/Packs/ThreatConnect/Integrations/ThreatConnect_v2/ThreatConnect_v2.yml

https://github.com/demisto/content · YAML · 2100 lines · 2100 code · 0 blank · 0 comment · 0 complexity · b7b492765fdf58d7576c95f360e1470a MD5 · raw file

Large files are truncated click here to view the full file

    

  1. commonfields:
    2. 

  2.   id: ThreatConnect v2
    3. 

  3.   version: -1
    4. 

  4. name: ThreatConnect v2
    5. 

  5. display: ThreatConnect v2
    6. 

  6. category: Data Enrichment & Threat Intelligence
    7. 

  7. description: ThreatConnect's intelligence-driven security operations solution with intelligence, automation, analytics, and workflows.
    8. 

  8. configuration:
    9. 

  9. - display: baseUrl
    10. 

  10.   name: baseUrl
    11. 

  11.   defaultvalue: https://api.threatconnect.com
    12. 

  12.   type: 0
    13. 

  13.   required: true
    14. 

  14. - display: Access ID
    15. 

  15.   name: accessId
    16. 

  16.   defaultvalue: ""
    17. 

  17.   type: 0
    18. 

  18.   required: true
    19. 

  19. - display: Secret Key
    20. 

  20.   name: secretKey
    21. 

  21.   defaultvalue: ""
    22. 

  22.   type: 4
    23. 

  23.   required: true
    24. 

  24. - display: Default Organization
    25. 

  25.   name: defaultOrg
    26. 

  26.   defaultvalue: ""
    27. 

  27.   type: 0
    28. 

  28.   required: false
    29. 

  29. - display: Rating threshold for Malicious Indicators
    30. 

  30.   name: rating
    31. 

  31.   defaultvalue: "3"
    32. 

  32.   type: 0
    33. 

  33.   required: false
    34. 

  34. - display: Confidence threshold for Malicious Indicators
    35. 

  35.   name: confidence
    36. 

  36.   defaultvalue: "50"
    37. 

  37.   type: 0
    38. 

  38.   required: false
    39. 

  39. - display: Indicator Reputation Freshness (in days)
    40. 

  40.   name: freshness
    41. 

  41.   defaultvalue: "7"
    42. 

  42.   type: 0
    43. 

  43.   required: false
    44. 

  44. - display: Use system proxy settings
    45. 

  45.   name: proxy
    46. 

  46.   required: false
    47. 

  47.   type: 8
    48. 

  48. script:
    49. 

  49.   script: '-'
    50. 

  50.   type: python
    51. 

  51.   commands:
    52. 

  52.   - name: ip
    53. 

  53.     arguments:
    54. 

  54.     - name: ip
    55. 

  55.       required: true
    56. 

  56.       default: true
    57. 

  57.       description: The IPv4 or IPv6 address.
    58. 

  58.     - name: owners
    59. 

  59.       description: A comma-separated list of a client's organizations, sources, or communities
    60. 

  60.         to which a user has permissions. For example, users with admin permissions
    61. 

  61.         can search for indicators belonging to all owners.
    62. 

  62.     - name: ratingThreshold
    63. 

  63.       description: A list of results filtered by indicators whose threat rating is
    64. 

  64.         greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious",
    65. 

  65.         "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    66. 

  66.     - name: confidenceThreshold
    67. 

  67.       description: A list of results filtered by indicators whose confidence rating
    68. 

  68.         is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited",
    69. 

  69.         "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%"
    70. 

  70.         - "Probable," or "90-100%" - "Confirmed".
    71. 

  71.     outputs:
    72. 

  72.     - contextPath: TC.Indicator.Name
    73. 

  73.       description: The name of the indicator.
    74. 

  74.       type: string
    75. 

  75.     - contextPath: TC.Indicator.Type
    76. 

  76.       description: The type of the indicator.
    77. 

  77.       type: string
    78. 

  78.     - contextPath: TC.Indicator.ID
    79. 

  79.       description: The ID of the indicator.
    80. 

  80.       type: string
    81. 

  81.     - contextPath: TC.Indicator.Description
    82. 

  82.       description: The description of the indicator.
    83. 

  83.       type: string
    84. 

  84.     - contextPath: TC.Indicator.Owner
    85. 

  85.       description: The owner of the indicator.
    86. 

  86.       type: string
    87. 

  87.     - contextPath: TC.Indicator.CreateDate
    88. 

  88.       description: The date on which the indicator was created.
    89. 

  89.       type: date
    90. 

  90.     - contextPath: TC.Indicator.LastModified
    91. 

  91.       description: The date on which the indicator was modified.
    92. 

  92.       type: date
    93. 

  93.     - contextPath: TC.Indicator.Rating
    94. 

  94.       description: The threat rating of the indicator.
    95. 

  95.       type: number
    96. 

  96.     - contextPath: TC.Indicator.Confidence
    97. 

  97.       description: The confidence rating of the indicator.
    98. 

  98.       type: number
    99. 

  99.     - contextPath: DBotScore.Indicator
    100. 

  100.       description: The value assigned by DBot for the indicator.
    101. 

  101.       type: string
    102. 

  102.     - contextPath: DBotScore.Type
    103. 

  103.       description: The type assigned by DBot for the indicator.
    104. 

  104.       type: string
    105. 

  105.     - contextPath: DBotScore.Score
    106. 

  106.       description: The score assigned by DBot for the indicator.
    107. 

  107.       type: number
    108. 

  108.     - contextPath: DBotScore.Vendor
    109. 

  109.       description: The vendor used to calculate the score.
    110. 

  110.       type: string
    111. 

  111.     - contextPath: IP.Address
    112. 

  112.       description: The IP address of the indicator.
    113. 

  113.       type: string
    114. 

  114.     - contextPath: IP.Malicious.Vendor
    115. 

  115.       description: For malicious IP addresses, the vendor that made the decision.
    116. 

  116.       type: string
    117. 

  117.     - contextPath: IP.Malicious.Description
    118. 

  118.       description: For malicious IP addresses, the full description.
    119. 

  119.       type: string
    120. 

  120.     description: Searches for an indicator of type IP address.
    121. 

  121.   - name: url
    122. 

  122.     arguments:
    123. 

  123.     - name: url
    124. 

  124.       required: true
    125. 

  125.       default: true
    126. 

  126.       description: The URL for which to search. For example, "www.demisto.com".
    127. 

  127.     - name: owners
    128. 

  128.       description: A comma-separated list of a client's organizations, sources, or communities
    129. 

  129.         to which a client’s API user has been granted permission. For example, "owner1",
    130. 

  130.         "owner2", or "owner3".
    131. 

  131.     - name: ratingThreshold
    132. 

  132.       description: A list of results filtered by indicators whose threat rating is
    133. 

  133.         greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious",
    134. 

  134.         "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    135. 

  135.     - name: confidenceThreshold
    136. 

  136.       description: A list of results filtered by indicators whose confidence rating
    137. 

  137.         is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited",
    138. 

  138.         "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%"
    139. 

  139.         - "Probable," or "90-100%" - "Confirmed".
    140. 

  140.     outputs:
    141. 

  141.     - contextPath: TC.Indicator.Name
    142. 

