags | boolean | | True False
+action_result.data.\*.intelligence.\*.confidence | numeric | | 50
+action_result.data.\*.intelligence.\*.country | string | |
+action_result.data.\*.intelligence.\*.created_by | string | | qa+test@qa.user.com
+action_result.data.\*.intelligence.\*.created_ts | string | | 2019-12-17T06:50:38.403Z
+action_result.data.\*.intelligence.\*.description | string | |
+action_result.data.\*.intelligence.\*.expiration_ts | string | | 2019-12-18T08:00:00.000Z
+action_result.data.\*.intelligence.\*.feed_id | numeric | | 0
+action_result.data.\*.intelligence.\*.id | numeric | | 171989368
+action_result.data.\*.intelligence.\*.id | numeric | | 1000001355
+action_result.data.\*.intelligence.\*.import_session_id | numeric | | 238
+action_result.data.\*.intelligence.\*.import_source | string | | test
+action_result.data.\*.intelligence.\*.ip | string | |
+action_result.data.\*.intelligence.\*.is_anonymous | boolean | | True False
+action_result.data.\*.intelligence.\*.is_editable | boolean | | True False
+action_result.data.\*.intelligence.\*.is_public | boolean | | True False
+action_result.data.\*.intelligence.\*.itype | string | | mal_email
+action_result.data.\*.intelligence.\*.latitude | string | |
+action_result.data.\*.intelligence.\*.longitude | string | |
+action_result.data.\*.intelligence.\*.meta.detail2 | string | | bifocals_deactivated_on_2019-12-18_08:00:00.243473
+action_result.data.\*.intelligence.\*.meta.severity | string | | low
+action_result.data.\*.intelligence.\*.modified_ts | string | | 2021-05-27T12:26:57.714Z
+action_result.data.\*.intelligence.\*.org | string | |
+action_result.data.\*.intelligence.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.intelligence.\*.rdns | string | |
+action_result.data.\*.intelligence.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.resource_uri | string | | /api/v2/intelligence/171989368/?remote_api=true
+action_result.data.\*.intelligence.\*.retina_confidence | numeric | | -1
+action_result.data.\*.intelligence.\*.source | string | | qa+testuser2@qa.user.com
+action_result.data.\*.intelligence.\*.source_created | string | |
+action_result.data.\*.intelligence.\*.source_modified | string | |
+action_result.data.\*.intelligence.\*.source_reported_confidence | numeric | | 50
+action_result.data.\*.intelligence.\*.status | string | | inactive
+action_result.data.\*.intelligence.\*.subtype | string | |
+action_result.data.\*.intelligence.\*.tags.\*.category | string | | user
+action_result.data.\*.intelligence.\*.tags.\*.id | string | | g8d
+action_result.data.\*.intelligence.\*.tags.\*.name | string | | test_name
+action_result.data.\*.intelligence.\*.tags.\*.org_id | string | | 67
+action_result.data.\*.intelligence.\*.tags.\*.remote_api | boolean | | True False
+action_result.data.\*.intelligence.\*.tags.\*.source_user | string | |
+action_result.data.\*.intelligence.\*.tags.\*.source_user_id | string | | 1234
+action_result.data.\*.intelligence.\*.tags.\*.tagger | string | | user
+action_result.data.\*.intelligence.\*.tags.\*.tlp | string | | white
+action_result.data.\*.intelligence.\*.threat_type | string | | malware
+action_result.data.\*.intelligence.\*.threatscore | numeric | | 10
+action_result.data.\*.intelligence.\*.tlp | string | | green
+action_result.data.\*.intelligence.\*.trusted_circle_ids | string | |
+action_result.data.\*.intelligence.\*.type | string | | email
+action_result.data.\*.intelligence.\*.update_id | numeric | | 482449590
+action_result.data.\*.intelligence.\*.uuid | string | | 628c8970-6297-4747-82fd-5660ac42a6c5
+action_result.data.\*.intelligence.\*.value | string | | test_assoi_cloud@test.com
+action_result.data.\*.is_anonymous | boolean | | True False
+action_result.data.\*.is_cloneable | string | | yes
+action_result.data.\*.is_public | boolean | | True False
+action_result.data.\*.is_team | boolean | | True False
+action_result.data.\*.logo_s3_url | string | |
+action_result.data.\*.modified_ts | string | | 2021-04-20T08:52:18.115817
+action_result.data.\*.name | string | | actor_test_2
+action_result.data.\*.organization.id | string | | 70
+action_result.data.\*.organization.name | string | | test
+action_result.data.\*.organization.resource_uri | string | | /api/v1/userorganization/70/
+action_result.data.\*.organization_id | numeric | | 70
+action_result.data.\*.owner_user.email | string | `email` | test@test.com
+action_result.data.\*.owner_user.id | string | | 142
+action_result.data.\*.owner_user.name | string | | testuser
+action_result.data.\*.owner_user.resource_uri | string | | /api/v1/user/142/
+action_result.data.\*.owner_user_id | numeric | | 142
+action_result.data.\*.parent | string | |
+action_result.data.\*.personal_motivations | string | |
+action_result.data.\*.primary_motivation | string | |
+action_result.data.\*.publication_status | string | | reviewed
+action_result.data.\*.published_ts | string | |
+action_result.data.\*.remote_api | boolean | | True False
+action_result.data.\*.resource_level | string | |
+action_result.data.\*.resource_uri | string | | /api/v1/actor/11930/
+action_result.data.\*.roles | string | |
+action_result.data.\*.secondary_motivations | string | |
+action_result.data.\*.signatures.\*.id | numeric | `threatstream signature id` | 632
+action_result.data.\*.soph_desc | string | | Testing actor soph desc..
+action_result.data.\*.soph_type | string | |
+action_result.data.\*.soph_type | string | |
+action_result.data.\*.soph_type.display_name | string | | Innovator
+action_result.data.\*.soph_type.id | numeric | | 1
+action_result.data.\*.soph_type.resource_uri | string | | /api/v1/actorsophisticationtype/1/
+action_result.data.\*.soph_type.value | string | | I
+action_result.data.\*.source_created | string | | 2019-04-10T10:10:55
+action_result.data.\*.source_modified | string | | 2019-05-19T10:15:23
+action_result.data.\*.starred_by_me | boolean | | True False
+action_result.data.\*.starred_total_count | numeric | | 0
+action_result.data.\*.start_date | string | | 2019-06-05T04:15:03
+action_result.data.\*.tags_v2.\*.id | string | | 7ms
+action_result.data.\*.tags_v2.\*.name | string | | testing
+action_result.data.\*.tags_v2.\*.org_id | numeric | | 67
+action_result.data.\*.tags_v2.\*.tlp | string | | white
+action_result.data.\*.threat_actor_types | string | |
+action_result.data.\*.tlp | string | | amber
+action_result.data.\*.ttps.\*.id | numeric | `threatstream ttp id` | 1573
+action_result.data.\*.uuid | string | | b58939d4-21b0-427b-bb62-6dc42391bef0
+action_result.data.\*.victims.\*.id | numeric | | 13
+action_result.data.\*.victims.\*.name | string | | Health Care
+action_result.data.\*.victims.\*.resource_uri | string | | /api/v1/victimtype/13/
+action_result.data.\*.victims.\*.value | numeric | | 12
+action_result.data.\*.votes.me | string | |
+action_result.data.\*.votes.total | numeric | | 0
+action_result.data.\*.vulnerability.\*.id | numeric | `threatstream vulnerability id` | 29891
+action_result.data.\*.watched_by_me | boolean | | True False
+action_result.data.\*.watched_total_count | numeric | | 0
+action_result.summary | string | |
+action_result.message | string | | Successfully updated actor
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete threat bulletin'
Delete threat bulletin in ThreatStream by ID
@@ -4515,18 +4705,18 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**threat\_bulletin\_id** | required | ID of the threat bulletin to delete | string | `threatstream threatbulletin id`
+**threat_bulletin_id** | required | ID of the threat bulletin to delete | string | `threatstream threatbulletin id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.threat\_bulletin\_id | string | `threatstream threatbulletin id`
-action\_result\.data\.\* | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.threat_bulletin_id | string | `threatstream threatbulletin id` | 10911
+action_result.data.\* | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted threat bulletin
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete vulnerability'
Delete vulnerability in ThreatStream by ID
@@ -4537,18 +4727,18 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**vulnerability\_id** | required | ID of the vulnerability to delete | string | `threatstream vulnerability id`
+**vulnerability_id** | required | ID of the vulnerability to delete | string | `threatstream vulnerability id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.vulnerability\_id | string | `threatstream vulnerability id`
-action\_result\.data\.\* | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.vulnerability_id | string | `threatstream vulnerability id` | 1000000001
+action_result.data.\* | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted vulnerability
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete actor'
Delete actor in ThreatStream by ID number
@@ -4559,18 +4749,18 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**actor\_id** | required | ID number of actor to delete | string | `threatstream actor id`
+**actor_id** | required | ID number of actor to delete | string | `threatstream actor id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.actor\_id | string | `threatstream actor id`
-action\_result\.data | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.actor_id | string | `threatstream actor id` | 15518 1000000030
+action_result.data | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted actor
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update observable'
Update an observable in ThreatStream
@@ -4578,83 +4768,83 @@ Update an observable in ThreatStream
Type: **generic**
Read only: **False**
-If any of the indicator\_type, confidence, tlp, severity, status, or expiration\_date parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered\.
+If any of the indicator_type, confidence, tlp, severity, status, or expiration_date parameter is added and is also mentioned in the fields parameter, the value given in the individual parameters is considered.
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
**id** | required | ID of the observable | string | `threatstream intelligence id`
-**indicator\_type** | optional | Indicator type to give the observable | string |
+**indicator_type** | optional | Indicator type to give the observable | string |
**confidence** | optional | Confidence to give the observable | numeric |
**tlp** | optional | Tlp to give the observable | string |
**severity** | optional | Severity to give the observable | string |
-**status** | optional | Status to give the observable \(For example, active, inactive, falsepos\) | string |
-**expiration\_date** | optional | Expiration timestamp to give the observable \(in UTC format\) | string |
+**status** | optional | Status to give the observable (For example, active, inactive, falsepos) | string |
+**expiration_date** | optional | Expiration timestamp to give the observable (in UTC format) | string |
**fields** | optional | JSON formatted string of fields to include with the observable | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.confidence | numeric |
-action\_result\.parameter\.expiration\_date | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.id | string | `threatstream intelligence id`
-action\_result\.parameter\.indicator\_type | string |
-action\_result\.parameter\.severity | string |
-action\_result\.parameter\.status | string |
-action\_result\.parameter\.tlp | string |
-action\_result\.data\.\*\.asn | string |
-action\_result\.data\.\*\.confidence | numeric |
-action\_result\.data\.\*\.country | string |
-action\_result\.data\.\*\.created\_by | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.expiration\_ts | string |
-action\_result\.data\.\*\.feed\_id | numeric |
-action\_result\.data\.\*\.id | numeric | `threatstream intelligence id`
-action\_result\.data\.\*\.import\_session\_id | string |
-action\_result\.data\.\*\.import\_source | string |
-action\_result\.data\.\*\.ip | string |
-action\_result\.data\.\*\.is\_anonymous | boolean |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.itype | string |
-action\_result\.data\.\*\.latitude | string |
-action\_result\.data\.\*\.longitude | string |
-action\_result\.data\.\*\.meta\.detail2 | string |
-action\_result\.data\.\*\.meta\.next | string |
-action\_result\.data\.\*\.meta\.previous | string |
-action\_result\.data\.\*\.meta\.severity | string |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.org | string |
-action\_result\.data\.\*\.owner\_organization\_id | numeric |
-action\_result\.data\.\*\.rdns | string |
-action\_result\.data\.\*\.remote\_api | boolean |
-action\_result\.data\.\*\.resource\_uri | string |
-action\_result\.data\.\*\.retina\_confidence | numeric |
-action\_result\.data\.\*\.source | string |
-action\_result\.data\.\*\.source\_created | string |
-action\_result\.data\.\*\.source\_modified | string |
-action\_result\.data\.\*\.source\_reported\_confidence | numeric |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.subtype | string |
-action\_result\.data\.\*\.tags\.\*\.id | string |
-action\_result\.data\.\*\.tags\.\*\.name | string |
-action\_result\.data\.\*\.tags\.\*\.org\_id | numeric |
-action\_result\.data\.\*\.tags\.\*\.remote\_api | numeric |
-action\_result\.data\.\*\.tags\.\*\.source\_user | string |
-action\_result\.data\.\*\.tags\.\*\.source\_user\_id | string |
-action\_result\.data\.\*\.tags\.\*\.tlp | string |
-action\_result\.data\.\*\.threat\_type | string |
-action\_result\.data\.\*\.threatscore | numeric |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.type | string |
-action\_result\.data\.\*\.update\_id | numeric |
-action\_result\.data\.\*\.uuid | string |
-action\_result\.data\.\*\.value | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.confidence | numeric | | 43
+action_result.parameter.expiration_date | string | | 2021-11-09T14:55:06.097Z
+action_result.parameter.fields | string | | {"confidence": 60}
+action_result.parameter.id | string | `threatstream intelligence id` | 263745273
+action_result.parameter.indicator_type | string | | mal_email
+action_result.parameter.severity | string | | low
+action_result.parameter.status | string | | false positive
+action_result.parameter.tlp | string | | red
+action_result.data.\*.asn | string | |
+action_result.data.\*.confidence | numeric | | 37
+action_result.data.\*.country | string | |
+action_result.data.\*.created_by | string | |
+action_result.data.\*.created_ts | string | | 2021-08-10T11:48:12.678
+action_result.data.\*.expiration_ts | string | | 2022-11-09T14:55:06.097Z
+action_result.data.\*.feed_id | numeric | | 0
+action_result.data.\*.id | numeric | `threatstream intelligence id` | 255050731
+action_result.data.\*.import_session_id | string | |
+action_result.data.\*.import_source | string | |
+action_result.data.\*.ip | string | |
+action_result.data.\*.is_anonymous | boolean | | False
+action_result.data.\*.is_public | boolean | | False
+action_result.data.\*.itype | string | | apt_email
+action_result.data.\*.latitude | string | |
+action_result.data.\*.longitude | string | |
+action_result.data.\*.meta.detail2 | string | | imported by user 136
+action_result.data.\*.meta.next | string | |
+action_result.data.\*.meta.previous | string | |
+action_result.data.\*.meta.severity | string | | medium
+action_result.data.\*.modified_ts | string | | 2021-08-12T11:02:35.625
+action_result.data.\*.org | string | |
+action_result.data.\*.owner_organization_id | numeric | | 67