  142.       description: The name of the indicator.
    143. 

  143.       type: string
    144. 

  144.     - contextPath: TC.Indicator.Type
    145. 

  145.       description: The type of the indicator.
    146. 

  146.       type: string
    147. 

  147.     - contextPath: TC.Indicator.ID
    148. 

  148.       description: The ID of the indicator.
    149. 

  149.       type: string
    150. 

  150.     - contextPath: TC.Indicator.Description
    151. 

  151.       description: The description of the indicator.
    152. 

  152.       type: string
    153. 

  153.     - contextPath: TC.Indicator.Owner
    154. 

  154.       description: The owner of the indicator.
    155. 

  155.       type: string
    156. 

  156.     - contextPath: TC.Indicator.CreateDate
    157. 

  157.       description: The date on which the indicator was created.
    158. 

  158.       type: date
    159. 

  159.     - contextPath: TC.Indicator.LastModified
    160. 

  160.       description: The date on which the indicator was last modified.
    161. 

  161.       type: date
    162. 

  162.     - contextPath: TC.Indicator.Rating
    163. 

  163.       description: The threat rating of the indicator.
    164. 

  164.       type: number
    165. 

  165.     - contextPath: TC.Indicator.Confidence
    166. 

  166.       description: The confidence rating of the indicator.
    167. 

  167.       type: number
    168. 

  168.     - contextPath: DBotScore.Indicator
    169. 

  169.       description: The value assigned by DBot for the indicator.
    170. 

  170.       type: string
    171. 

  171.     - contextPath: DBotScore.Type
    172. 

  172.       description: The type assigned by DBot for the indicator.
    173. 

  173.       type: string
    174. 

  174.     - contextPath: DBotScore.Score
    175. 

  175.       description: The score assigned by DBot for the indicator.
    176. 

  176.       type: number
    177. 

  177.     - contextPath: DBotScore.Vendor
    178. 

  178.       description: The vendor used to calculate the score.
    179. 

  179.       type: string
    180. 

  180.     - contextPath: URL.Data
    181. 

  181.       description: The data of the URL indicator.
    182. 

  182.       type: string
    183. 

  183.     - contextPath: URL.Malicious.Vendor
    184. 

  184.       description: For malicious URLs, the vendor that made the decision.
    185. 

  185.       type: string
    186. 

  186.     - contextPath: URL.Malicious.Description
    187. 

  187.       description: For malicious URLs, the full description.
    188. 

  188.       type: string
    189. 

  189.     description: Searches for an indicator of type URL.
    190. 

  190.   - name: file
    191. 

  191.     arguments:
    192. 

  192.     - name: file
    193. 

  193.       required: true
    194. 

  194.       default: true
    195. 

  195.       description: The hash of the file. Can be "MD5", "SHA-1", or "SHA-256".
    196. 

  196.     - name: owners
    197. 

  197.       description: A comma-separated list of a client's organizations, sources, or communities
    198. 

  198.         to which a user has permissions. For example, users with admin permissions
    199. 

  199.         can search for indicators belonging to all owners.
    200. 

  200.     - name: ratingThreshold
    201. 

  201.       description: A list of results filtered by indicators whose threat rating is
    202. 

  202.         greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious",
    203. 

  203.         "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    204. 

  204.     - name: confidenceThreshold
    205. 

  205.       description: A list of results filtered by indicators whose confidence rating
    206. 

  206.         is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited",
    207. 

  207.         "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%"
    208. 

  208.         - "Probable," or "90-100%" - "Confirmed".
    209. 

  209.     outputs:
    210. 

  210.     - contextPath: TC.Indicator.Name
    211. 

  211.       description: The name of the indicator.
    212. 

  212.       type: string
    213. 

  213.     - contextPath: TC.Indicator.Type
    214. 

  214.       description: The type of the indicator.
    215. 

  215.       type: string
    216. 

  216.     - contextPath: TC.Indicator.ID
    217. 

  217.       description: The ID of the indicator.
    218. 

  218.       type: string
    219. 

  219.     - contextPath: TC.Indicator.Description
    220. 

  220.       description: The description of the indicator.
    221. 

  221.       type: string
    222. 

  222.     - contextPath: TC.Indicator.Owner
    223. 

  223.       description: The owner of the indicator.
    224. 

  224.       type: string
    225. 

  225.     - contextPath: TC.Indicator.CreateDate
    226. 

  226.       description: The date on which the indicator was created.
    227. 

  227.       type: date
    228. 

  228.     - contextPath: TC.Indicator.LastModified
    229. 

  229.       description: The last date on which the indicator was modified.
    230. 

  230.       type: date
    231. 

  231.     - contextPath: TC.Indicator.Rating
    232. 

  232.       description: The threat rating of the indicator.
    233. 

  233.       type: number
    234. 

  234.     - contextPath: TC.Indicator.Confidence
    235. 

  235.       description: The confidence rating of the indicator.
    236. 

  236.       type: number
    237. 

  237.     - contextPath: TC.Indicator.File.MD5
    238. 

  238.       description: The MD5 hash of the indicator.
    239. 

  239.       type: string
    240. 

  240.     - contextPath: TC.Indicator.File.SHA1
    241. 

  241.       description: The SHA1 hash of the indicator.
    242. 

  242.       type: string
    243. 

  243.     - contextPath: TC.Indicator.File.SHA256
    244. 

  244.       description: The SHA256 hash of the indicator.
    245. 

  245.       type: string
    246. 

  246.     - contextPath: DBotScore.Indicator
    247. 

  247.       description: The value assigned by DBot for the indicator.
    248. 

  248.       type: string
    249. 

  249.     - contextPath: DBotScore.Type
    250. 

  250.       description: The type assigned by DBot for the indicator.
    251. 

  251.       type: string
    252. 

  252.     - contextPath: DBotScore.Score
    253. 

  253.       description: The score assigned by DBot for the indicator.
    254. 

  254.       type: number
    255. 

  255.     - contextPath: DBotScore.Vendor
    256. 

  256.       description: The vendor used to calculate the score.
    257. 

  257.       type: string
    258. 

  258.     - contextPath: File.MD5
    259. 

  259.       description: The MD5 hash of the indicator.
    260. 

  260.       type: string
    261. 

  261.     - contextPath: File.SHA1
    262. 

  262.       description: The SHA1 hash of the indicator.
    263. 

  263.       type: string
    264. 

  264.     - contextPath: File.SHA256
    265. 

  265.       description: The SHA256 hash of the indicator.
    266. 

  266.       type: string
    267. 

  267.     - contextPath: File.Malicious.Vendor
    268. 

  268.       description: For malicious files, the vendor that made the decision.
    269. 

  269.       type: string
    270. 

  270.     - contextPath: File.Malicious.Description
    271. 

  271.       description: For malicious files, the full description.
    272. 

  272.       type: string
    273. 

  273.     description: Searches for an indicator of type file.
    274. 

  274.   - name: tc-owners
    275. 

  275.     arguments: []
    276. 

  276.     outputs:
    277. 

  277.     - contextPath: TC.Owner.Name
    278. 

  278.       description: The name of the owner.
    279. 

  279.       type: string
    280. 

  280.     - contextPath: TC.Owner.ID
    281. 

  281.       description: The ID of the owner.
    282. 

  282.       type: string
    283. 

  283.     - contextPath: TC.Owner.Type
    284. 

  284.       description: The type of the owner.
    285. 

  285.       type: string
    286. 

  286.     description: Retrieves all owners for the current account.
    287. 

  287.   - name: tc-indicators
    288. 

  288.     arguments:
    289. 

  289.     - name: owner
    290. 

  290.       description: A list of results filtered by the owner of the indicator.
    291. 

  291.     - name: limit
    292. 

  292.       description: The maximum number of results that can be returned. The default
    293. 

  293.         is 500.
    294. 

  294.     outputs:
    295. 

  295.     - contextPath: TC.Indicator.Name
    296. 

  296.       description: The name of the indicator.
    297. 

  297.       type: string
    298. 

  298.     - contextPath: TC.Indicator.Type
    299. 

  299.       description: The type of the indicator.
    300. 

  300.       type: string
    301. 

  301.     - contextPath: TC.Indicator.ID
    302. 

  302.       description: The ID of the indicator.
    303. 

  303.       type: string
    304. 

  304.     - contextPath: TC.Indicator.Description
    305. 

  305.       description: The description of the indicator.
    306. 

  306.       type: string
    307. 

  307.     - contextPath: TC.Indicator.Owner
    308. 

  308.       description: The owner of the indicator.
    309. 

  309.       type: string
    310. 

  310.     - contextPath: TC.Indicator.CreateDate
    311. 

  311.       description: The date on which the indicator was created.
    312. 

  312.       type: date
    313. 

  313.     - contextPath: TC.Indicator.LastModified
    314. 

  314.       description: The last date on which the indicator was modified.
    315. 

  315.       type: date
    316. 

  316.     - contextPath: TC.Indicator.Rating
    317. 

  317.       description: The threat rating of the indicator.
    318. 

  318.       type: number
    319. 

  319.     - contextPath: TC.Indicator.Confidence
    320. 

  320.       description: The confidence rating of the indicator.
    321. 

  321.       type: number
    322. 

  322.     - contextPath: TC.Indicator.WhoisActive
    323. 

  323.       description: The active indicator (for domains only).
    324. 

  324.       type: string
    325. 

  325.     - contextPath: TC.Indicator.File.MD5
    326. 

  326.       description: The MD5 hash of the indicator of the file.
    327. 

  327.       type: string
    328. 

  328.     - contextPath: TC.Indicator.File.SHA1
    329. 

  329.       description: The SHA1 hash of the indicator of the file.
    330. 

  330.       type: string
    331. 

  331.     - contextPath: TC.Indicator.File.SHA256
    332. 

  332.       description: The SHA256 hash of the indicator of the file.
    333. 

  333.       type: string
    334. 

  334.     - contextPath: DBotScore.Indicator
    335. 

  335.       description: The value assigned by DBot for the indicator.
    336. 

  336.       type: string
    337. 

  337.     - contextPath: DBotScore.Type
    338. 

  338.       description: The type assigned by DBot for the indicator.
    339. 

  339.       type: string
    340. 

  340.     - contextPath: DBotScore.Score
    341. 

  341.       description: The score assigned by DBot for the indicator.
    342. 

  342.       type: number
    343. 

  343.     - contextPath: DBotScore.Vendor
    344. 

  344.       description: The vendor used to calculate the score.
    345. 

  345.       type: string
    346. 

  346.     - contextPath: IP.Address
    347. 

  347.       description: The IP address of the indicator.
    348. 

  348.       type: string
    349. 

  349.     - contextPath: IP.Malicious.Vendor
    350. 

  350.       description: For malicious IP addresses, the vendor that made the decision.
    351. 

  351.       type: string
    352. 

  352.     - contextPath: IP.Malicious.Description
    353. 

  353.       description: For malicious IP addresses, the full description.
    354. 

  354.       type: string
    355. 

  355.     - contextPath: URL.Data
    356. 

  356.       description: The data of the URL of the indicator.
    357. 

  357.       type: string
    358. 

  358.     - contextPath: URL.Malicious.Vendor
    359. 

  359.       description: For malicious URLs, the vendor that made the decision.
    360. 

  360.       type: string
    361. 

  361.     - contextPath: URL.Malicious.Description
    362. 

  362.       description: For malicious URLs, the full description.
    363. 

  363.       type: string
    364. 

  364.     - contextPath: Domain.Name
    365. 

  365.       description: The name of the domain.
    366. 

  366.       type: string
    367. 

  367.     - contextPath: Domain.Malicious.Vendor
    368. 

  368.       description: For malicious domains, the vendor that made the decision.
    369. 

  369.       type: string
    370. 

  370.     - contextPath: Domain.Malicious.Description
    371. 

  371.       description: For malicious domains, the full description.
    372. 

  372.       type: string
    373. 

  373.     - contextPath: File.MD5
    374. 

  374.       description: The MD5 hash of the file.
    375. 

  375.       type: string
    376. 

  376.     - contextPath: File.SHA1
    377. 

  377.       description: The SHA1 hash of the file.
    378. 

  378.       type: string
    379. 

  379.     - contextPath: File.SHA256
    380. 

  380.       description: The SHA256 hash of the file.
    381. 

  381.       type: string
    382. 

  382.     - contextPath: File.Malicious.Vendor
    383. 

  383.       description: For malicious files, the vendor that made the decision.
    384. 

  384.       type: string
    385. 

  385.     - contextPath: File.Malicious.Description
    386. 

  386.       description: For malicious files, the full description.
    387. 

  387.       type: string
    388. 

  388.     description: Retrieves a list of all indicators.
    389. 

  389.   - name: tc-get-tags
    390. 

  390.     arguments: []
    391. 

  391.     outputs:
    392. 

  392.     - contextPath: TC.Tags
    393. 

  393.       description: A list of tags.
    394. 

  394.       type: Unknown
    395. 

  395.     description: Returns a list of all ThreatConnect tags.
    396. 

  396.   - name: tc-tag-indicator
    397. 

  397.     arguments:
    398. 

  398.     - name: tag
    399. 

  399.       required: true
    400. 

  400.       description: The name of the tag.
    401. 

  401.     - name: indicator
    402. 

  402.       required: true
    403. 

  403.       description: The indicator to tag. For example, for an IP indicator, "8.8.8.8".
    404. 

  404.     - name: owner
    405. 

  405.       description: A list of indicators filtered by the owner.
    406. 

  406.     description: Adds a tag to an existing indicator.
    407. 

  407.   - name: tc-get-indicator
    408. 

  408.     arguments:
    409. 

  409.     - name: indicator
    410. 

  410.       required: true
    411. 

  411.       default: true
    412. 

  412.       description: The name of the indicator by which to search. The command retrieves
    413. 

  413.         information from all owners. Can be an IP address, a URL, or a file hash.
    414. 

  414.     - name: indicator_type
    415. 

  415.       description: Only for custom. Leave empty for standard ones
    416. 

  416.     - name: owners
    417. 

  417.       description: Indicator Owner(s)
    418. 

  418.     - name: ratingThreshold
    419. 