+action_result.data.\*.rdns | string | |
+action_result.data.\*.remote_api | boolean | | True
+action_result.data.\*.resource_uri | string | |
+action_result.data.\*.retina_confidence | numeric | | -1
+action_result.data.\*.source | string | | test.source.com
+action_result.data.\*.source_created | string | |
+action_result.data.\*.source_modified | string | |
+action_result.data.\*.source_reported_confidence | numeric | | 37
+action_result.data.\*.status | string | | active
+action_result.data.\*.subtype | string | |
+action_result.data.\*.tags.\*.id | string | | dxd
+action_result.data.\*.tags.\*.name | string | | test2
+action_result.data.\*.tags.\*.org_id | numeric | | 67
+action_result.data.\*.tags.\*.remote_api | numeric | | True
+action_result.data.\*.tags.\*.source_user | string | | Customer
+action_result.data.\*.tags.\*.source_user_id | string | | 1234
+action_result.data.\*.tags.\*.tlp | string | | red
+action_result.data.\*.threat_type | string | | apt
+action_result.data.\*.threatscore | numeric | | 28
+action_result.data.\*.tlp | string | | green
+action_result.data.\*.type | string | | email
+action_result.data.\*.update_id | numeric | | 539165917
+action_result.data.\*.uuid | string | | 6ae8e41a-6fa1-43fb-bd08-02c1babf7fa0
+action_result.data.\*.value | string | | 55test@test.com
+action_result.summary | string | |
+action_result.message | string | | Successfully updated observable
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'create investigation'
Create an investigation in ThreatStream
@@ -4668,61 +4858,61 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**name** | required | Name to give the investigation | string |
**priority** | required | Priority assigned to the investigation | string |
**fields** | optional | JSON formatted string of fields to include with the investigation | string |
-**create\_on\_cloud** | optional | Create on remote \(cloud\)? \(applicable only for hybrid on\-prem instances\) | boolean |
+**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.create\_on\_cloud | boolean |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.name | string |
-action\_result\.parameter\.priority | string |
-action\_result\.data\.\*\.assignee | string |
-action\_result\.data\.\*\.attachments | string |
-action\_result\.data\.\*\.candidate\_session | string |
-action\_result\.data\.\*\.circles | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.elements | numeric |
-action\_result\.data\.\*\.graph\_content | string |
-action\_result\.data\.\*\.id | numeric | `threatstream investigation id`
-action\_result\.data\.\*\.import\_sessions | string |
-action\_result\.data\.\*\.investigation\_attachments | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.owner\_org\.id | string |
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\_id | string | `id`
-action\_result\.data\.\*\.priority | string |
-action\_result\.data\.\*\.reporter\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.reporter\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.reporter\.email | string | `email`
-action\_result\.data\.\*\.reporter\.id | string | `id`
-action\_result\.data\.\*\.reporter\.is\_active | boolean |
-action\_result\.data\.\*\.reporter\.is\_readonly | boolean |
-action\_result\.data\.\*\.reporter\.must\_change\_password | boolean |
-action\_result\.data\.\*\.reporter\.name | string |
-action\_result\.data\.\*\.reporter\.nickname | string |
-action\_result\.data\.\*\.reporter\.organization\.id | string | `id`
-action\_result\.data\.\*\.reporter\.organization\.name | string |
-action\_result\.data\.\*\.reporter\.organization\.resource\_uri | string | `url`
-action\_result\.data\.\*\.reporter\.resource\_uri | string | `url`
-action\_result\.data\.\*\.reporter\_id | numeric | `id`
-action\_result\.data\.\*\.resource\_uri | string | `url`
-action\_result\.data\.\*\.source\_type | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tips | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.workgroups | string |
-action\_result\.data\.tasks | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.create_on_cloud | boolean | | True False
+action_result.parameter.fields | string | | {"tlp": "red"}
+action_result.parameter.name | string | | new_investigation
+action_result.parameter.priority | string | | low
+action_result.data.\*.assignee | string | |
+action_result.data.\*.attachments | string | |
+action_result.data.\*.candidate_session | string | |
+action_result.data.\*.circles | string | |
+action_result.data.\*.created_ts | string | | 2020-05-28T00:39:25.453003
+action_result.data.\*.description | string | | this is a low priority investigation
+action_result.data.\*.elements | numeric | | 0
+action_result.data.\*.graph_content | string | |
+action_result.data.\*.id | numeric | `threatstream investigation id` | 0
+action_result.data.\*.import_sessions | string | |
+action_result.data.\*.investigation_attachments | string | |
+action_result.data.\*.is_public | boolean | | False
+action_result.data.\*.modified_ts | string | | 2020-05-21T18:53:11.233187
+action_result.data.\*.name | string | | Blank Investigation Two
+action_result.data.\*.owner_org.id | string | | 2342
+action_result.data.\*.owner_org.name | string | | test.us
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/2342/
+action_result.data.\*.owner_org_id | string | `id` |
+action_result.data.\*.priority | string | | low
+action_result.data.\*.reporter.avatar_s3_url | string | |
+action_result.data.\*.reporter.can_share_intelligence | boolean | | True
+action_result.data.\*.reporter.email | string | `email` | user@test.us
+action_result.data.\*.reporter.id | string | `id` | 6941
+action_result.data.\*.reporter.is_active | boolean | | True
+action_result.data.\*.reporter.is_readonly | boolean | | True
+action_result.data.\*.reporter.must_change_password | boolean | | True
+action_result.data.\*.reporter.name | string | |
+action_result.data.\*.reporter.nickname | string | | EAlezeb
+action_result.data.\*.reporter.organization.id | string | `id` | 2324
+action_result.data.\*.reporter.organization.name | string | | test.us
+action_result.data.\*.reporter.organization.resource_uri | string | `url` | /api/v1/userorganization/2342/
+action_result.data.\*.reporter.resource_uri | string | `url` | /api/v1/user/6941/
+action_result.data.\*.reporter_id | numeric | `id` | 6941
+action_result.data.\*.resource_uri | string | `url` | /api/v1/investigation/56198/
+action_result.data.\*.source_type | string | | user
+action_result.data.\*.status | string | | unassigned
+action_result.data.\*.tags | string | |
+action_result.data.\*.tips | string | |
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.workgroups | string | |
+action_result.data.tasks | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully created investigation
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'list investigations'
List investigations present in ThreatStream
@@ -4736,46 +4926,46 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**limit** | optional | Total number of investigations to return | numeric |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.limit | numeric |
-action\_result\.data\.\*\.assignee | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.elements | numeric |
-action\_result\.data\.\*\.id | numeric | `investigation id`
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.owner\_org\.id | string | `id`
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string |
-action\_result\.data\.\*\.owner\_org\_id | string |
-action\_result\.data\.\*\.priority | string |
-action\_result\.data\.\*\.reporter\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.reporter\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.reporter\.email | string | `email`
-action\_result\.data\.\*\.reporter\.id | string | `id`
-action\_result\.data\.\*\.reporter\.is\_active | boolean |
-action\_result\.data\.\*\.reporter\.is\_readonly | boolean |
-action\_result\.data\.\*\.reporter\.must\_change\_password | boolean |
-action\_result\.data\.\*\.reporter\.name | string |
-action\_result\.data\.\*\.reporter\.nickname | string |
-action\_result\.data\.\*\.reporter\.organization\.id | string | `id`
-action\_result\.data\.\*\.reporter\.organization\.name | string |
-action\_result\.data\.\*\.reporter\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.reporter\.resource\_uri | string | `url`
-action\_result\.data\.\*\.reporter\_id | numeric | `id`
-action\_result\.data\.\*\.resource\_uri | string | `url`
-action\_result\.data\.\*\.source\_type | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.workgroups | string |
-action\_result\.summary\.investigations\_returned | numeric |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.limit | numeric | | 1000
+action_result.data.\*.assignee | string | |
+action_result.data.\*.created_ts | string | | 2020-05-28T23:47:44.391824
+action_result.data.\*.elements | numeric | | 0
+action_result.data.\*.id | numeric | `investigation id` | 0
+action_result.data.\*.is_public | boolean | | False
+action_result.data.\*.modified_ts | string | | 2020-05-28T23:47:44.391824
+action_result.data.\*.name | string | | Blank Investigation Two
+action_result.data.\*.owner_org.id | string | `id` | 2342
+action_result.data.\*.owner_org.name | string | | test.us
+action_result.data.\*.owner_org.resource_uri | string | | /api/v1/userorganization/2342/
+action_result.data.\*.owner_org_id | string | |
+action_result.data.\*.priority | string | | low
+action_result.data.\*.reporter.avatar_s3_url | string | |
+action_result.data.\*.reporter.can_share_intelligence | boolean | | True
+action_result.data.\*.reporter.email | string | `email` | user@test.us
+action_result.data.\*.reporter.id | string | `id` | 6941
+action_result.data.\*.reporter.is_active | boolean | | True
+action_result.data.\*.reporter.is_readonly | boolean | | True
+action_result.data.\*.reporter.must_change_password | boolean | | True
+action_result.data.\*.reporter.name | string | |
+action_result.data.\*.reporter.nickname | string | |
+action_result.data.\*.reporter.organization.id | string | `id` | 2324
+action_result.data.\*.reporter.organization.name | string | | test.us
+action_result.data.\*.reporter.organization.resource_uri | string | | /api/v1/userorganization/2342/
+action_result.data.\*.reporter.resource_uri | string | `url` | /api/v1/user/6941/
+action_result.data.\*.reporter_id | numeric | `id` | 6941
+action_result.data.\*.resource_uri | string | `url` | /api/v1/investigation/56953/
+action_result.data.\*.source_type | string | | user
+action_result.data.\*.status | string | | unassigned
+action_result.data.\*.tags | string | |
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.workgroups | string | |
+action_result.summary.investigations_returned | numeric | | 1000
+action_result.message | string | | Investigations returned: 1000
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'get investigation'
Retrieve investigation present in Threatstream by ID
@@ -4786,58 +4976,58 @@ Read only: **True**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**investigation\_id** | required | ID of the investigation to retrieve | numeric | `threatstream investigation id`
+**investigation_id** | required | ID of the investigation to retrieve | numeric | `threatstream investigation id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.investigation\_id | numeric | `threatstream investigation id`
-action\_result\.data\.\*\.assignee | string |
-action\_result\.data\.\*\.attachments | string |
-action\_result\.data\.\*\.candidate\_session | string |
-action\_result\.data\.\*\.circles | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.elements | numeric |
-action\_result\.data\.\*\.graph\_content | string |
-action\_result\.data\.\*\.id | numeric | `id`
-action\_result\.data\.\*\.import\_sessions | string |
-action\_result\.data\.\*\.investigation\_attachments | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.owner\_org\.id | string | `id`
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string | `url`
-action\_result\.data\.\*\.owner\_org\_id | string | `id`
-action\_result\.data\.\*\.priority | string |
-action\_result\.data\.\*\.reporter\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.reporter\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.reporter\.email | string | `email`
-action\_result\.data\.\*\.reporter\.id | string | `id`
-action\_result\.data\.\*\.reporter\.is\_active | boolean |
-action\_result\.data\.\*\.reporter\.is\_readonly | boolean |
-action\_result\.data\.\*\.reporter\.must\_change\_password | boolean |
-action\_result\.data\.\*\.reporter\.name | string |
-action\_result\.data\.\*\.reporter\.nickname | string |
-action\_result\.data\.\*\.reporter\.organization\.id | string | `id`
-action\_result\.data\.\*\.reporter\.organization\.name | string |
-action\_result\.data\.\*\.reporter\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.reporter\.resource\_uri | string |
-action\_result\.data\.\*\.reporter\_id | numeric | `id`
-action\_result\.data\.\*\.resource\_uri | string | `url`
-action\_result\.data\.\*\.source\_type | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tips | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.workgroups | string |
-action\_result\.data\.tasks | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.investigation_id | numeric | `threatstream investigation id` | 56198
+action_result.data.\*.assignee | string | |
+action_result.data.\*.attachments | string | |
+action_result.data.\*.candidate_session | string | |
+action_result.data.\*.circles | string | |
+action_result.data.\*.created_ts | string | | 2020-05-21T18:53:11.233187
+action_result.data.\*.description | string | | this is a low priority investigation
+action_result.data.\*.elements | numeric | | 0
+action_result.data.\*.graph_content | string | |
+action_result.data.\*.id | numeric | `id` | 0
+action_result.data.\*.import_sessions | string | |
+action_result.data.\*.investigation_attachments | string | |
+action_result.data.\*.is_public | boolean | | False
+action_result.data.\*.modified_ts | string | | 2020-05-21T18:53:11.233187
+action_result.data.\*.name | string | | Blank Investigation Two
+action_result.data.\*.owner_org.id | string | `id` | 2342
+action_result.data.\*.owner_org.name | string | | test.us
+action_result.data.\*.owner_org.resource_uri | string | `url` | /api/v1/userorganization/2342/
+action_result.data.\*.owner_org_id | string | `id` |
+action_result.data.\*.priority | string | | low
+action_result.data.\*.reporter.avatar_s3_url | string | |
+action_result.data.\*.reporter.can_share_intelligence | boolean | | True
+action_result.data.\*.reporter.email | string | `email` | user@test.us
+action_result.data.\*.reporter.id | string | `id` | 6941
+action_result.data.\*.reporter.is_active | boolean | | True
+action_result.data.\*.reporter.is_readonly | boolean | | True
+action_result.data.\*.reporter.must_change_password | boolean | | True
+action_result.data.\*.reporter.name | string | |
+action_result.data.\*.reporter.nickname | string | | EAlezeb
+action_result.data.\*.reporter.organization.id | string | `id` | 2324
+action_result.data.\*.reporter.organization.name | string | | test.us
+action_result.data.\*.reporter.organization.resource_uri | string | | /api/v1/userorganization/2342/
+action_result.data.\*.reporter.resource_uri | string | | /api/v1/user/6941/
+action_result.data.\*.reporter_id | numeric | `id` | 6941