  419.       description: A list of results filtered by indicators whose threat rating is
    420. 

  420.         greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious",
    421. 

  421.         "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    422. 

  422.     - name: confidenceThreshold
    423. 

  423.       description: A list of results filtered by indicators whose confidence rating
    424. 

  424.         is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited",
    425. 

  425.         "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%"
    426. 

  426.         - "Probable," or "90-100%" - "Confirmed".
    427. 

  427.     - name: group_associations
    428. 

  428.       required: true
    429. 

  429.       auto: PREDEFINED
    430. 

  430.       predefined:
    431. 

  431.       - "true"
    432. 

  432.       - "false"
    433. 

  433.       description: Retrieve Indicator Group Associations
    434. 

  434.       defaultValue: "false"
    435. 

  435.     - name: indicator_associations
    436. 

  436.       auto: PREDEFINED
    437. 

  437.       predefined:
    438. 

  438.       - "true"
    439. 

  439.       - "false"
    440. 

  440.       description: Retrieve Indicator Associations
    441. 

  441.       defaultValue: "false"
    442. 

  442.     - name: indicator_observations
    443. 

  443.       auto: PREDEFINED
    444. 

  444.       predefined:
    445. 

  445.       - "true"
    446. 

  446.       - "false"
    447. 

  447.       description: Retrieve Indicator Observations
    448. 

  448.       defaultValue: "false"
    449. 

  449.     - name: indicator_tags
    450. 

  450.       auto: PREDEFINED
    451. 

  451.       predefined:
    452. 

  452.       - "true"
    453. 

  453.       - "false"
    454. 

  454.       description: Retrieve Indicator Tags
    455. 

  455.       defaultValue: "false"
    456. 

  456.     outputs:
    457. 

  457.     - contextPath: TC.Indicator.Name
    458. 

  458.       description: The name of the indicator.
    459. 

  459.       type: string
    460. 

  460.     - contextPath: TC.Indicator.Type
    461. 

  461.       description: The type of the indicator.
    462. 

  462.       type: string
    463. 

  463.     - contextPath: TC.Indicator.ID
    464. 

  464.       description: The ID of the indicator.
    465. 

  465.       type: string
    466. 

  466.     - contextPath: TC.Indicator.Description
    467. 

  467.       description: The description of the indicator.
    468. 

  468.       type: string
    469. 

  469.     - contextPath: TC.Indicator.Owner
    470. 

  470.       description: The owner of the indicator.
    471. 

  471.       type: string
    472. 

  472.     - contextPath: TC.Indicator.CreateDate
    473. 

  473.       description: The date on which the indicator was created.
    474. 

  474.       type: date
    475. 

  475.     - contextPath: TC.Indicator.LastModified
    476. 

  476.       description: The last date on which the indicator was modified.
    477. 

  477.       type: date
    478. 

  478.     - contextPath: TC.Indicator.Rating
    479. 

  479.       description: The threat rating of the indicator.
    480. 

  480.       type: number
    481. 

  481.     - contextPath: TC.Indicator.Confidence
    482. 

  482.       description: The confidence rating of the indicator.
    483. 

  483.       type: number
    484. 

  484.     - contextPath: TC.Indicator.WhoisActive
    485. 

  485.       description: The active indicator (for domains only).
    486. 

  486.       type: string
    487. 

  487.     - contextPath: TC.Indicator.File.MD5
    488. 

  488.       description: The MD5 hash of the indicator of the file.
    489. 

  489.       type: string
    490. 

  490.     - contextPath: TC.Indicator.File.SHA1
    491. 

  491.       description: The SHA1 hash of the indicator of the file.
    492. 

  492.       type: string
    493. 

  493.     - contextPath: TC.Indicator.File.SHA256
    494. 

  494.       description: The SHA256 hash of the indicator of the file.
    495. 

  495.       type: string
    496. 

  496.     - contextPath: DBotScore.Indicator
    497. 

  497.       description: The value assigned by DBot for the indicator.
    498. 

  498.       type: string
    499. 

  499.     - contextPath: DBotScore.Type
    500. 

  500.       description: The type assigned by DBot for the indicator.
    501. 

  501.       type: string
    502. 

  502.     - contextPath: DBotScore.Score
    503. 

  503.       description: The score assigned by DBot for the indicator.
    504. 

  504.       type: number
    505. 

  505.     - contextPath: DBotScore.Vendor
    506. 

  506.       description: The vendor used to calculate the score.
    507. 

  507.       type: string
    508. 

  508.     - contextPath: IP.Address
    509. 

  509.       description: The IP address of the indicator.
    510. 

  510.       type: string
    511. 

  511.     - contextPath: IP.Malicious.Vendor
    512. 

  512.       description: For malicious IP addresses, the vendor that made the decision.
    513. 

  513.       type: string
    514. 

  514.     - contextPath: IP.Malicious.Description
    515. 

  515.       description: For malicious IP addresses, the full description.
    516. 

  516.       type: string
    517. 

  517.     - contextPath: URL.Data
    518. 

  518.       description: The data of the indicator of the URL.
    519. 

  519.       type: string
    520. 

  520.     - contextPath: URL.Malicious.Vendor
    521. 

  521.       description: For malicious URLs, the vendor that made the decision.
    522. 

  522.       type: string
    523. 

  523.     - contextPath: URL.Malicious.Description
    524. 

  524.       description: For malicious URLs, the full description.
    525. 

  525.       type: string
    526. 

  526.     - contextPath: Domain.Name
    527. 

  527.       description: The domain name of the indicator.
    528. 

  528.       type: string
    529. 

  529.     - contextPath: Domain.Malicious.Vendor
    530. 

  530.       description: For malicious domains, the vendor that made the decision.
    531. 

  531.       type: string
    532. 

  532.     - contextPath: Domain.Malicious.Description
    533. 

  533.       description: For malicious domains, the full description.
    534. 

  534.       type: string
    535. 

  535.     - contextPath: File.MD5
    536. 

  536.       description: The MD5 hash of the file.
    537. 

  537.       type: string
    538. 

  538.     - contextPath: File.SHA1
    539. 

  539.       description: The SHA1 hash of the file.
    540. 

  540.       type: string
    541. 

  541.     - contextPath: File.SHA256
    542. 

  542.       description: The SHA256 hash of the file.
    543. 

  543.       type: string
    544. 

  544.     - contextPath: File.Malicious.Vendor
    545. 

  545.       description: For malicious files, the vendor that made the decision.
    546. 

  546.       type: string
    547. 

  547.     - contextPath: File.Malicious.Description
    548. 

  548.       description: For malicious files, the full description.
    549. 

  549.       type: string
    550. 

  550.     description: Retrieves information about an indicator.
    551. 

  551.   - name: tc-get-indicators-by-tag
    552. 

  552.     arguments:
    553. 

  553.     - name: tag
    554. 

  554.       required: true
    555. 

  555.       default: true
    556. 

  556.       description: The name of the tag by which to filter.
    557. 

  557.     - name: owner
    558. 

  558.       description: A list of indicators filtered by the owner.
    559. 

  559.     outputs:
    560. 

  560.     - contextPath: TC.Indicator.Name
    561. 

  561.       description: The name of the tagged indicator.
    562. 