+action_result.data.\*.resource_uri | string | `url` | /api/v1/investigation/56198/
+action_result.data.\*.source_type | string | | user
+action_result.data.\*.status | string | | unassigned
+action_result.data.\*.tags | string | |
+action_result.data.\*.tips | string | |
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.workgroups | string | |
+action_result.data.tasks | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully retrieved investigation
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'update investigation'
Update an investigation in ThreatStream
@@ -4848,60 +5038,60 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**investigation\_id** | required | ID of the investigation to update | numeric | `threatstream investigation id`
+**investigation_id** | required | ID of the investigation to update | numeric | `threatstream investigation id`
**fields** | required | JSON formatted string of fields to include with the investigation | string |
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.fields | string |
-action\_result\.parameter\.investigation\_id | numeric | `threatstream investigation id`
-action\_result\.data\.\*\.assignee | string |
-action\_result\.data\.\*\.attachments | string |
-action\_result\.data\.\*\.candidate\_session | string |
-action\_result\.data\.\*\.circles | string |
-action\_result\.data\.\*\.created\_ts | string |
-action\_result\.data\.\*\.description | string |
-action\_result\.data\.\*\.elements | numeric |
-action\_result\.data\.\*\.graph\_content | string |
-action\_result\.data\.\*\.id | numeric | `id`
-action\_result\.data\.\*\.import\_sessions | string |
-action\_result\.data\.\*\.investigation\_attachments | string |
-action\_result\.data\.\*\.is\_public | boolean |
-action\_result\.data\.\*\.modified\_ts | string |
-action\_result\.data\.\*\.name | string |
-action\_result\.data\.\*\.owner\_org\.id | string | `id`
-action\_result\.data\.\*\.owner\_org\.name | string |
-action\_result\.data\.\*\.owner\_org\.resource\_uri | string | `url`
-action\_result\.data\.\*\.owner\_org\_id | string | `id`
-action\_result\.data\.\*\.priority | string |
-action\_result\.data\.\*\.reporter\.avatar\_s3\_url | string |
-action\_result\.data\.\*\.reporter\.can\_share\_intelligence | boolean |
-action\_result\.data\.\*\.reporter\.email | string | `email`
-action\_result\.data\.\*\.reporter\.id | string | `id`
-action\_result\.data\.\*\.reporter\.is\_active | boolean |
-action\_result\.data\.\*\.reporter\.is\_readonly | boolean |
-action\_result\.data\.\*\.reporter\.must\_change\_password | boolean |
-action\_result\.data\.\*\.reporter\.name | string |
-action\_result\.data\.\*\.reporter\.nickname | string |
-action\_result\.data\.\*\.reporter\.organization\.id | string | `id`
-action\_result\.data\.\*\.reporter\.organization\.name | string |
-action\_result\.data\.\*\.reporter\.organization\.resource\_uri | string |
-action\_result\.data\.\*\.reporter\.resource\_uri | string | `url`
-action\_result\.data\.\*\.reporter\_id | numeric | `id`
-action\_result\.data\.\*\.resource\_uri | string | `url`
-action\_result\.data\.\*\.source\_type | string |
-action\_result\.data\.\*\.status | string |
-action\_result\.data\.\*\.tags | string |
-action\_result\.data\.\*\.tips | string |
-action\_result\.data\.\*\.tlp | string |
-action\_result\.data\.\*\.workgroups | string |
-action\_result\.data\.tasks | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.fields | string | | {"tlp": "red"}
+action_result.parameter.investigation_id | numeric | `threatstream investigation id` | 56198
+action_result.data.\*.assignee | string | |
+action_result.data.\*.attachments | string | |
+action_result.data.\*.candidate_session | string | |
+action_result.data.\*.circles | string | |
+action_result.data.\*.created_ts | string | | 2020-05-28T00:39:25.453003
+action_result.data.\*.description | string | | this is a low priority investigation
+action_result.data.\*.elements | numeric | | 0
+action_result.data.\*.graph_content | string | |
+action_result.data.\*.id | numeric | `id` | 0
+action_result.data.\*.import_sessions | string | |
+action_result.data.\*.investigation_attachments | string | |
+action_result.data.\*.is_public | boolean | | False
+action_result.data.\*.modified_ts | string | | 2020-05-21T18:53:11.233187
+action_result.data.\*.name | string | | Blank Investigation Two
+action_result.data.\*.owner_org.id | string | `id` | 2342
+action_result.data.\*.owner_org.name | string | | test.us
+action_result.data.\*.owner_org.resource_uri | string | `url` | /api/v1/userorganization/2342/
+action_result.data.\*.owner_org_id | string | `id` |
+action_result.data.\*.priority | string | | low
+action_result.data.\*.reporter.avatar_s3_url | string | |
+action_result.data.\*.reporter.can_share_intelligence | boolean | | True
+action_result.data.\*.reporter.email | string | `email` | user@test.us
+action_result.data.\*.reporter.id | string | `id` | 6941
+action_result.data.\*.reporter.is_active | boolean | | True
+action_result.data.\*.reporter.is_readonly | boolean | | True
+action_result.data.\*.reporter.must_change_password | boolean | | True
+action_result.data.\*.reporter.name | string | |
+action_result.data.\*.reporter.nickname | string | | EAlezeb
+action_result.data.\*.reporter.organization.id | string | `id` | 2324
+action_result.data.\*.reporter.organization.name | string | | test.us
+action_result.data.\*.reporter.organization.resource_uri | string | | /api/v1/userorganization/2342/
+action_result.data.\*.reporter.resource_uri | string | `url` | /api/v1/user/6941/
+action_result.data.\*.reporter_id | numeric | `id` | 6941
+action_result.data.\*.resource_uri | string | `url` | /api/v1/investigation/56198/
+action_result.data.\*.source_type | string | | user
+action_result.data.\*.status | string | | unassigned
+action_result.data.\*.tags | string | |
+action_result.data.\*.tips | string | |
+action_result.data.\*.tlp | string | | red
+action_result.data.\*.workgroups | string | |
+action_result.data.tasks | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully updated investigation
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
## action: 'delete investigation'
Delete investigation in ThreatStream by ID number
@@ -4912,15 +5102,15 @@ Read only: **False**
#### Action Parameters
PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
--------- | -------- | ----------- | ---- | --------
-**investigation\_id** | required | ID number of investigation to delete | numeric | `threatstream investigation id`
+**investigation_id** | required | ID number of investigation to delete | numeric | `threatstream investigation id`
#### Action Output
-DATA PATH | TYPE | CONTAINS
---------- | ---- | --------
-action\_result\.status | string |
-action\_result\.parameter\.investigation\_id | numeric | `threatstream investigation id`
-action\_result\.data | string |
-action\_result\.summary | string |
-action\_result\.message | string |
-summary\.total\_objects | numeric |
-summary\.total\_objects\_successful | numeric |
\ No newline at end of file
+DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
+--------- | ---- | -------- | --------------
+action_result.status | string | | success failed
+action_result.parameter.investigation_id | numeric | `threatstream investigation id` | 56911
+action_result.data | string | |
+action_result.summary | string | |
+action_result.message | string | | Successfully deleted investigation
+summary.total_objects | numeric | | 1
+summary.total_objects_successful | numeric | | 1
\ No newline at end of file
From a0c38f7134117b87781e94a71c00e6fc053d0585 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 09:17:06 +0100
Subject: [PATCH 10/34] Updated release notes
---
release_notes/unreleased.md | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md
index fbcb2fd..12157d9 100644
--- a/release_notes/unreleased.md
+++ b/release_notes/unreleased.md
@@ -1 +1,5 @@
**Unreleased**
+
+* Feature that allows custom Observable Types to be used in import observables action
+ * Validation for default types has been removed
+ * Action no longer has dropdown, now information about default types is visible in description
From 17bd119f74cd6553108264f0bf053e7af32619b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 09:18:46 +0100
Subject: [PATCH 11/34] formatting fix
---
threatstream_connector.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/threatstream_connector.py b/threatstream_connector.py
index 76d58ba..7412093 100644
--- a/threatstream_connector.py
+++ b/threatstream_connector.py
@@ -131,7 +131,7 @@ def __init__(self):
self._is_cloud_instance = None
self._first_run_limit = None
self._data_dict = {} # Blank dict to contain data from all API calls
-
+
def _save_action_handler_progress(self):
self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
From cb65a3e558047dafb57e5137007cb571ba1480ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 12:17:21 +0100
Subject: [PATCH 12/34] Reverted contains values in json
---
threatstream.json | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/threatstream.json b/threatstream.json
index ca38461..7fd3ff4 100644
--- a/threatstream.json
+++ b/threatstream.json
@@ -18,7 +18,7 @@
"product_name": "ThreatStream",
"product_version_regex": ".*",
"python_version": "3",
- "min_phantom_version": "5.3.3",
+ "min_phantom_version": "5.5.0",
"fips_compliant": true,
"license": "Copyright (c) 2016-2023 Splunk Inc.",
"pip_dependencies": {
@@ -8318,11 +8318,6 @@
"description": "Unresolved domains will be imported if set to true",
"data_type": "boolean",
"order": 6
- },
- "allow_custom_type": {
- "description": "Allows upload of custom observable_type",
- "data_type": "boolean",
- "order": 6
}
},
"output": [
From c0a51fe9b8abbed8cde333a829dda8fc5994f5ca Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Fri, 1 Dec 2023 11:17:55 +0000
Subject: [PATCH 13/34] Update README.md
---
README.md | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/README.md b/README.md
index 2d99357..100b337 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Connector Version: 3.5.1
Product Vendor: Anomali
Product Name: ThreatStream
Product Version Supported (regex): ".\*"
-Minimum Product Version: 5.3.3
+Minimum Product Version: 5.5.0
Integrates a variety of generic, reputation, and investigative actions from the Anomali ThreatStream threat intelligence platform
@@ -1968,7 +1968,6 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS
**create_on_cloud** | optional | Create on remote (cloud)? (applicable only for hybrid on-prem instances) | boolean |
**with_approval** | optional | Import the observable with approvals | boolean |
**allow_unresolved** | optional | Unresolved domains will be imported if set to true | boolean |
-**allow_custom_type** | optional | Allows upload of custom observable_type | boolean |
#### Action Output
DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES
From 7deebacd9e6bedd0b52cc6f4cf1f2fbd616d3124 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Fri, 1 Dec 2023 12:26:30 +0100
Subject: [PATCH 14/34] removed experimental params
---
threatstream.json | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/threatstream.json b/threatstream.json
index 7fd3ff4..4bd287b 100644
--- a/threatstream.json
+++ b/threatstream.json
@@ -131,22 +131,6 @@
"data_type": "boolean",
"order": 4,
"description": "Verify server certificate"
- },
- "custom_types_str": {
- "data_type": "string",
- "order": 0,
- "description": "Specify additional types"
- },
- "custom_types": {
- "data_type": "array",
- "order": 0,
- "items": [
- {
- "data_type": "string",
- "description": "type"
- }
- ],
- "description": "Specify additional types"
}
},
"actions": [
From c1ea03e0eedfa572e9e34f0c4060de2655f02654 Mon Sep 17 00:00:00 2001
From: splunk-soar-connectors-admin
Date: Fri, 1 Dec 2023 11:27:06 +0000
Subject: [PATCH 15/34] Update README.md
---
README.md | 2 --
1 file changed, 2 deletions(-)
diff --git a/README.md b/README.md
index 100b337..f4e041c 100644
--- a/README.md
+++ b/README.md
@@ -306,8 +306,6 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
**ingest_only_published_incidents** | optional | boolean | Ingest only incidents marked as published
**is_cloud_instance** | optional | boolean | Is the provided instance in hostname parameter cloud?
**verify_server_cert** | optional | boolean | Verify server certificate
-**custom_types_str** | optional | string | Specify additional types
-**custom_types** | optional | array | Specify additional types
### Supported Actions
[test connectivity](#action-test-connectivity) - Test connectivity to ThreatStream by querying the intelligence endpoint
From c4b8528b05ae1a2051129d839816072125b7a9b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Pos=C5=82uszny?=
Date: Thu, 7 Dec 2023 12:21:00 +0100
Subject: [PATCH 16/34] applied proposed changes
---
threatstream.json | 4 ++--
threatstream_connector.py | 2 +-
wheels/py3/certifi-2023.11.17-py3-none-any.whl | Bin 0 -> 162530 bytes
wheels/py3/soupsieve-2.5-py3-none-any.whl | Bin 0 -> 36131 bytes
.../urllib3-1.26.18-py2.py3-none-any.whl | Bin 0 -> 143835 bytes
5 files changed, 3 insertions(+), 3 deletions(-)
create mode 100644 wheels/py3/certifi-2023.11.17-py3-none-any.whl
create mode 100644 wheels/py3/soupsieve-2.5-py3-none-any.whl
create mode 100644 wheels/shared/urllib3-1.26.18-py2.py3-none-any.whl
diff --git a/threatstream.json b/threatstream.json
index 4bd287b..f77651c 100644
--- a/threatstream.json
+++ b/threatstream.json
@@ -5,7 +5,7 @@
"publisher": "Splunk",
"type": "threat intel",
"main_module": "threatstream_connector.py",
- "app_version": "3.5.1",
+ "app_version": "3.5.0",
"latest_tested_versions": [
"On-premise v4.0 RED",
"Cloud, 26 September 2022"
@@ -8251,7 +8251,7 @@
"read_only": false,
"parameters": {
"observable_type": {
- "description": "Type of observable to import, default types: [ip, domain, url, email, hash]. Custom types can be provided if they are available on ThreatStream instance",
+ "description": "Type of observable to import, types supported by default: [ip, domain, url, email, hash]. Custom types can also be provided if they are available on ThreatStream instance",
"data_type": "string",
"order": 0,
"required": true
diff --git a/threatstream_connector.py b/threatstream_connector.py
index 7412093..c85e619 100644
--- a/threatstream_connector.py
+++ b/threatstream_connector.py
@@ -133,7 +133,7 @@ def __init__(self):
self._data_dict = {} # Blank dict to contain data from all API calls
def _save_action_handler_progress(self):
- self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
+ self.save_progress(f"In action handler for: {self.get_action_identifier()}")
def initialize(self):
config = self.get_config()
diff --git a/wheels/py3/certifi-2023.11.17-py3-none-any.whl b/wheels/py3/certifi-2023.11.17-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..de0787f6431bf157c306c086de4e108cbad95bca
GIT binary patch
literal 162530
zcmZUZGng(6u%y4SZQHhOTW4(ZjBVTI8QZpP+qQlG-DvN#K?N1{+tooOttbNmiV6S#
zAOVHwP8#-n8X?O6Ilcdc@}G=Not!PrEE)9mE$u9w_4Vl;JY;AlX4U3oW*DT^#-`}T
z7^sybXJ%=nrfH~FlqhE<>7eRy31Er|XDJcVrQ;Y&0Ov}ZFGu}N6
z*rdh5#Ya3tLp?)Jq;&v_{|kZe?qMzEztNBXAA+r+rQQEUkc(A<4q}82-Svu`qky>p
z0_VR1?+i%B);0JeMcnygq%rz|oOwH&HrHXU9^Q480G5-*RU03lVg~%NkjybGR~+(+
zvMx+E$@q2h!NV|Wl_5bSSC+spzlcd=?VaWg({o8*@NJ|#vAHM4a#-e_k1#_%bhWHB
zVTts}ojF^*pdXtB;>D9h*XAh)39ldcTb1n_i15F+n8=cWy*391T-bsFkpG_`jSc@#
zr1TD^wo~0&jYX1~bRRRdkUXcwo6ZUm9`Rayj4-6}g0O*U)>DLnlKz5sm$gNFL-9P!
zjTN2OTTN?N(4*Uqh;M%`v)G?{d#Q9^B{!xy^nOcq*bEhOBCkHCZ8CpwW_@|S*4*)a
z6fnGb)_%POpucbJOC{W;3V(L-dJqQwZFqm``{91{rj94IK=v7Ck3d3?C`OJzg$7b3
zni!-D8sa|9gC1n5>NNiAZXQOX1(jjvtS6d-6Sgrh6CuO_-zFU+|Hm%c)n5jeWG8GQ
zqJopWKG*M*Nf-6S3&DvmjuW~yw@*I8LDge;02g65XMi$?L%udQM()D{(vVHv$06BO
zFb{{)JspO8G|NI>8-eH^G?)dt8@vx*#Zt)5*%6U07f8o4vIZ`d>XCLH2q$kZ>?E>)
zbI_a|ydkntKZ8H|Yu9LqfStMzjzsx{wxUua2{IMA5-W);FJhGZ0Vx(+?P
zrnJ8%yZ-m;Qb4}p(||NuiILZ3^-Y>zl-oKS*}SfZCCV#?&NN)iCSj6ohw{4Arrw->
z5ii!3Rw=p@QSDK2!Ja?Te1G|pMAbVI*vtKLQ46;aUNIai11L(t!|b~iB$F&v0HMX&
zEZjq$k(NC{Je?DgwgBotrL&IYACwLNn_>
z0oIs;zulIS1?;F@fyUu5j2PwYr|L9wJXZMSq6uU44Yd%qDxAACW1AAE*44r8nav#w
zrW;)5;?9@KI5i?
zez38xnObu@`T9?n+vf&S42sC41WN6pr|-=D*Hy}P_)lSw?UiGEEK<-35J%o
z>!#+N{G!3BQLQ5_za_i51S&CaE^kOR!g5596fC`QtlfRs-||`K_HLo@O}&m1(j1wH
zup$WzC$t-B*$yHKUe%gE-Sp?@j%JZd{CH|;wI7U;rVGr+)gC~3`8QSs4-zLB-HTxz
zK{6bzghe)PoUlm~=cABZTEuoq%xvTzJKKMEM2FrEBlyp&V7bv6lorx!@z8H8=ShbK
zT-i9F#>}-N*=kLHViS(MJRE&`_{dJUARFeMUZ9lchU-h@rMaR_F|DKEaC4qDkEg=F?{L->`bH*fdOO54ljSZK`6!)5OJdLed
zWl_}KA$%u{3-5@gaaL_uW3x*7Ju~xyWGJ+75y#kDCSp^MelnQkbo25334h5>IZ0l4
zZkzLHvuos5Vcbid$&HS;Q@35krzHpz+0`vqkp_k55i`;~IxXF8D?`_;536d+3RgZ!yb$QfCcHVc)1RHv64!}`APM*auR{P%sf
zl}>IcM8M8sPN9rU@AGB;`L~T6z>(O(us{s`QP}QlOyINABqreVi2y)<@&o4lsAmx@
zbj1Bl@V5W+IJ)@T>HMv(Q&iIZeW=apW1aLwu=`U)eNlMZqb7#bw`qS5p*{*;PK`T@0Voq#)^8~#2G-my^=vahcC
zt{1d`Q%|8LHhC>}iiFu_K9demT-_Y5lZY@s_T13Enw|dTm3qu5ibCkx6VyBxcYPGK
zDV9LGb1Hwyx4yp|lvU3}9SwjFRpIrD6#cz*dEXu3*1)2OOJEJ^7qNF$x|fH54Q>A3
zEBUKOgA~wz;WH#V6_UYNadoZ$`5w3z-NW+ft4EM|x8vIHC+dz&jRQ@d1{ysN?c>9PXSEk$#o45|LZla!Hqq#~YM5JkD5V-`yX;yJ2uduiJ
zG~W(iAtN>*zs>*!<8~2DP{xszAt8U9(DE@j)T0zBUI!L?i3xQj+x#dp64;v7LR|K#3(7A&x+?Fwr
zP1j55<7m(e-gj57qBq)CFIT#UK>lWqEV^|%5Dgx#lXp-0HK6f&QdikgzQ{acD7vc!eF<+C_vhifm4_5he$%wkSE+S5{;-eLu$Wye
z+;Th^ZtX^|?b|q>L&+Gh^uGDiY6%>4mxWO62i7H4vr-m&f`^vwyTStFJ
z%)Q`jaRlURVpvF7y~eKx_K91LK&%a**c6YSrDdxtZ|{nP&M>7{S*krED_6kD+a!nV
zh_(~~eg^H}>f(nvCw6cjV)T7HfSVo;Xqb0aL+gDkTx$?!NXYT25gC08>%GEctd^u~
z&b8$A0*0k9C7q_G8MPK?0`nIdW_kesc>MrLFuf$ARoGg^tO7HXQMVB>0k0WqTCE%Q
zOERDL@kfXlwoY25v$n+Qp-J_y9-R81t&h8NPId9aHvIRehd4hfjt~S{Fjz>PO?15u^-%S#y{-or>
z42EWQ6^PZMsw~SOUlnyDn&%@mEIg8M9Gg$U+*DpJkBpeO;qAhnA-U2!KgCUa=6@IL
zh67CyBUjS?cu%+;@fx@<@Z93!YYr5iU3--7?I68wKWSy|jyyXWBGu4cAVrv@((5;S
zCchKKHl?n0vp^1YD3O$R$6YakDMrQ`iko0y3!5?9e8RiGMS-U;`zW*n2tKH!H?0H~
z*f%`i4Ke|CcM*OEpnkfs_zgZ=i~NEuVM!pfMayaxvG;HkQ(=3cAoDdjAe-}zU&fi&TqFF%-FQ9h8BH2w+tQijmmI~^QB`fM
zX$U1Alc25|yLl<#x(i~{y*Oio5}V-9BROf!AF*W|BTEWXRZRu|9Z>UOka{QxdS=n)
z94t+>H}hrRL6{pdWj1&Ln3Y0b+x$Q=9gHreq)Zl4P3VV}vZ)R=`j{dw50yIt;2)Ds
zh5G?)0^r=%fS(;;1J?|w2fF!%zHg7P)@=oI4F8SeU3!H4^xwl{pmd6^jSRw5ID_5f
zE`S|*TZ?`R^NkM;Ps5~R(Z2rXhCB+vVoit@5LZ%{z;d++;a78C(!lu3LpVv?pj`!s
zzW(tkD45&M`8<`^)N{=pI5PdyiRerky0UjPn>?PmK7sU<#e9hTSeOQ(kZZSis<6u=~5@)qXhU3WD7=eUc?_r08
z|ENaY{0^f@n{%A1m8_DQsM&1n>mmsE>Oe)W*Mg`0Fs|}LxT6U{osUwAYw
zEO_L1Oq*2FL>+<_@wt(!R+vuTUb`~-KM6(`W;}$J(|UxDROde?;s99Ug$&ov>}`xGU=1xSTt66
zutlwN}(HLl9NF3m4u+RAWep1+C_(tFqz
zMpjHjJ|vBRFV1sl+-wVHD_+}EFTMhu;f~kH_MX5Krn{y6iDJSG-E$kFh90L99~AS&
z%yTI+U<(vpaqx39{d}#TGIratyc<5J@cjPktx_{D;9Dfni?-eQVFU1!JaB``Y#L{i
z)*CfN-klo?c*S};8=y+MkyFai2ciMem!aTsE-{PFoXjsDgX
zU*PKHX~UTLRI#=W4lfQU30au=mR)Pj5e^^}lS=tzN>)Ht(Af+-q(cjkgjmtKPdsm5
z%+f{sffs`OAp3F@IJ_S+_uBNS=2btzYKzx!ryK{ZD83^!V~$Ow&W6_reaKe|c&k*z
zbG9fyI;aO>cFQdSFh*yc#48PZu)aD6z=GDG0)lp2$EB3ufRi9&0O+FI<{oe${S)~E
zs(d)E|i0iVRo|IVtOqF4bMlT%D$U>|?Idri#o^EV#IF
zrGnr8jEt#L&D=XvlxsCRa*IvN6G>_(W)!GubW+rglBWGOG(qk>>FylEA4%x#+sTH9
zZ34m8C%Ssnb55d@2B1S)n?E;jUn@%m9G>wKA{0+&6#j>RaZy~b?BZBKK*H8>Hx#ZTEnHCC#07&p#JY4?|ph0j^g^|6MaCfsSEtJy7^JdOsh#+YYMVc$SC+er0{f|Ni;oR*WSl~a`gp<<~R0Z@f92RBoQ
zOksM7gMKS2HKxY5YP{P8yKWrfAvTh}(MesW+iE%63TC5t?OM0Yo>GhnQnw}r1`X&b
zlbC1evU`u1Ph0flr-*iSC|feGdyPV-De^CtGwE;$?R5T$}>`&|G{|8(`NJf?c
z6!;g91rR9!@Y|EaruPn!MhEvNiX!s|rZ7fFV9lkS)CT2fM#Lc2z1oARhC&w+I0Jz4
z?}0|i@oH5;O4Si%z=3=m`i;XjrD=Wr^uuz#Sl7#a6SuUEh`|!YcojhzxN&C)hS2+?
zp=I9y>A;%+>>60U_l~xqZES#SbwTzR*c!2j-tpMMJ3paW!QtC8UOe^<}@~O&Q7|N?aGut*0?V7{ms}*y{QEGfKeAvyeBoh54Fr
zlUIH1;mxwvM*|Tg82nb5q|yMLO;S%e^^%*0$laRz
zdS8O%iGcF*5$
z%ypBO^lXu*EZ85rk^Lr5(HWJy|E=qyTA=U@lnkFANSZ@=SmJrKS#lfBE=Lt2?LUksBN8fok}Og83>NbU`m*MO~q`XIHqav_9Ls?(ANG-yn0cf!V8Kwg5mWoy(_?d!ZwDf
zqt2ZKG^55{rH*Z1(jt_vLV*YY^XbyZkbcMV9Ts8k!RhO2+@VK66vZ*(!g1-Ab_>#9
zVUi2iUdu^$OGRmTWXZT4qIE>~uP;B_c={jI*ujCd~W;+H%dACUd)C%)F7;
z`X5Oc40@Vk$~Z??9+tsWf-@8(8lVmVlIyBl^RcV_{r9~alIs4eCzA?%sFCQdhgOilKA8yrgl+mdDw~eZw5oC{e4$cvmYPJv
zWe!ke`RlsgtCQ#>J}juaM-R%npSLb!MGXQNaK!y8j@v3qtR^)WjRWsR`v45H-#~>O
zcUE~s5XT=R$WUO5Z<{ad5q09{`Vl
zn6H|^Q$kNzn5q8kj=LZ0@nqcEyZuPV`d+PUN;g|AV1G-|ULH
z<}|a_;-INd%r5HSmu%p28N&1S2@AZ1@`qN%7h`|8SInJCCKzMQkIGyE$zyo!ZquqbJLv7I_2sz4#ThpKV&s&dZguJ7SGCNQf1NDBIXpf
zc~fpM7VfL@FK97z7WlBSMxWw15?j073z|b##nduq^s*0n1++l;#q>vWUp_Fn&7~X0#905C`YqQ4R{Pbg=
zwm@V2zA1%%!kG6{`~dYhUe7{ckKiVpL>8I0XTX>)q0S{py^3ow?((7v9s4goERbo<
z$y)SU;VOItuUgMGj-03XK#-xLBSlRsRBGsfG}Y?ed$gdb8za(fO<%>FA#*Bf!XGi;
zI*e$NzuPPY&Ux}@6}n`nXPh)FW2Se0rvRtr7i
z3$b~{A=HWMULndSoo)cCcWS$US`y_Dzb=?r+A4A^A)Rb$z}I|=x=5q{k!f@
z#SxRSMwu=tVgMTF+kK7fcoP){JmT|6@XR5cOU$FOvF%L)fakCokPOI)2>P?<{
z9`&F?Vo|TyU0@@q_knhiCz9KJO?+oDcy9dzIrMe2+iJ&F=)|~`^Hlb$t+Qhw7tNp)~48#~?N3=+y+H?c8D
z&H@im%k1PLS3;>FB9XY)<)X#pmxm2^poVq=r!MmNxZW;8W!{{W5Hz1U)Op>8b_7@HFVYGa16GuJG-5HSx