  562.       type: string
    563. 

  563.     - contextPath: TC.Indicator.Type
    564. 

  564.       description: The type of the tagged indicator.
    565. 

  565.       type: string
    566. 

  566.     - contextPath: TC.Indicator.ID
    567. 

  567.       description: The ID of the tagged indicator.
    568. 

  568.       type: string
    569. 

  569.     - contextPath: TC.Indicator.Description
    570. 

  570.       description: The description of the tagged indicator.
    571. 

  571.       type: string
    572. 

  572.     - contextPath: TC.Indicator.Owner
    573. 

  573.       description: The owner of the tagged indicator.
    574. 

  574.       type: string
    575. 

  575.     - contextPath: TC.Indicator.CreateDate
    576. 

  576.       description: The date on which the tagged indicator was created.
    577. 

  577.       type: date
    578. 

  578.     - contextPath: TC.Indicator.LastModified
    579. 

  579.       description: The last date on which the tagged indicator was modified.
    580. 

  580.       type: date
    581. 

  581.     - contextPath: TC.Indicator.Rating
    582. 

  582.       description: The threat rating of the tagged indicator.
    583. 

  583.       type: number
    584. 

  584.     - contextPath: TC.Indicator.Confidence
    585. 

  585.       description: The confidence rating of the tagged indicator.
    586. 

  586.       type: number
    587. 

  587.     - contextPath: TC.Indicator.WhoisActive
    588. 

  588.       description: The active indicator (for domains only).
    589. 

  589.       type: string
    590. 

  590.     - contextPath: TC.Indicator.File.MD5
    591. 

  591.       description: The MD5 hash of the indicator of the file.
    592. 

  592.       type: string
    593. 

  593.     - contextPath: TC.Indicator.File.SHA1
    594. 

  594.       description: The SHA1 hash of the indicator of the file.
    595. 

  595.       type: string
    596. 

  596.     - contextPath: TC.Indicator.File.SHA256
    597. 

  597.       description: The SHA256 hash of the indicator of the file.
    598. 

  598.       type: string
    599. 

  599.     - contextPath: DBotScore.Indicator
    600. 

  600.       description: The value assigned by DBot for the tagged indicator.
    601. 

  601.       type: string
    602. 

  602.     - contextPath: DBotScore.Type
    603. 

  603.       description: The type assigned by DBot for the tagged indicator.
    604. 

  604.       type: string
    605. 

  605.     - contextPath: DBotScore.Score
    606. 

  606.       description: The score assigned by DBot for the tagged indicator.
    607. 

  607.       type: number
    608. 

  608.     - contextPath: DBotScore.Vendor
    609. 

  609.       description: The vendor used to calculate the score.
    610. 

  610.       type: string
    611. 

  611.     - contextPath: IP.Address
    612. 

  612.       description: The IP address of the tagged indicator.
    613. 

  613.       type: string
    614. 

  614.     - contextPath: IP.Malicious.Vendor
    615. 

  615.       description: For malicious IP addresses, the vendor that made the decision.
    616. 

  616.       type: string
    617. 

  617.     - contextPath: IP.Malicious.Description
    618. 

  618.       description: For malicious IP addresses, the full description.
    619. 

  619.       type: string
    620. 

  620.     - contextPath: URL.Data
    621. 

  621.       description: The data of the URL of the tagged indicator.
    622. 

  622.       type: string
    623. 

  623.     - contextPath: URL.Malicious.Vendor
    624. 

  624.       description: For malicious URLs, the vendor that made the decision.
    625. 

  625.       type: string
    626. 

  626.     - contextPath: URL.Malicious.Description
    627. 

  627.       description: For malicious URLs, the full description.
    628. 

  628.       type: string
    629. 

  629.     - contextPath: Domain.Name
    630. 

  630.       description: The domain name of the tagged indicator.
    631. 

  631.       type: string
    632. 

  632.     - contextPath: Domain.Malicious.Vendor
    633. 

  633.       description: For malicious domains, the vendor that made the decision.
    634. 

  634.       type: string
    635. 

  635.     - contextPath: Domain.Malicious.Description
    636. 

  636.       description: For malicious domains, the full description.
    637. 

  637.       type: string
    638. 

  638.     - contextPath: File.MD5
    639. 

  639.       description: The MD5 hash of the file.
    640. 

  640.       type: string
    641. 

  641.     - contextPath: File.SHA1
    642. 

  642.       description: The SHA1 hash of the file.
    643. 

  643.       type: string
    644. 

  644.     - contextPath: File.SHA256
    645. 

  645.       description: The SHA256 hash of the file.
    646. 

  646.       type: string
    647. 

  647.     - contextPath: File.Malicious.Vendor
    648. 

  648.       description: For malicious files, the vendor that made the decision.
    649. 

  649.       type: string
    650. 

  650.     - contextPath: File.Malicious.Description
    651. 

  651.       description: For malicious files, the full description.
    652. 

  652.       type: string
    653. 

  653.     description: Fetches all indicators that have a tag.
    654. 

  654.   - name: tc-add-indicator
    655. 

  655.     arguments:
    656. 

  656.     - name: indicator
    657. 

  657.       required: true
    658. 

  658.       description: The indicator to add.
    659. 

  659.     - name: rating
    660. 

  660.       description: The threat rating of the indicator. Can be "0" - "Unknown", "1"
    661. 

  661.         - "Suspicious", "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    662. 

  662.     - name: confidence
    663. 

  663.       description: The confidence rating of the indicator. Can be "0%" - "Unknown,"
    664. 

  664.         "1% " - "Discredited", "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%"
    665. 

  665.         - "Possible", "70-89%" - "Probable," or "90-100%" - "Confirmed".
    666. 

  666.     - name: owner
    667. 

  667.       description: The owner of the new indicator. The default is the "defaultOrg"
    668. 

  668.         parameter.
    669. 

  669.     outputs:
    670. 

  670.     - contextPath: TC.Indicator.Name
    671. 

  671.       description: The name the indicator.
    672. 

  672.       type: string
    673. 

  673.     - contextPath: TC.Indicator.Type
    674. 

  674.       description: The type of indicator.
    675. 

  675.       type: string
    676. 

  676.     - contextPath: TC.Indicator.ID
    677. 

  677.       description: The ID of the indicator.
    678. 

  678.       type: string
    679. 

  679.     - contextPath: TC.Indicator.Description
    680. 

  680.       description: The description of the indicator.
    681. 

  681.       type: string
    682. 

  682.     - contextPath: TC.Indicator.Owner
    683. 

  683.       description: The owner of the indicator.
    684. 

  684.       type: string
    685. 

  685.     - contextPath: TC.Indicator.CreateDate
    686. 

  686.       description: The date on which the added indicator was created.
    687. 

  687.       type: date
    688. 

  688.     - contextPath: TC.Indicator.LastModified
    689. 

  689.       description: The last date on which the added indicator was modified.
    690. 

  690.       type: date
    691. 

  691.     - contextPath: TC.Indicator.Rating
    692. 

  692.       description: The threat rating of the indicator.
    693. 

  693.       type: number
    694. 

  694.     - contextPath: TC.Indicator.Confidence
    695. 

  695.       description: The confidence rating of the indicator.
    696. 