z2O61YtAp&sdZl70u5uBdcA71gmrI~ZCr^A5-m3S;V6(%Ei=3A_1h#gINqVkhk6qkJ
z*rY6Ao=;z=kO!YprGcMlAJ$m7eW~D
zW8n?T)(0GyJrYAwTd8>O`Y{oEG8Hop88rc#s3p-6q(SWmOfnGaIG)gI
z6_BE~L&$wG5(Rr@spmtbF%HDKD2?wjnV{0d>oC**{75NAm4j6w7O{)giK^}0A4n9`
zg|sH@A6RRZNV7-bL1@7n4(ZP`zgyk&mbUF$Y8`#==9@k;G+l`eKjm3w3>S77{KPFX
zU+d?a27+_d9dKXhtbWWlAX|xvNm)%T&mhFbESWHJ6Z?9!#F}PBjKH5LG;YB|TY-C~
zLU{}dx%(DX@y6bt#NtITrzi3EE?T)vYG^7HteNt$BnaQ)aB0;CT+FVupqD`Fsw8Hu
zxx&~&1vHll#4bh`ZE=d3y-jXMqMqg*7FrXt5(!Fg}vyTysx4|2fG
z@1F)MhhEwyo0&wd-b@63SgN8X+DX&mbm+*}Ns$>dMyM$kHCxSC-v5)YDp0T6)tbLS
zAXRY_KOQEGo_3M*^I^hO?@GZ^e663aFyM%2^_#8>Ekd<(W=!b)ArJY0JGom!K*-X!_
z@#%Q6vv~wNo==k`2kYJ9Q+b-E!!l(%by1Ui$i$q^4K9JLGamG24-Z6dO5#uYO?_;9
zKCKvTOQ(*^eVdyJl{&f&k$}AS!(7|SbunxntiZ#wswk{Fg`@Qvn$VCtquM90#-?fCfWUpVX%`ZhF$00YUrln|T1jsyEjs}A^&;pyBbpgj9eFulT4T2sV
zE`4@+EXKS_c#-~f(Y{Jmh#oE5fiEzAM}*=X@_etUd%
zv(IxFj{G6H+{(eIXUPO-cP+6qZUoAcdq;cs3A-nB`ziD}B@IV`X(@(VGiTS(w$zEe
zD*fFCw;fqoFI9p93$xeTol1q-Wd$LoJsDIWG#0bSLgc!Jfg#XdiZT;o>jaAy409*m3Xq_W8J`7%a8FT=rp3XYV=z{9SV2xI?BiMp(D5rO
zs*C1QN--}yNju`NdRY30#w~UYRF0{Gf9t?tOMOaijV+or<{kMCh}SJN%XeHU*$5C2)J?&U)UiL%
z+PP|&I0K8Q74ACbh9iB*r%hm9$}=hJXi6_j15ZzcbQOG$i-yM1(ay6$k(6wA#pCuX
zIAek60Q{F_PxJU)FA~?yYgSAb&OX?3oMcl5A
zy5=
znRQP`$%gW4@cAe|u6KH7W@l3m9N?sUPa3dE$9*gw?9mIx@es;yE<+%u)
zaCex{Az?`hwz=Ox_DtfWSM$VSa(Q5qrxA;<}
z5+$o)v|GY{*X?tLHW#W7ta*akvTI86Z#AMf!ck7KfFpI?z{?HFyDQTfhhUCQj2d$)
zS*BFF6wZ=OP7^oZE#cSE5q9y%gR~FfU+){1C-Rr+T~-$S9}ndBpqJ?nCgYQo_J$#Z
zdpTW!8iILV7>r}BBMGa|Tex3?cE5%DH17-sk&p$AP}ux7le#+*K@t(8`<~+3yXD|N
z!nWwEx?My`a6c}I)Z+B$0<1cc_7k*F|70655$-MC>qz(Ja5!}feZtd<5bIXS?l8W)
z(U7y#B=w}2?-R*jLi@*!@WHGh?}xLY24M=|?#TS92GGf)yQ;GM?~SIw#W1AdNTL)F
z8SVS_9s7baLOei#Wq(Y|;`iv``<-65iQY`p5zW6E%5Q9ho(N+e`Pr9?;CKST1~VQ-
zCc<1J#h*!_U!^pADoJWNlTcdUemyB&BM1;J0vJ>nX&tvt5^8`BJnEX1P@>7qgB{XZ
zCTDHqz1}@7{oG9FZc|@6Q@%5UpuhQ{Qt~?4>O+;Dr1*R`h-~S2Av*cKG(Si6iZWgQ
zl}3i9JAbe71><1t2wylxEWE;XEomq$ldw9&bJ0TH`U}
z%AOm%-K+_9nr4DBXn_|ao$TMPRmP75UZkzMgW^0}#uaReK1?T}Iz(@)ee(3G6_|Hk
zQ+({Xcewv^`)*rU^}3XG8FR3oN7UjO)fLMHY8&RSczFLx2=dI=aa$F3KITvs3@;1Sg-lFI!0iwFH9Yc5AuXorW}<)!cb|E*K+|gO>O4j9JG1FLNNb
zWdllX^X>?A$(FD-)CJvvY?k7-Vc2X|(XL&gWy>za-7YvWCq-P$xc1|^{ha7ASv`}S
z%z0OH@#wDQ)_?SDooXJ19Y4G|7vXbq3=sVongL6&m_hfCZv^(a&3x3af7OLO=;P(O
zIL85+mXxapgM@OvFC-gEJi5;W_zb!I6T
zk8DPTIU@X%A0DYun0_4i&-Cf}C86sXwD;&jAw|3UL_%u?J`642?iEj~|PB
zTq`o1sVJICUr!D~_Vo1c2tdpPHFbHiV3~e4^mSMJp`Od(fd&eA&W_~4u-%F%ddUns
zu_O8SdjZ7j+Jh7g7eBb4i8g5ziCF@e1j$_zOKrr8C#9`@SP9>b=j^W|7()!*nsYSB
zGH5wL1&+*_%B9}qZ<#PzZzURMxr$`hk$YB_+iRncY5TDjMbGr3-|t^rB~?&xhE;nC
zKxjsuaBgg#wObEO_U_3}uvI26h3K|agk?qA)rR5iYQtEG!KZuwh|1)&a2OuRC2>B6twg>8{Y#J5%e%yk
zJG*=y57Q=FDWy~LpM6NDcE?-L`
zs3p%~i{TCl%?~}?MK4v)^-jvN7e*Xi3WZ@tZ+&AawSbKd57ax?g8)cdy2yl*^N
zAPD_xwlj?cO@$I3sAYw$39KICX(h+vG{>HT)A{Oj6drr3nY$9@u0||}*
zW66ri*vX;N5o1h6mBNUENWt#$`I>G5$fA&B%s-CHwQxCPCNA`W-)Nv8l)h5zy1$6w
z@x0Lgo{@~80+LT@)m54BQRk<8)=B$LsfM!ey|}|TZv+~+O1yF8v)eeOCeoCXi@7q_
z&M`i(ZxiJW>LlbKWQOvO2etDnUe@1s*gYQ!?q9tiEse($*9Ctfyy%X7$TrK&;?KNd
zr&JElRv+;y6{m`QX{SqC}R*F}1d58Z=LD
ztT^-bg~_$4^=hm7{buTJ(Hn!t*WWW0lXokRGRzB#4n20#5zgvX4Fa?pQo}92X@LHCJlfN1d&df10C$r>RmQ
z_i!+d`_*(zU6C?(dBrMv)@R|kMD)diec^?4@stx0UW66m$v(NF5sn~U#o|Cr&y28)58*YYqR(IMpNdMxp5oYN=N4^G_$`*
zM82LeIbC+-5Qi1@VZr({A)`4@W*2;s(@X-FR>Ln822yMb`euHccL@<0xbM7R|epw98zA`}XZ8>>inH_KCcSa*xYN|zcrvC;#|w7EhX
z%mX#v<-dvtpCE0Ns{{H>e3p((dv*?SR^viitTY#BQk5B7>(X+sSuFd>du^rz<
zOc1D%Y2Gy?um`B=oneR5(;|>;3Qh>U3rv&h*rS8;$IwPZ0x$$Jl2#&_T
zRb{=6hC_Lmk0yiHIzZXf1A%nQC&?z(R#lIu#AOpdY0;Xc;
zR?(DX+`%Ke7E~6BjlhI{$xvZr2ruKm&`>$_uV~Spw6-W#iE&sS%UNWAl`7e#*TPyJ__`lH*~zI
z?pr~R5kD62q}3h%Y3%x}u-rI8wX=+VL5jj*II?1ma@{81j)_cq%FStkGe#0K7@W&E
z4_Q!A1gtw_po_BS&+iA~Br(G3TrZ7RKbit*OT)XyD7>E*u+D=TkinWokeQj$!u`%O20godSl{hudD>)_uEHU>Ck`!Q
zb^vaNSvb5Jd5wQA>=RDZ{!72CD_}5}tDLA6g;MtyhKnkXs!cR@Rgyis3)5l1tFHCZ
zk!^ZSs-o4|w6@0U+Co4}H6bjW5RB52VEC`?AhP^>Azh!fZpwVp*@|z+4pJoj@MjL*F50y^p)l$&>NlJutN
zN72j5cwu6{@#2t0ZezE-_fDZ1sb|d}_tCtHy1yTEwMCixJJdJ6<;i;^&lNcuhQoa;
z8mRAW1hO@Q<)1)GQT7D{n|U`O80c)GQaoC=vfx#F%
zld(qFQ9sCR28U?4AHY8DDj6NWBDuYdfn~=3nGk_Hb_hN*qcpbpIQD_o?e?*!(i(I<
zdC^#A)6xP;(+*JXXoT3H&|$unZKym_A_dV!A+Yh!OdX6ewLbpYheTuyJHmDt-U|x>
z#)Fb9aHAz7ZM0(g;Y1ShRsdA)P+p$$Ic{Ld`5D3Yy9baX+y)hPvO57|+yD4bP8yxVr~Jnv$5P*Clw37{Kkky$p$F9g$izFLC{oQr?XJ9r466
zcw8N5e^9)61UcTHw!mn7w^^O-YQ4l&hW_N3{%THOeq^Cv>W$4p2=msRc6Sw*b86=d
zFVf``OLpfZe;VMWqsUzS<3))Di`tPXZCLthbIap7ZUSlIIBt}RuluaulH&octZF2T
z>g?wcZqCnl1f%hC02rdKFdKdUQEHBDNklW;Q`o>8=+h?ptxC
zFrl$vh1e&?^+_)6c1ghFVMdCV_e;l4yX-lwspO_+?3Gw?a>U+u<$FQ#Bw^Mhg5!H|
z9J?>9ida#zXqq_Z<+m2PO_t~m0b{e+7@2sm^`YnqjS+J>vqVS=Gje+!(-;gMS{<@PIIr4&vD3dmn-DX4e}dFCW^PN=
zVG{;^+)1y@`s`Y%UOQc#YE-7glj-0FZTl0wZcy+j-)?lurn}cFx>ZvVIj{&@RD4Ob
zWSpqHv|UtL{tDXez+HJ8&cY$eMqy5gc|z6p*nuK^SY#onUk95}mr;ac
z_IGLv=%P2kDZ^8NJwP1}w}O5_R}$k9_8n@sxr3?wl&vq)(Fe^+V#L+>-xQeI=I6Fc
z%Jx6Lc7k(1ve5^WiXGkNUzfWtH}Vera>#|IwJ6b%CEXU?uW7fH8fWtuY7o0Ds#-q#@IdjlhiO#E-)
zzuKbxN?Z_4YR#8KQ*4IqgS38JN&Pv9!L&YVMsra*L|I}#sLX2^R)OZ4ei)IHEzTXA
zV_sM7<>%JTMUD9a;Iv)~3KXPbdL1ub;V+@dE-Y
z0-;Px2D|Rp1BqFJ*%r)SUrC%x+WTro)%K@*J)dwG)WSOzq_raw5aGap3Bk%Vsz2{<
z+u*y_T#mh|dm%qn;0(T4PWN33H$0P8@ke&It`hh%(Nt?{syza#YNJA5QgfQW4$btu
zX0^uqRB2Tr2E)fqagX!nT4JiF@CYncIWy|NtOQ=Gx5VXxU6o6WsLs<;6mpVRpi4L#
z5F&{&pz&pwDqy7`X$NkRo>xzp^7T0I$(5*Mplhy6-vAX_s%=lm(KnZ`qg89ysFV8!
z8OL1LT0|`f;$E^AL5gjx<_ry^a`y>?JgT6n*UB%wou;KfQ!$W>!)O^fCqrE?#zISL
zLI*ct`8eu-%hvhR?6%A0n_T&nM6B=cc6wBpN}ppwaaTB#hv{7$8(i$+r_WVU6LxsH
z@CG}0vuR&k_r_%WItZow^mL`K8OsQe9?IAQDfR*11-J>Xr)=&57vy!YhG+5?!Ye(s
z=iBx1c|nRw&>%c7ZFsvOOldL7gTAgm6}Pu3B`@L54<+FWrmYu9_tea#Hx|XV;La!Q
zs+r?=D@LorfV)o#@0}Wms7>OuZxQjLBP(5Ne1Nfgk0=j+-nCTucaVB+$N~StyaUhH
z%Go^88fTEfLtPJdj`ZjakVNcVF@K^2Gn^NfY&W;FVcH&jIdI)oXpSAtoQ&mmxN!>F
z)-9@9VC?DyeN-PvvO+t|x!@)LzN6s+e#78ZV$QhO8-5RXn{BPDZNvtv+=fl~H37za
zKqdTxd|?=7DL>N4&78xv?K39nVn@M5ikGHG*zUg?%=8DxSZZ^0O%HC}JNF(#2ieyG
zC1KvTOiFxH_s9hBV2Ydb`f9EFCGn7lF4H@#FgFRhE~1{xV5T2?z;Vmi1BW4oPSH`;
z*%ybwiJ#+)K;NnT>1TNxgOC9y>>z3c2_s@5?0_Prydh)AKBgGS9^$ttKs~yb8kS6^
z2OEh_s1xSPu$GeAs2m>=38oO(d&uu|(lI<7z$2mElHP?E}N%B&@ifQVa=X42mayl{G;*X8%)gd5Z?K+Cr&*_NAP0`@MNgYhgn5
z9dGqj(`nMYY&T?QJ1)n%J$}~Dp_eIr?WJoObZQJ&osJ@wy{Fe1MztStNflVBawg!mJzoy`xB)O+m72O%f0#Yx
z&!C6B-F8Jg{Zk!Mo(hBajL&~HwM{#q#y-@URg?n{VFm8=sFfQb`gNxE
zU{##M<4iCAhN<2~Z8euP%SD0rVyD7=?y`ACR3xD_4x0wvT8zIq6}B_4Wcl%GO*2?U
z%4Vd%h8_{#i7g2JFIn{11InD!JBKqV@_2d1@CrhyKY@==qZu4R2S2(0#lj!QD93F9
zMcl3ldzvBzmJcS#95r7@?4suvX>)UVR79Ci#9vIht&?{
zRZ#oe7h%_@ld&l)Zw!p)nF5cWQtWLtHUZAKmcz&sX<*IczqgE1&P8_BE7aZPaUXXx
z6`h7qkx3qGYoB=+1W!+emBJ{UPwB-g2tD%lI*lv+AA{IWX$iwd*q+%*+74zRc4l^Asw`8ntYlNINjR+7X6K-buN>Q
zK^lVfn#3r5nYEX=phsE#+b;{lINB8-Btoi_zJidpJpKfzacUSRvgy5MQ>*>5kMvc=`|kP}D+QD~7-*hiC3tPbvvvZq4a
zfHuQ@B&A1FFk)DGze#B5P@
zdWV{9dAEC%ZI1lrY^T&V`E;25y4gqT9nWz_D{;hD9>r!)s||L|-0ADjgIJ875kzse8*eF`{NJ
z?@FUD6eg+Fzpx@b!hVq=`B?GP*WOJ)DZ(4<{Cw4}o!OiNZWWfr&${7Fxu!&r5??>Q
z9eSVisa$VHfq33&Ku_R1X1fTidsOo{@;t(u#a4ncyKYVYR8UiN*{hzJXAd8mtA$lx
zZg%p;gMh^kedrmKqbYf|o|j7l7<~F1Qsl@M{I!-7ycedQ9q*D_**~RbTCD~b5wBkd
z1GgLy!w+$2COI`6VWZtcm2&NXfoVwCjCHvMZWd+I6K^uDbY5iaJSwZQcCph
zssDPbDWJEvbF)S-2-U@z8F7yRtZ
za%1`cbUw3=PbU+3BNNMYul^H$FOFJIQmXb~$(&
zZ$KZHi%8#%2Zgs?>eA;4q?-jB(kulBM7`YK9yEBee2Qno)B81+qLiQn{RAzq6G6WL
zQL4=$^LW0yn(DRWC??S^SH=pLHFUVu{K8mR*2a^fm~bTwK{W`>LBW&aK`6a`x&kXt
zr>l&j(BKT6qnAy-9p-);f(AL@_cIz@T=0@E@1~9~NyWuc7%6I;$XDMq@pt{wfkL6t
z4B;aA0U}ggWc+rgW8VD(dM6;eu~R{m&RU|ZQPK2Nyw)O>Ook}aB|JX>sF340H;
zRxu-66x+o6%DNMdu`k6JwL(Bc)h3bXB|6*dJzqbQPtX6dJ^y={>U`Y9wMzkU83ACp
zO;Hiapk?0TY30+tGZzPkTzpK-ATUpZXgZl?kWa67#uq%|Jg(Br;h@iB@_NPc45a=_?1H;Clk3lXvrS1~1jj
zk0mUg-;PzKUP+j~8;|JK*U1rdR&`UY}kL!PM0E
z`g0Cghr35cY0(khZ>f%TvO+m`qh896XZsS+u9l5ue};gu1|X&+gbuw+lZWE|-%s
zIdN56PXROR7pGy?84`1Ln_US?HRsxVa{2pL0o(7k`g_Rs;}+isZ8!-*D1|~e3d1B$(>Q^C
zXfC+B0!HxWm`kSHtkwEMo@^C?1lo$uB)%5~s4c+`e;l*X@z!RR;h*Q5H@`x7%h_Y-
zUO>;bXl=6&$~S4`e7EaeV?%g7Li~%EZQX|0)qWymE5NT|TO4f}k(k(K(CEDfj@T^&
zF=R_>YzYo%3*l&bYk%L08u`|a4(+{qS-PFX8a`6H$#DAnm~GnVGVxU-NO512r@;=X
zLF30-LEm+B1G`udRQ$;J#cwg$*6n3~*L1s*`OEiF6rhO45X<2vz5Fdw`kH@W-iFIy
z`l3L_?rNa_yle*SpBl{n?b!f71a%*s&2Qqi?Mvjo#BHyWB3M>^^NMdhlX@L8
z$^cU{i3hDB{6+R(&-RG%K7nBdq)&jjK>1t8dqEemds*|x7f)z%%hS&*9%+qF6}B)e
z9e!XOO`fEy>*V<5{3IS=a23e-4qRN)iVe914?{-U2-MveI3OhFePGwO9wBmt2jY)f
z!)lO3RS!L=@}O7V6|yP9y=EfN#f;zZT6D2s*$r6kKBzLG7?CGd!?l0n=SWV_usO<0
z*gc`DF31Z?Km~E1>8^SuGC(lykwp4eNxRHrYQ5zA=tAv^)ZV~li1*Z`UZ+F;*<|s1
zxo9I2iAVAjy&cdO%Pf2VnW_ug@aAGS8eY6u%UHy7?>l5z1NQdMCo5)U!sYTd#>*QM
z2~Vda&Px?aM2(G#aR3rZ=1r)$6$MqcWToHuGheb#eq0D}Q2l{%Zz>}f0+Mu4Yqxj5
z!{aM}Z?)U|@k0NfA{n6__pc6N33!K0LCE77fGHcUCUNlB~Vyiw!wr
z)4fFJ=}2x4REGE*S+ry^N|A>)NwP*qj%U<l|qct1CZBhv>BJqPQz2;;Rf$C${sXeEQK{Fu)~U;)Sx#h80I
zK?t8(Yw-4Rk%!sca;Y5T`dly1UQ6`0=9?DFodf$iJdG~7ajyw}YxwCF0?L>PPy1=C
zjN(8#=VCzuk`4rcq@iqV23BcqWd}neAx>%>)jBUxUcO-z}Sgyt9fu%NbUP&Mv-kjShqe;HR
zYOD2{CDRLf@&!2M?ml(K2kCtyO%iIJ>JXjIYFSH>OcqPvrj`w)%;R<_M*eU#d>`vT
zXM8?`S0cVoM?+ae*EEzzRDs;{0x8jyX4ct$&My&UiFvrF!T~V#;Vdu+t#b!?$U?R^
zZcp}-Mg7rk;w?L%w8Yae@mV#G`srri;cyo%(F}=ubZIUiP%>o;jTVwe2`HT23T8MA
zZgKQ&GEDYn5Yg0Jlc%n_;4|h6p`t>N%#9_9S?R3C+8cOCx(5}PTZp}RIw5Z?eT|}$
z9C7AG9_!`K1q{B7!xiE1KbLU)WX=4^^KmaS{jlJ(5!SWueh%FJe6t@UZoY2vQ}-iH
zlO%>yG>qT~Ns=p3B@l9r<6sOS2#P=;6#20JwA(^&(lO-LZ?OhjIJs4a)&L2jw+_Q>
zS7zKwJIJpD04Q>knMw9Y3c|MJ7P=4Kr^pul(a8408h@eL79?WWmgGaREuRPfD(#lT
zTg@rnvu$f=812E>CPjemlY_e*Wt{v6!L|dV=~i1J$X&5#KmRS*!*d{dnTcGgAaZ1atX;zpJk@ggzc*P(G?Z6>9|cCFynkJnY_l
zac8u?IXrEx)UP#sVf-)oIKKHbK_B{`e58IVC(YYf{?^QBe)6@zH%|*-{Qx(31~&YD
zc0Ong|JGvByCVFz157~Du~X818vE1jWEQ{V&
zQ6V{(x_el6^#k?AVipowoOL!sVFAKt3t|^@x-@SU%I7*jqy=LI+p_00o;d7zsImc*
zh@q~e?uF1(PYjkzV2ue4(!((UsL)deq#t~cBtD%;_vEh7IcDCGOXDz3z`;oMEMuM%
z4z@iN-ua{{=RykO98ne}>VY|+URL{ZPHm-8uNp$hr!0vPqmHhH>g
zKn^8OaR;`iEWEvtL6$0j>Ju
zb2+xH7#H}eJa|!1kx|y)KPE7O&RFhGS~tJw&j5Z7N380Ih*K{day)g=JAcSi-D2U$
zBB6RRq=VW-v8owwoli4u>Ik5J@9S3{-0c!`G*VL%YYx8
zqf8WD6x&xQk8PN
zyf1TvPd0!mo8gm$!+~b?Hy#RSA3Fwm6wht|>Y?7_x0gXW2JV!a9Ae{qFZ;=aII{W|
zCd{AE={uR4e}{yBxZ#gj_-&)_(U2y$9!6qo|3_g6hjAQ3Py~i)jDj(oph*g+KWxTW
zF)QCE)Hk%jHtN5^BY|%PAB^7Maf6!ZKXJZSls@iiM57Jj$US?pLf0k&2W=*k8&(k;
z8eyM$@pqw|1ltDb^1U7f|0AzRD;R(is=^%82sw{7Y#-qdtfNZlMLb{S(F+G<`1
zy*pvV+a}-!{w)|zI~Y1&!H|V7*TG!bZr>O*ds3)V
zbsIh&1vviC!SGwp;EHPEXRLC*Q-ArP%b!7Yw}$je!9EGX)h|G=wkC@j)+=V4);s>&
zGXj1-r9U~N?ZDw$=kgK6g@`3L6jen9$WFvrc^_E
zTH`hFB>jnyE9Zjn@q=b#4+WYo!5rioir^x)DrGTi3(JmBFg=g+DgD#4_2L7
zxS$N-tf}WaeLJ)D?Ig~(M7c0{Ah&0{J_I+)*OE3Y=;3mS
zc-~vU^}sB1@nv3ONTR<)l)A>UcN28=0?q?Es`N);xg;=(i`N}b*E5S&H&2Dn-Q=Yp
zh5OoF<;o%!hDOz}QakwU6*`}~3LW@wk~7c@6k-2Inlt~dm*PkZtgfd=R5AR8RsW)T-cD;8|isL)p4^i=bTYm
zqbiFns>EOazZpL;ziz-_E2$`%JhC%yhEYVmJ>?nF0MEYg*o7nCwe!~
zu<{x{2NwgaXVDmkE?C4UdC7jH%rx~%fSl6!mVMpbGGYjHz(Oy$GVEqcIz;ht&TUgp6|}SiDhd7=5IIvfdGjA+;l8Z!D^tY(Y6oAf5&v=HAEy8?
z6klNyB`^xX=oKnyY^9SF4pHkL6pCR4hLax_0PtjMxKB49r7fAh36&;W7N7p)h?wki
z@|N72~aqgQRzxroGW}^BADFt*Bke4#GFu
z39tK!cf*6_q{(}z8*O7tuZnLEyflapN
zy>ip_KMyzDCejs&{m44FV2y|OXOV$J^{AyH|xkw=e#d9
zitM}Z;KNB~;HxyxPXh-3G+zJ-oOVUEsQP0g1am?N
z_2iKa#21SiGJfep;SLFIf}22h^p(3dw)8h=By+uqw4V%*w7?9sS3Ua%VKXRBq%qQV7ZZ*0EMI3D=sIF5KvSSXU{IY>r}yLEBd=8
z+I0!2G$(4A#kg0MOZzkm%rvN5L_^M^CkMcOrFuUqQd4vRa=;EJA!Jdwy7~o0nUs*!
z%Q-Z~<4BIxs8y`l@ByT9M+eDFaft*^+M`Wn(Li&U`h9BoW
z9xXnVd!c^|BM@hjJAS(3_Tq(jnyzmo0^~5W6)_Xn*<lb`VWA9nCPhGQ^JQV4}o
z1PM_DK_di8t++@dFiz1VMA9e)(I56*lDorCp6?np=?29(x(&$@)TU;$A}~p91^Sh;
zt`LpXEH!
zbEU2@whbE4ByDSd6TMOm;-ickW7TsmqqkR~EJr4xl&I87`afo^Qt3DaY7eobvek4iFWuI-eqs~vW<8Trsp~JRR7os=I%kxIJl@#yX
z><_BSz;|WkA8*y!=r^SXrVr4kiH}`^%1=BEs$H4B=s3B9m{2M
z;^T#Rr_0dh3p}56QvyX^zA+W!(W*{4QL
zgwQ00Kr~7q@Xl8Lu9v-YhLx18v|%e|?FI|*uF{cGn_dV)Y|>r$Zfcf)?25K|L}dSg
z(M>D_!*{W4Y-1>Jw9S4I(C6kP{8QsQwq@zoo$VfMzp{xyw-?}6po_O%r@NxbO3Wy1
zdrz*f(5)*T*#x;0a%+r-ckkNurHaK{s&E^!hPNE$CjPm1yRX-k<6AFQw4Q7F+YI4t
z%McFSw=VS)nP9VUdVAI3!!C8+`ngLzbk_TNOZ|VcfM*&ZT4VPtprPojzXbP_(!%DE
z&V7m55xm?gVQZMlpr2JTVcped!{19`KQEh&pDJN?qr8Omr2u>`g{=g^?xO(4W7Hm!