  696.       type: number
    697. 

  697.     - contextPath: TC.Indicator.WhoisActive
    698. 

  698.       description: The active indicator (for domains only).
    699. 

  699.       type: string
    700. 

  700.     - contextPath: TC.Indicator.File.MD5
    701. 

  701.       description: The MD5 hash of the indicator of the file.
    702. 

  702.       type: string
    703. 

  703.     - contextPath: TC.Indicator.File.SHA1
    704. 

  704.       description: The SHA1 hash of the indicator of the file.
    705. 

  705.       type: string
    706. 

  706.     - contextPath: TC.Indicator.File.SHA256
    707. 

  707.       description: The SHA256 hash of the indicator of the file.
    708. 

  708.       type: string
    709. 

  709.     - contextPath: IP.Address
    710. 

  710.       description: The IP address of the indicator.
    711. 

  711.       type: string
    712. 

  712.     - contextPath: IP.Malicious.Vendor
    713. 

  713.       description: For malicious IP addresses, the vendor that made the decision.
    714. 

  714.       type: string
    715. 

  715.     - contextPath: IP.Malicious.Description
    716. 

  716.       description: For malicious IP addresses, the full description.
    717. 

  717.       type: string
    718. 

  718.     - contextPath: URL.Data
    719. 

  719.       description: The data of the URL of the indicator.
    720. 

  720.       type: string
    721. 

  721.     - contextPath: URL.Malicious.Vendor
    722. 

  722.       description: For malicious URLs, the vendor that made the decision.
    723. 

  723.       type: string
    724. 

  724.     - contextPath: URL.Malicious.Description
    725. 

  725.       description: For malicious URLs, the full description.
    726. 

  726.       type: string
    727. 

  727.     - contextPath: Domain.Name
    728. 

  728.       description: The name of the added indicator of the domain.
    729. 

  729.       type: string
    730. 

  730.     - contextPath: Domain.Malicious.Vendor
    731. 

  731.       description: For malicious domains, the vendor that made the decision.
    732. 

  732.       type: string
    733. 

  733.     - contextPath: Domain.Malicious.Description
    734. 

  734.       description: For malicious domains, the full description.
    735. 

  735.       type: string
    736. 

  736.     - contextPath: File.MD5
    737. 

  737.       description: The MD5 hash of the file.
    738. 

  738.       type: string
    739. 

  739.     - contextPath: File.SHA1
    740. 

  740.       description: The SHA1 hash of the file.
    741. 

  741.       type: string
    742. 

  742.     - contextPath: File.SHA256
    743. 

  743.       description: The SHA256 hash of the file.
    744. 

  744.       type: string
    745. 

  745.     - contextPath: File.Malicious.Vendor
    746. 

  746.       description: For malicious files, the vendor that made the decision.
    747. 

  747.       type: string
    748. 

  748.     - contextPath: File.Malicious.Description
    749. 

  749.       description: For malicious files, the full description.
    750. 

  750.       type: string
    751. 

  751.     description: Adds a new indicator to ThreatConnect.
    752. 

  752.   - name: tc-create-incident
    753. 

  753.     arguments:
    754. 

  754.     - name: owner
    755. 

  755.       description: The owner of the new incident. The default is the "defaultOrg"
    756. 

  756.         parameter.
    757. 

  757.     - name: incidentName
    758. 

  758.       required: true
    759. 

  759.       default: true
    760. 

  760.       description: The name of the incident group.
    761. 

  761.     - name: eventDate
    762. 

  762.       description: The creation time of an incident in the "2017-03-21T00:00:00Z"
    763. 

  763.         format.
    764. 

  764.     - name: tag
    765. 

  765.       description: The tag applied to the incident.
    766. 

  766.     - name: securityLabel
    767. 

  767.       auto: PREDEFINED
    768. 

  768.       predefined:
    769. 

  769.       - TLP:RED
    770. 

  770.       - TLP:GREEN
    771. 

  771.       - TLP:AMBER
    772. 

  772.       - TLP:WHITE
    773. 

  773.       description: The security label applied to the incident. Can be "TLP:RED", "TLP:GREEN",
    774. 

  774.         "TLP:AMBER", or "TLP:WHITE".
    775. 

  775.     - name: description
    776. 

  776.       description: The description of the incident.
    777. 

  777.     outputs:
    778. 

  778.     - contextPath: TC.Incident.Name
    779. 

  779.       description: The name of the new incident group.
    780. 

  780.       type: string
    781. 

  781.     - contextPath: TC.Incident.Owner
    782. 

  782.       description: The owner of the new incident.
    783. 

  783.       type: string
    784. 

  784.     - contextPath: TC.Incident.EventDate
    785. 

  785.       description: The date on which the event that indicates an incident occurred.
    786. 

  786.       type: date
    787. 

  787.     - contextPath: TC.Incident.Tag
    788. 

  788.       description: The name of the tag of the new incident.
    789. 

  789.       type: string
    790. 

  790.     - contextPath: TC.Incident.SecurityLabel
    791. 

  791.       description: The security label of the new incident.
    792. 

  792.       type: string
    793. 

  793.     - contextPath: TC.Incident.ID
    794. 

  794.       description: The ID of the new incident.
    795. 

  795.       type: Unknown
    796. 

  796.     description: Creates a new incident group.
    797. 

  797.   - name: tc-fetch-incidents
    798. 

  798.     arguments:
    799. 

  799.     - name: incidentId
    800. 

  800.       default: true
    801. 

  801.       description: The fetched incidents filtered by ID.
    802. 

  802.     - name: owner
    803. 

  803.       description: The fetched incidents filtered by owner.
    804. 

  804.     - name: incidentName
    805. 

  805.       description: The fetched incidents filtered by incident name.
    806. 

  806.     outputs:
    807. 

  807.     - contextPath: TC.Incident
    808. 

  808.       description: The name of the group of fetched incidents.
    809. 

  809.       type: string
    810. 

  810.     - contextPath: TC.Incident.ID
    811. 

  811.       description: The ID of the fetched incidents.
    812. 

  812.       type: string
    813. 

  813.     - contextPath: TC.Incident.Owner
    814. 

  814.       description: The owner of the fetched incidents.
    815. 

  815.       type: string
    816. 

  816.     description: Fetches incidents from ThreatConnect.
    817. 

  817.   - name: tc-incident-associate-indicator
    818. 

  818.     arguments:
    819. 

  819.     - name: indicatorType
    820. 

  820.       required: true
    821. 

  821.       auto: PREDEFINED
    822. 

  822.       predefined:
    823. 

  823.       - ADDRESSES
    824. 

  824.       - EMAIL_ADDRESSES
    825. 

  825.       - URLS
    826. 

  826.       - HOSTS
    827. 

  827.       - FILES
    828. 

  828.       - CUSTOM_INDICATORS
    829. 

  829.       description: The type of the indicator. Can be "ADDRESSES", "EMAIL_ADDRESSES",
    830. 

  830.         "URLS", "HOSTS", "FILES", or "CUSTOM_INDICATORS".
    831. 

  831.     - name: incidentId
    832. 

  832.       required: true
    833. 

  833.       description: The ID of the incident to which the indicator is associated.
    834. 