zMX*0-fHt#v<@4*Mi`#$Y^1v(6Nmk)Uv>3A279}}8H1c*fg_g8M`I1T3oDDI+;^g|G
z;?Y|=l`l;S>WR9&^i;*t#30`l<
zVqwWv>=GbPBAn+My?4zkfh0tDaoy&rJ<{5rE7H58Q(eJz^E|N*{2C}&Zg^|H(6>ae
zxXbu_0&-BY12LQl(Y=BGC`eV~eNFpxzkENB9y3>sdc>KFeVgb`A6yU*Muv8syZ>
z4lx4{$ZBUUX6~>zch%$@*FI!Vb|O!Qlcwbd=!D1?EBk_Dl8(-lx5(z^wGQ@hvu3ZFT)u?uW(JIVHz5Q5%1QgY~53f0gqe~IlCK6Jy*4GZ@kW_%ajMD~;;
zMD3bj(U#gwv(Jf4bf+IHK(4F_-ziGA!~eR@dUa|3Cr!fR2ATLbiwQBg(xI0ock+5>
zM6zZdN2>d{sFwX)RP+2rsMZ(CrvSQ`BMT|vxJ~;M5ei@O$1vEk6f7UVv2l&3At2%XAU@NhZWT>yADHiuL&w
z$qsxZ`_B+5(TlSQ6TX_Q{;{>8XxF)LWxLiY;ihw+`N2Gwq0ef7<9wa3{%3LRUvwJ-
z-;arX={Ck3??m=!eB})|q>zVe?i4YtUgxI={lOQJrDr{xp}WI?~RWzt=H7rz(&y$qhWG*aEwc0E*HcW6at+
zv2gRqMeUXkJyhEe8&0T#ja4`r2QY+u$PBF8J<4+i7z8jHE#ahJZIJ1j4#evzG9
zj+I{PiYwQcQ!9}g)?xkR(&3DB5-IVPq#5WOo*od$Fetd@%bL<_%vQlNH~p!jN4g|V
zmmAVt=usVB)YYnmEXLd8>5=0nh$XU^YnV`TfX;;!G4d?NK^DD>`o=<58gnPv7mEqO
zp{%Hk;NM=9a`#47OSVm^vIMU_+xEv18Dt=B&xkpKr%RcH+1&SweRql%R=(cv!!*%l
zq@|riJ}~!!njv_u=L>--v
zIJTo>$+pzrUbn!^Sgp6|<|4iH+qrAwZtia(acO|l91ebW;;(I}fbW*|QA>Ic%k5|u
zSopr&sWgC3NZ^8em{vVvSR5xy*?m$eW)qh^0qXhDd$R3!%qz_Op0+}(@rtUj-?OjV
zoj=W~|GJOPBg~;QW{S^FW|82{3g^p_yK@Ji7;==TPy&3;kDGJ#OgK)VM%X&DXpRl^
z6jq?-5yf{yPpeiq8RutwubP2F)WYHz1gMAuX*{t9C-mu41LO17SYbblgorPoL>BsN
z=h3n6N)Qd_kW0uIt)eQJE;M+TjFtfKXLBSP?#LsOD?gQolqqw=2hQ0d5SF0ALZRha
z6g90z(=yW>u2GI6ey5~6YcWrc1$snB74Idy)Q8>Lf|=m6RKeDBc$b;Yx3YhQ(COj}
zjVb8P`<=}AQ8Xl396)P@5bDvQYDYB;7Z(Y+vkibTYbn0cp+fq$zedhOiS#2{sVt(5|T%sMP^W9OT;3(Xxiqtm2SIPgQTq`H{VL7`CelslWmu4oJ9YsOq)ep
zTk*P=1ltDvv1khbqkQua%djmfgg^CM;d>!D-IM^RbW7pl=r+i;X#;%HwIR1X5X81O
zEZY(&*f#j}+pLATg<#jOSqn*FE~3~m+{YP<@h7U+s3+b2k
zK1|?yBC=eT?>S=u-rKRRNUYwJ>-`SjD#mQVXB|HS)F3rB;|d?YYDa+!W0QV4Ba@FV
z#Vp2|&(JG4;wfOK7i@6@WE^FyQ^e!#>AV?#PAeD;Uz+q-W5JTZ8Kvm?ML!xmK5#3F
zd%csvF-+7JU@|0FL9e)l;+vHRGbg(|q!i1eTh6I*NJ>NG`Od?8$7hb_fW2pI)T%bE
zl*dyn=Lt}I#loIO(=fd-izIsXCrmIk>)8z&NMk6o0(0=LDrk5ur|KxTM_Kip!x_EJ
z%Lq|lv76IZGXIMV#^3Y2$v2a1UaEsC=t{
zR-GwOKBss`H`kN>cJ+FM7uBR_D9pT!uBt~|&$Q(@mK(h+DS1*VL`WqDal$)GE`Z)y
zlp|rM4w^jrMY=T>*1nonNyGboav&5{=lWsd72Ghz#z%UY#p47jWr~`#cn$#!D_)>j
zN5%R}Y={tgA-oV!uXA-*;e$PLT>1!O^yo%;^0LxMF*Q&g?@*BC?G4um1yEDCRNs2?
za0Qv=BS;!Jx|i*jr!Vk~FM?5*qoF_5KKL9;}AxNrYf^DX)JDE_#sVXX~|v{4fmta=NY~+0QyPHL5-`nXkX6I
zk^kd-wvj!wKB@m=?os#t>;L)WH?fJS{I9>n|NDes9DYRI|9$1r_DH(XDst@n3D#PyuE8Y;E{B(`?|)4zA@5VzXr^i_OKay((gS4Qyji-en3
zTvVj)XWeYYcfaM%*)4b8`Ss<@HVJBdKS`|f0^X#;Yq}s~;UFQj^8C&F%KJj}pS~nM
zXL49(0*2DjEaR@ZM}b(+q;Xfc^6zO1aTng+7Wm6?Oa1fumkj>swm#%abQQf>c9S{F
z9H#%`clAkHrY`I;uz~b%NBvqLed)V2syCaw^7_CaXv4rI2IUwnxJ+>@4M7*
zqH}@@hmtslX9N0Pn}=s!W_Y%BAV${f6CQ2KVQUP)z+cidT4R^-Xc7sv0+b-YdZq?xIbIY>J)$$DKrpDOYF{k?Z-JdE&mn)jT
zyFepSQ7%3n)54xgE=Rf-txkFra%%w3AN+%bS?C3pwCv{32YI+G7a}GTLy8r9KBxBu
zU_z!k2-ti(lckEBIx?`RUaM3cIf3H9A66WvVWMJY)#f=e_Jb(O{0CFZD2w0e5eIw*
zZql^&S0c#XVREE<^mQQM`f%kU7+&s&+a>2Dr@Eq{f44F6C^66SeeQ2JDu1=M1SncM
z=gX2g#xwB91W!RL!p0;h<>(x|K~k~<5tLey4%_aQE6_l+$WWZ97`xEE{6YX$ecVBh
zO&Q*mwV{E#EKnF?FhJ(ySY6CWTVK@is`ZdJTMOfSFGkMsjI{e!uXJ1ZNWGk`ek_eF
zr=hD49P%`{W@gF7J0LpX(I5}wm!IQA?d#~x@o^x_Ik<&0FYZeXeS(ASSAFXEBb0uNN>52A(-ABCgXHlh{u}%=?ba@zU!Y-TN7~nD+7*=%jO&3
z&3FIGl{4eiR-#Yw4PmogV0Aq`irz)c$xW|h1?3gE*JuFW2JA@NYe+`FKO&Civ!?^>H!a@>4C~=<&iG_#*YmmHO3b#rYCoAN2rzhYep%s1lv+
zKQ$3=X3$@TVLpp}>=}0p+NHpE_G<37mBnoE9%At6=eA!40={3Ui^Y%hwH~bR^i+?+
zTRpDvK^cE%IthG_>0coItBIgJ&(c>_bK}cM>Sx7~%}2xD2=;oK|Dt{OaL#Un{kB+l
z(p+_1fGga4cI0+78`~(HJBrQK;sMR?#w8y>H_lJ_h>``54EE*V!|z;~59e9zQZ@*%
zS)qWEem>u`WX_Y(zItDz8BH?p{&l<^h)x4*{NXUVS}lAWxfRiQ2p_-4)BE_ozDv4CcaQeRl;Y
zJ>i37y}IYM)92NMqt!vzR3A~YH=p5mQG4k#%P
zyjq{zcOhlA_@9Ky4yECe$EJK(1T=|Nd*eVZ56=%8+pFNf-^$>>aDx8Ta45hWxzc3A
zR=cHv{FV}S>QgeVuP?V~5dlAuN8^yCxTHjqoMM#Bskir_2NS;>FC6-6fnyxSx#K&I
zXWm^7yT{!y-(MFKo7EA7v{q7K5fRS{!A~g;%8*u!i6OqmK)92YQd+ti_Pe|BcnI%H=@r(3DMtge4$&Z*z5y4HHfgrBF4=*LS16HhhF+Dd+24h%{
z>6O)}Xkd^*+Xl>4>L*_fi8BPhsnU6OAbWT;cj%DVq;t+eGsl79G`t&Z4ZotZrI)3h
zHnkTshdU{POeOn#L78HEqV?_y8MvJBHAKKok!eTPj4QS^0Lw{L%Oo@WY6xcfE|o__
zFbCz&Axgg{_kPThzq0@BEGs`~jIT2*yYl
zAxQ$JagxHYk0)MM9Kq0NV>^%$9uySvFl(V^d|Ya636%#dI|JKELXtW
zERB)Y_Z6uN;w=<-OZF)2!x8i(;ZwH1yjm@C@h-F+5cx5<=F-^rBf
zDrn8NX)jdx3);wi0WRP(a{V)HtQhYrZS>&bf~wOtHutrf{bhP(V>WXA-3pTT@X%pv
zvzflLSSq$6wdo4^?#=hz>8Xr;v7!KPV~B0Evq5Z_62I|2{f2le+uLSM^;vhz9r1uq
zlP=8Hh2LM_pIjdBPuKS+mk0dQ_5I1^0qMUH`8GSOIvCYGy-CP1FRW=g0d-2W>U0f<
zz?kphihPy9tcqBj)cM*9a`@BEY
z+6#H#d(?`nDmT!K&~)ru*1t%kYT;T
zmi{pu-SSX$7A6x(OXy$@&Z5_A%#j&h9o#)${z}`=*_+6@;>E23?s@rXl
z?wla?F@7eWFHa(B$hzzBSp?U;t?2K&@m0;=@2Q35S9*WM9Pp}_hPC97^jAc34E%7q
zE2?7p6zShQOSV!v9)z2WOZ|x~$|pXmIg}Qc#e&-6Fh5}cynA0|915NVe~ESW&PzT&
zSXx`cf17sRp7T$6W?qFXJkuU$eMD#QeVFOP4E0T@3vcZZE$0@qaDE;%a-yD83AEbc
z!6GElPn;upcGE~7-jg(4r~bg9#_ja%pO%c}_r@->YO8L>9fEZ
z%Nyf9IY!onE{{ZCS{}9t@LS*y50DYlCTC@_dxP4cCLRBJR@^!7uzVy*9C*A1ds)9}
zzvDVVRWfODSoww|(x?k36XGuEC1WQeH~aj3Jcwcmdi33pWgm0sh#(UHIkkv{s57@f
z$lKH2`XePSS?nMSy2f{%+R{rL2<|yvu2YUyZcji_x}NRqhE(;!AAqbIuzkZ|Hj0rm
z50zvS&+m(J)y{)=LwP=T)TZdTKOaW@B$TidGxLYPc;El+3p)Pqzijj;4F0cn@CAo|
zvBnP*EEI~95Q?nOi_;`dV+esjH2rZwGr@N+#T|=R4tut;#dT5s{+J;Ma*$8rv3CLaaD51B7TmSa&
z3!3N6eyaXzKc%tE{tv78rOO@v_G;gfIJ3)tQa=DbmkZA}@|rHKIDXIgzUY5@mHrYI
z#{Qxm#MPfInM7klAndyj^&dW5Kl_|Qt!I4^urE$hpG6w>Wx&^k6{~;eTcruF^s~0Y
z>pO<`3Fb71b=HmDtvMF>%y^GKTtfBf!_S2Fr_X+bJm8;=E#@X2Se)&Ot2mvRf{cXs
z^_m?l9}$w^ag{X+unU!ck;h|a*}1BZPX`o>qK-@NHtL0!&ana4P&UEZQ9l(Gq#p_5
z43ihHELr@yj4n{fna-J_3bn&kd(jyF;5SmEt=p{5jyJbF}`C6
z+-A7|obT838bqTH#EG&yozM1ZY7vd(gQf7LI=ESy)h%{$Rx|Vo!V4u35G+S19NxjTz>J`?T{epv7k~RL#yJB;A1@N15i~uZYQRR
zYt1=6-YH>-M~}KZaLyi|pW?dg#
zIgf|sefKTwRG-%uD`lLWm@Ks`OkI?Tw|v1>aMYw1_1-X2-)6}O=r4*e-)E<+dDDEq
zrA%*1?d1^Ubo&PaBDNEK3*=E7C
zqKgs=#!2|g`9I9hMDQP0`vNuJR{22^2qtj?g$Nv@A(WyK49003M>l0WdNT-K!REu<
zWJGKTvNfOVoxdv|!}n>%%^MKi+?r@;>v373hamq$e%!pgjo?rlsoKQp_Ojy2x3Jyw
zaNPm9%k!*UZDnb6vO&+*51nrrMwtEu&};@4(3TdZvMu|#)hh8#v3Lc(l-`Xk;%%H~
z!@+njHSVy8>_2Q&6W;(YjyG;Z0esyjBw|wO&GCYI*+`KG$i{R<3@}+rMbNoSc8&*_AeSPQrfGIjxHv|v{_#8UB
zZrEo~Nw&J&vXL*7|E&D8d|t*EZ(~v5pklC}3Fp5)@|Oc|HidIhDA!+D^m3nOfRt?p
zh}*+o^nT=D#5iDaFSh;-7!xJ7UG>$Z9Vm#Ceh0HAv!v5CIUT9Sf6-_LrntK#H*2(w
zYgP}VXWryaRhc8#L?-Y`i?%W4&@qL_>CqpP2U4~6IVz%~Ov{g_+GT2RL<3@ezpeAI
z#4Q?UUC9#Gb$wwIGN82=`+~eYaCxW6$WhvK;2tz&q)(lI4;d6`#FfrWHXcPOh7ki3
zP{|hqRa!#;?k=8zXJj5*{WO}3D>j}usxIPgvrNr?JxN`sJE#Qjvzvf*GUQ0&IjjU-JG<
zR_^bIM4UiCy?Z`ItpN1MTNhI{ZWI0<;L0h?&cge)>9#7qgG*wu@
z5^qKpgW3X3r&}4bP3AmYr3Xb^_QpVKif6#EM~lyU#ZRoY&fiBR7&A3#mib)_Vf5&t(&!ogpyE%l0PZ}+=NmCtvlN+*_!yxirWq^
zZBvKA8uGf3n#GR-5ny|1tdR&d6m#GVw0`C9%zGvpu|x8wSLTvJ8JG2ix7f}7ew=)I
z5b1j-FDFtrGbMebI~!T^SFp=;eD@*lT3OFyA+4Z
znBT7TQ!L^LCxB>fZ?9|jjD)7sm6b(QLSXt2kh13|8qDfFS6=f)HJ|Z>Pj~88x(CKO
z>O_#gLT8zKKsBC_cn+TYSdqu6g<8B^YU|2n
zHpz_z+{}Q+pM(2yfgU3K?A$yPs4VWsMAW&VqYb`5ZC(p(x?$7TJ16%4ySiU
z)VX%!T)=-%S!tc{$j!B`D{pM=#h3~HJhQ2Eo6J-EX0%&=LO5hp
zW5BC|HL$%so>kx~M3OrO1lz;)El5>8xH8AB&!cn^thdj?2XlzT5wl^CoIIs?Typ9F
zSe-65!pX0ym&v$&IM}r0cDZ%V0#><7@?l+28dvw8hP?${-w60vR5P=4*r^{q0|H&7
zQ?9J7uU4mk^%+ws(q{+a>KNV7Q3RLpk=s^N-dyD>h!Y(d1e7|#VQ@FYx73V)^}eu1
zU=;pkjr+Rui{n15RsRon^))f^hr9Vcmi$mgV;c*Lc1>brOB`gxRyU^7EfQOUD`XG&
zwm2=`%s8Qs>jD_Ll@X$NBmKyyoISM(J+9H?7C>TKuk;!^(t8A#AX|Z8>$N8SL;X@Z
z6950Gd$T1s(Jl-0o~P)0PPdqcKcX){%%d13amS1h0*OHkPk#VA%Vk%(?CQV!M4Sjm
z+9m~jD3#yZ!`f?YQ{GUtPk)mevw9Pq++ETlY%6&ryK3?pOwzls7P@!fA!-X0iFB()
z5WAn~7j2LP-Dc6lEim08&m{b(KAzhw$tOYKk(Ze_GVa&&RQ;fKB}I^31mZ3&^p2cAn)uuB&KD_>61E|f%BbG#s_xEK%br`4Ze@^x?_lb&|(cE0f&=*POc2@UEUSw
zo{@wnp5;|`aqW6|StbX*RPa{#uZ+gDk-P>1b5V)S@mR4)yB=qN%XB8VX>xh4dZQU_
zQOn$}nDU-038q<0h=xU$#?;f$Cz)PQAjz~I;W%rsU@Mki0OH+Y%j5jC@N0<@BasJ<
zsm5OXN~=U_!?Z3L)r`sMCUc|%qq;uK!u76K2BVynQM7@c>qoVuhc3OvH%6dq+Qkvr
z=&uTL(9GoeB8$v^FXqH{+=;1M#}(qx3m1(4QX2vOF+==^hy)P0S6EoF70fq;JcKms
z34^SQ9+Dr@pVvl?0RqD~oINhU`5bfCOaRUCIwcNL$TEHkt|>$lVf;4Ar$%$pc_2@T
zJS{y}9Fg27K}Lax6H;|aIskN^r98DUvp~f!jGo^HIox8iPa6F1U
zkpWtBt!l1cGJp*V|E?C4C>Hql*C7K+Ou@KTe4dQK-mhpKdZaMTQ5G2Hbl+njqkPf>*1~R^2IwU+TE*g
zcw2Lf?pEHr2lwWKoo=fksJ+b&Z*c*IZm7F;`J=sE@XMib4&C6iJO2_+%l|DnRa~b0
z15PEufUXzi5uW|chtmtrMiV{gE<%!LaM8QnjC#g4KJ@s}1W^5N=K$+TpN(w)HoO8q
z;_EkfrG5)ufgkbpFYxMkqx>;bHBD|J3iGtj?D1!)RQ8%Q%&(xFa4L9$E
zHs?o#Hcfc2^&F@*TS*rA>Aw-2l$S()KWFrq6ctD!=f>@#;(_0sB`$=wpPc&kLYvn53;b6DJsN8EZ`ebJ4>pxt62SQl`(kVY1`
z9QGs=14ybSO)3l;&D+_3KGg2O9-cZvqntctYrc&Mlnsi*%kdZc5x90U80C4aklqh&
znAbyq6hxlVTQV!u)`P)JyeFv<9JBk0KmN`@7Vs;)6{Jzu3$R99_Ap6s(;#Zo#6-)&
zUA@6A@HyTx_Bm@RcQoFWawi`Jcr4u7OY*aK8TjUoz_*K49~-swfKKu-%C%p0>SVX(
z`tZ_g2gTPudV0C@lvz@{sR7ze*drcF#p9G4&edKs(EvX{z`r>GbJ~CcSeYE;wqcqP
zC%t#y4$GT|(8_i@#G=Jm662h*>&9R%sBkuu9&fx+z?=KTayfg-a)7E2-YahpRso@8
z;8uZfcVsEXphX5vS%9nhM1(Rp%@meR=|a>JdCFR8VrOKHdJZb^)DBiP`s&+kt}3Hi
zZ{Nm_jxa&AKugK}+^JP@N*I+nYSe_jwd2_qj!VzvSwd%=1_KZMc`a+`MLyXeMqJ#e
z?NkXRILN&rTkihLX-Q8W%;H=_{{y)FU^)L^;qL$5_5TXMzkBUpA~8(vZq?YNAeBPlo(BSe}`WqF}bzc`}CJc{P@Iu=l?q-HWvo}K;ktU`3{Ny
z#Qpx~s0{pF*82x42l-D?8Th-b_jgbk_%kejj>_F8XYmD<7v+0YM*JB_*5_Q`tbd#l
z{~lYw@N~1YUZ6+b=m-lc7&LE!IZ4YwTW~7p5$Fk+U4F{k1r5jAb-&EBo#^_wu=D8!
zFTiUYqQshdJ4($;oi}E94#|{nk7P;6r=&cfZ_5(U<(NLNjki!`ER(2oO2#Oi*?R)q
zcBej;k|W}3d{Jm}%0QYfDm)~SvL&^b5a
zw;`IzvRnK3um^fP(l%ZJY=y}`ed7nz{moN8fb{d1e>YuBKopAOG)d9~2BQ>3emY`I
zeVJ(rH{w^i)32#;wx)LjUd6>X$fV;f)!e)m$es8N
zZ8Bylz13`2eBDGok*#DL{Y)?vLU$rt^i>Ho#=klqY;cZkC$FFm!P@{;x=XF?ZVTJZ
zwnY#dK8HK@(|e73BfdjBQ!U$86aG?OnRB|D12%XB&-elFrggx!+eZl8Z=J^QEOcK`Z8I<6
zH^ERy=dR;dd*ty8sQqzlUkUIdqW{yC03S>F%SwK8UTO2!W9Xtk1!LSc_625dnkJ3n
zjG>0W-fczGdPT9_^U|5ak)W(PjPF+{^4o0gh%LQ3Ob4$=u!2et}PISkU*VU|44x$p0UT
zKu$jlCKyzpo{!13xy7Idl9fQF1|v+8mzfj`L
zSf9=>>HyRecEW>)|311%B~$;XI=g+$flo(jgJ2`}>c6c#Uo
zMU%91whN3Bct;C%y&l6geK)O|yS*-us9d1B$?!L+>8WC@7!G?O!*y`ay#pAA#>16&
zZ`m4X-QGPAP>wl!=6n%5|7NMw^*xzX>n*QVc|+st=9wqN1oOexwJ0cWPaO_q>I_9X
z1{ozs=YWBu?)-p3L&A(2Rgl{>Wbqqz3{Mc4=k+aVY8XTJqVp=r_ELyM8ii1ife+B>}?Z>9QuN&xZ
zL(Jct@)^W@d--<|L*pb$ArwL)8*_~$@lORdF=U@;-TiUaO`8t4KiJ-=qvB2Uc_T?D
zJHcyB*C&nOKHy*nuY-osQmobvBS&ac8|5wF70e7fROzZ(R_SZVo(~
z>JzkeF5zF3p?`#!jHh_hUc83`eKsrjzYj5+lmogZ5N&wI>%T%wJ{!W15VIfq--np*
zSMpCFrk7n^pW-3J?Jh(Fr!j|eK_8xLp1oYDHUDh$!IiFqb+^Xg5p}Zb`++&UbVFz0
zsz9UL&3uu{-7*pBp$uCcjbYo!;i_n8V<-r&FMXR3Ug7l}9JG#T>nemZ_Z&w<2;7fG
z`)E@+kz-w|K)k-8#0%D2RO^w`(^&V>n=ZZNQZnpU>!`%T;)m#b(cU-v;XAelSiCcd
zbXJVbg+UAEa7qzu4WB0&KE-e3e2M59wc@xWi>bh^Z>egGK9NTS2=!q79!jPyU*}K}42M5QOaC{Iqz|x#Ctr*LbTz=M|e+y#18K%nBr7HsBrE4_Y
zKcdIt9&62-1s(E&NeyGH$ft9@Pg}
zp{+Gw5FBrL@=$$}C$2;i=ruoAX
z8B{!%#tW~`UUACrZ#l?>i3t}pJd;zQni{|9u>okRfo`V~zYClZ3pJ)7YXU~4IlDY*$eEIey%Ry}(}zHK
z=dB1Hl~W|}+0>MoWCs`pOlbNJ)SHVQf@h8?Idxxi784E`!4V|(irn)l247+Srn~EpeM6pdj5dO6Gx7m{>+upm;g^7*)flwP+
z1WPwb}k$=ALM7r3%L)hqU&kdHn2)WTlN9%26XE>H*mo>vdnr9c=rciQEwA-NVjq!m2R}@
z6%beG$#%PNa;L>?;u7?3%KA%Ei(qespqcmsS)%Lc*{%3E4%m;#qHoAzx&IhhzR4SK
ztnn9QvEql{hZn#93#z!x@+EPxzM;yOV}Gmy_mx9A5jPmaM|mnMu`K+)W>v-l6p>C;
zSz{|WyE@0a+Ycgm_t31cCRbFNR8f^vc{tt*>#fnp>Hxj$D|riyIeaxK-Ua|zmZ>eo
zKAzq5*{EbJhtA3brL$}bN|X|>%4Ziwzd18vmn)>*Li#a*^+5&iRBN;j&{3x%RAvQ~
z8piKQ$PfGuB%gQmtZL}E?TP(uIfmhb9A4MP(0e8zbUlB*K}d9i6bB^TnpE1)-h%E3
z_#F6i^+*uD(5-k-yhkFQw1JxYsnpJdX(dW>Sl-%Gwb(1vYiL3OBxD|p6(x~VwLIr#
zhJ~J3*C2l`y{x&hM+T@F_JJg3P97MneO#*IwEFqs9aW4*Z
ze*(
zkhzXsurvK2E{ddcn1x#%HwVunBQ8QE;l(7kS%%3WaD;3A>?&wSPI>5G@k3;Z>Aai+
zE(+dW*%vGgJ{|R>w#AW_RTLIXE9J3Xd?RcGxfj431*p1fIb+I02(|)QtKC2zK;rdk
zKx09=`l0rZ@8^@gr`0Iv`jfrta({o&-no6Qfd{`vL3TKmzcafFd>e53zT(I+Uq%TS
z>$vz3WL@tVfvd}FVCT1fJINhXgAXhOFf}D)4WJ
z@h!h7ASv!0Cq3!zbw2fDeWS6e(bxQ|$0-iEyEoN`jb|=DyC`dQvOF6hdg=*+0z1eu
zZnr%1vD19;pV<;Ly`8cQc4;%51t{}8$L}Yfm&TDe!dDs&^=k_qYhg
zn)54I_F7{j2QdZ~F`LdA4`h)6bMJdjqw>i;)qCSeuBX%
zFXYb0YXatFC9NOIxp&k+i~*>umZOlR4=aSuIApPdbY#>UCh^VjSgf0&C#fJd!tw<<
znkV(?D|}!CrWc(XVu~~i7_f(U2XE1AQN$B{VNJ$j_PeEw`B2>&cR>#rkAy^SAN_EjACnoQ&D}!H0
z31LLC=*mMQnEKSY2gRK@!|3c
zdS>j>^2TfkO~CHOL@-)O04F@CNwUp!ir7^{$Xz%q+bF|p-oCDx
z3^y(kvOChR>t91Ia`)29sC^18-O}oGciN@n&A*DmcEM$23!)J8S3wbb*n*<#`CCO-
ziK|-|AJWPikNH*Jf}*8_*8Ni-?H>%}fM13p-==}rP$c;-Alf1k;3E`~d7rbEU8rNy
zIcC}n;0;b5^>PAbhMD1q;Ll-9`SACipy_jlvInZ+~Xc(KmGBfKa*
z@ZlEkNlF!+D>!m?Te@Gl&KbIZMM3~^0Hg}I5yiwwQHZ(l;^nL@^)ZOq1+DzktAxAJ
zA>NjE0dJ-lc5m%oK3cZmQgyKm%A|p=gF5`4-NYd%2M!uEwB%j-4RM6sxPm{2xR;Wixm
za320qVem)SxtihFJ5w^3V`fS>fel+~eS=zBx*Yrt2%9LMjtPWwg$s}VL0sH&x`E4_
z-zft}FF09xsW%
z?el+nmp^;oeR_xQynaZU#6HzsSa-T~r)6%Ial2FY7fvQdZ0Q|EZ;E*9jss_feqfCRY_H8;&%XwzK!RjF~<
z$RIECWAEcw-eo=&k(Yin!(nwmcjQt2gVA64(W4@Qi~U~n%<761LxfE40I4>bhO6EA
zL3iR&u|AX$a1Pjb3&|P!mB;6_rfB&G8ASAUuE(}Zea+`Y|1NKWuu}4lAKj*{@J;iU
zljn`&Xe>JVRj^^&{e8Y31I{H2{xH>Rxg3Af*NFYACPUz#@n`z*p=kaKT_p#+8E3Wf
zn??6=v*_L)N7}aZU-U`428W|yVrQIT$!D*?@PUTAzJpr{@O-d+a_ZxHO_3-EMW|%f#IwAFep-lJm4pu)
zpK>8+xp8vJf`W3_aptm-1&U+|O$Xe|DWVAcG{KR7ex>JI)-Erk^kggu6pB(5a_*v9
z$kjq
zSHd#W>a)YSyMW!fCixzUS{=B13hEv&%AG6T$br*A3`;Bc4#H>F#B;A9y$a`{fpCoO
z4PG?Yj9XBmb0~hFA#1%0z{IBxE%;u5p==O1`%*mWFu^2!E>%yt;7{1qd^xb}u*RM5
z3!pow0DnQ1?|r`Iq(e3KK;7x?Vvx~by-k%jpa7=77C?c|DxjYhK-I8m9nEB19(O%AAE!wxjo~hRr
z@Ec=^O-B@ad9tGB{k}o&xeng$P?))e9nPbEYgiQws@!(Ej+->=rQVRU05Z6*O)>zX
z*ScO)JoXhSBv(5xddMDmS2Lye?7X9oAL^zS&a$}XPyOP;S%=||{*F<;gu3(Znxw37
z=bl$&`#S@=74}?4J~PIDZV>4G_gC$pA5in(xXcGE{_+yP6tN9=uQ)2(;_r;!*b>n$
zS-YkOE3&}pMwQqG`oc|&mZU#L#ubR@bStG2`>fp-^v7FO6WJYCHcxAO`?^N*A++;1
z=p8Q6e__iF;A47R@p(bDj!2f^Yi5
z3~+QSoC{=J!z+klCDoy5lDrr-;!2Vqw!EFK6@&zA^67gffwWSUGPGY
zpRGx#txU?TPG;jClq5h!FIuL6L!XF=yd>q5o{r58aagvu#>;@6inrqDj;6tC)P~iW
zh^52&_qAA#NS>t^z|O|NU%EB|ZHZPY;ZUFxsHEkMg-}VDPndMA9u