  834.     - name: indicator
    835. 

  835.       required: true
    836. 

  836.       default: true
    837. 

  837.       description: The name of the indicator.
    838. 

  838.     - name: owner
    839. 

  839.       description: A list of indicators filtered by the owner.
    840. 

  840.     outputs:
    841. 

  841.     - contextPath: TC.Indicator.Name
    842. 

  842.       description: The name of the indicator.
    843. 

  843.       type: string
    844. 

  844.     - contextPath: TC.Indicator.Type
    845. 

  845.       description: The type of the indicator.
    846. 

  846.       type: string
    847. 

  847.     - contextPath: TC.Indicator.ID
    848. 

  848.       description: The ID of the indicator.
    849. 

  849.       type: string
    850. 

  850.     - contextPath: TC.Indicator.Description
    851. 

  851.       description: The description of the indicator.
    852. 

  852.       type: string
    853. 

  853.     - contextPath: TC.Indicator.Owner
    854. 

  854.       description: The owner of the indicator.
    855. 

  855.       type: string
    856. 

  856.     - contextPath: TC.Indicator.CreateDate
    857. 

  857.       description: The date on which the indicator associated was created.
    858. 

  858.       type: date
    859. 

  859.     - contextPath: TC.Indicator.LastModified
    860. 

  860.       description: The last date on which the indicator associated was modified.
    861. 

  861.       type: date
    862. 

  862.     - contextPath: TC.Indicator.Rating
    863. 

  863.       description: The threat rating of the indicator.
    864. 

  864.       type: number
    865. 

  865.     - contextPath: TC.Indicator.Confidence
    866. 

  866.       description: The confidence rating of the indicator.
    867. 

  867.       type: number
    868. 

  868.     - contextPath: TC.Indicator.WhoisActive
    869. 

  869.       description: The active indicator (for domains only).
    870. 

  870.       type: string
    871. 

  871.     - contextPath: TC.Indicator.File.MD5
    872. 

  872.       description: The MD5 hash of the indicator of the file.
    873. 

  873.       type: string
    874. 

  874.     - contextPath: TC.Indicator.File.SHA1
    875. 

  875.       description: The SHA1 hash of the indicator of the file.
    876. 

  876.       type: string
    877. 

  877.     - contextPath: TC.Indicator.File.SHA256
    878. 

  878.       description: The SHA256 hash of the indicator of the file.
    879. 

  879.       type: string
    880. 

  880.     - contextPath: IP.Address
    881. 

  881.       description: IP address of the associated indicator of the file.
    882. 

  882.       type: string
    883. 

  883.     - contextPath: IP.Malicious.Vendor
    884. 

  884.       description: For malicious IP addresses, the vendor that made the decision.
    885. 

  885.       type: string
    886. 

  886.     - contextPath: IP.Malicious.Description
    887. 

  887.       description: For malicious IP addresses, the full description.
    888. 

  888.       type: string
    889. 

  889.     - contextPath: URL.Data
    890. 

  890.       description: The data of the URL of the associated indicator of the file.
    891. 

  891.       type: string
    892. 

  892.     - contextPath: URL.Malicious.Vendor
    893. 

  893.       description: For malicious URLs, the vendor that made the decision.
    894. 

  894.       type: string
    895. 

  895.     - contextPath: URL.Malicious.Description
    896. 

  896.       description: For malicious URLs, the full description.
    897. 

  897.       type: string
    898. 

  898.     - contextPath: Domain.Name
    899. 

  899.       description: The name of the indicator of the domain.
    900. 

  900.       type: string
    901. 

  901.     - contextPath: Domain.Malicious.Vendor
    902. 

  902.       description: For malicious domains, the vendor that made the decision.
    903. 

  903.       type: string
    904. 

  904.     - contextPath: Domain.Malicious.Description
    905. 

  905.       description: For malicious domains, the full description.
    906. 

  906.       type: string
    907. 

  907.     - contextPath: File.MD5
    908. 

  908.       description: The MD5 hash of the file.
    909. 

  909.       type: string
    910. 

  910.     - contextPath: File.SHA1
    911. 

  911.       description: The SHA1 hash of the file.
    912. 

  912.       type: string
    913. 

  913.     - contextPath: File.SHA256
    914. 

  914.       description: The SHA256 hash of the file.
    915. 

  915.       type: string
    916. 

  916.     - contextPath: File.Malicious.Vendor
    917. 

  917.       description: For malicious files, the vendor that made the decision.
    918. 

  918.       type: string
    919. 

  919.     - contextPath: File.Malicious.Description
    920. 

  920.       description: For malicious files, the full description.
    921. 

  921.       type: string
    922. 

  922.     description: Associates an indicator with an existing incident. The indicator
    923. 

  923.       must exist before running this command. To add an indicator, run the tc-add-indicator
    924. 

  924.       command.
    925. 

  925.   - name: domain
    926. 

  926.     arguments:
    927. 

  927.     - name: domain
    928. 

  928.       required: true
    929. 

  929.       default: true
    930. 

  930.       description: The name of the domain.
    931. 

  931.     - name: owners
    932. 

  932.       description: A comma-separated list of a client's organizations, sources, or communities
    933. 

  933.         to which a user has permissions. For example, users with admin permissions
    934. 

  934.         can search for indicators belonging to all owners.
    935. 

  935.     - name: ratingThreshold
    936. 

  936.       description: A list of results filtered by indicators whose threat rating is
    937. 

  937.         greater than the specified value. Can be "0" - "Unknown", "1" - "Suspicious",
    938. 

  938.         "2" - "Low", "3" - Moderate, "4" - High, or "5" - "Critical".
    939. 

  939.     - name: confidenceThreshold
    940. 

  940.       description: A list of results filtered by indicators whose confidence rating
    941. 

  941.         is greater than the specified value. Can be "0%" - "Unknown," "1% " - "Discredited",
    942. 

  942.         "2-29%" - "Improbable," "30-49%" - "Doubtful," "50-69%" - "Possible", "70-89%"
    943. 

  943.         - "Probable," or "90-100%" - "Confirmed".
    944. 

  944.     outputs:
    945. 

  945.     - contextPath: TC.Indicator.Name
    946. 

  946.       description: The name of the of the indicator.
    947. 

  947.       type: string
    948. 

  948.     - contextPath: TC.Indicator.Type
    949. 

  949.       description: The type of the domain.
    950. 

  950.       type: string
    951. 

  951.     - contextPath: TC.Indicator.ID
    952. 

  952.       description: The ID of the domain.
    953. 

  953.       type: string
    954. 

  954.     - contextPath: TC.Indicator.Description
    955. 

  955.       description: The description of the domain.
    956. 

  956.       type: string
    957. 

  957.     - contextPath: TC.Indicator.Owner
    958. 

  958.       description: The owner of the domain.
    959. 

  959.       type: string
    960. 

  960.     - contextPath: TC.Indicator.CreateDate
    961. 

  961.       description: The date on which the indicator of the domain was created.
    962. 

  962.       type: date
    963. 

  963.     - contextPath: TC.Indicator.LastModified
    964. 

  964.       description: The last date on which the indicator of the domain was modified.
    965. 

  965.       type: date
    966. 

  966.     - contextPath: TC.Indicator.Rating
    967. 

  967.       description: The threat rating of the domain.
    968. 

  968.       type: number
    969. 

  969.     - contextPath: TC.Indicator.Confidence
    970. 

  970.       description: The confidence rating of the domain.
    971. 

  971.       type: number
    972. 

  972.     - contextPath: TC.Indicator.WhoisActive
    973. 

  973.       description: The active indicator (for domains only).
    974. 

  974.       type: string
    975. 

  975.     - contextPath: DBotScore.Indicator
    976. 

  976.       description: The value assigned by DBot for the indicator.
    977. 

  977.       type: string
    978. 

  978.     - contextPath: DBotScore.Type
    979. 

  979.       description: The type assigned by DBot for the indicator.
    980. 

  980.       type: string
    981. 

  981.     - contextPath: DBotScore.Score
    982. 

  982.       description: The score assigned by DBot for the indicator.
    983. 

  983.       type: number
    984. 

  984.     - contextPath: DBotScore.Vendor
    985. 

  985.       description: The vendor used to calculate the score.
    986. 

  986.       type: string
    987. 

  987.     - contextPath: Domain.Name
    988. 

  988.       description: The name of the domain.
    989. 

  989.       type: string
    990. 

  990.     - contextPath: Domain.Malicious.Vendor
    991. 

  991.       description: For malicious domains, the vendor that made the decision.
    992. 

  992.       type: string
    993. 

  993.     - contextPath: Domain.Malicious.Description
    994. 

  994.       description: For malicious domains, the full description.
    995. 

  995.       type: string
    996. 

  996.     description: Searches for an indicator of type domain.
    997. 

  997.   - name: tc-get-incident-associate-indicators
    998. 

  998.     arguments:
    999. 

  999.     - name: incidentId
    1000. 

  1000.       required: true
    1001. 

  1001.       default: true
    1002. 

  1002.       description: The ID of the incident.
    1003. 

  1003.     - name: owner
    1004. 

  1004.       description: A list of indicators filtered by the owner.
    1005. 

  1005.     outputs:
    1006. 

  1006.     - contextPath: TC.Indicator.Name
    1007. 

  1007.       description: The name of the returned indicator.
    1008. 

  1008.       type: string
    1009. 

  1009.     - contextPath: TC.Indicator.Type
    1010. 

  1010.       description: The type of the returned indicator.
    1011. 

  1011.       type: string
    1012. 

  1012.     - contextPath: TC.Indicator.ID
    1013. 

  1013.       description: The ID of the returned indicator.
    1014. 

  1014.       type: string
    1015. 

  1015.     - contextPath: TC.Indicator.Description
    1016. 

  1016.       description: The description of the returned indicator.
    1017. 

  1017.       type: string
    1018. 

  1018.     - contextPath: TC.Indicator.Owner
    1019. 

  1019.       description: The owner of the returned indicator.
    1020. 

  1020.       type: string
    1021. 

  1021.     - contextPath: TC.Indicator.CreateDate
    1022. 

  1022.       description: The date on which the returned indicator was created.
    1023. 

  1023.       type: date
    1024. 

  1024.     - contextPath: TC.Indicator.LastModified
    1025. 

  1025.       description: The last date on which the returned indicator was modified.
    1026. 

  1026.       type: date
    1027. 

  1027.     - contextPath: TC.Indicator.Rating
    1028. 

  1028.       description: The threat rating of the returned indicator.
    1029. 

  1029.       type: number
    1030. 

  1030.     - contextPath: TC.Indicator.Confidence
    1031. 

  1031.       description: The confidence rating of the returned indicator.
    1032. 

  1032.       type: number
    1033. 

  1033.     - contextPath: TC.Indicator.WhoisActive
    1034. 

  1034.       description: The active indicator (for domains only).
    1035. 

  1035.       type: string
    1036. 

  1036.     - contextPath: TC.Indicator.File.MD5
    1037. 

  1037.       description: The MD5 hash of the indicator of the file.
    1038. 

  1038.       type: string
    1039. 

  1039.     - contextPath: TC.Indicator.File.SHA1
    1040. 

  1040.       description: The SHA1 hash of the indicator of the file.
    1041. 

  1041.       type: string
    1042. 

  1042.     - contextPath: TC.Indicator.File.SHA256
    1043. 

  1043.       description: The SHA256 hash of the indicator of the file.
    1044. 

  1044.       type: string
    1045. 

  1045.     - contextPath: DBotScore.Indicator
    1046. 

  1046.       description: The value assigned by DBot for the indicator.
    1047. 

  1047.       type: string
    1048. 

  1048.     - contextPath: DBotScore.Type
    1049. 

  1049.       description: The type assigned by DBot for the indicator.
    1050. 

  1050.       type: string
    1051. 

  1051.     - contextPath: DBotScore.Score
    1052. 

  1052.       description: The score assigned by DBot for the indicator.
    1053. 

  1053.       type: number
    1054. 

  1054.     - contextPath: DBotScore.Vendor
    1055. 

  1055.       description: The vendor used to calculate the score.
    1056. 

  1056.       type: string
    1057. 

  1057.     - contextPath: IP.Address
    1058. 

  1058.       description: The IP address of the returned indicator.
    1059. 

  1059.       type: string
    1060. 

  1060.     - contextPath: IP.Malicious.Vendor
    1061. 

  1061.       description: For malicious IP addresses, the vendor that made the decision.
    1062. 

  1062.       type: string
    1063. 

  1063.     - contextPath: IP.Malicious.Description
    1064. 

  1064.       description: For malicious IP addresses, the full description.
    1065. 

  1065.       type: string
    1066. 

  1066.     - contextPath: URL.Data
    1067. 

  1067.       description: The data of the URL of the returned indicator.
    1068. 

  1068.       type: string
    1069. 

  1069.     - contextPath: URL.Malicious.Vendor
    1070. 

  1070.       description: For malicious URLs, the vendor that made the decision.
    1071. 

  1071.       type: string
    1072. 

  1072.     - contextPath: URL.Malicious.Description
    1073. 

  1073.       description: For malicious URLs, the full description.
    1074. 

  1074.       type: string
    1075. 

  1075.     - contextPath: Domain.Name
    1076. 

  1076.       description: The name of the domain.
    1077. 

  1077.       type: string
    1078. 

  1078.     - contextPath: Domain.Malicious.Vendor
    1079. 

  1079.       description: For malicious domains, the vendor that made the decision.
    1080. 

  1080.       type: string
    1081. 

  1081.     - contextPath: Domain.Malicious.Description
    1082. 

  1082.       description: For malicious domains, the full description.
    1083. 

  1083.       type: string
    1084. 

  1084.     - contextPath: File.MD5
    1085. 

  1085.       description: The MD5 hash of the file.
    1086. 

  1086.       type: string
    1087. 

  1087.     - contextPath: File.SHA1
    1088. 

  1088.       description: The SHA1 hash of the file.
    1089. 

  1089.       type: string
    1090. 

  1090.     - contextPath: File.SHA256
    1091. 

  1091.       description: The SHA256 hash of the file.
    1092. 

  1092.       type: string
    1093. 

  1093.     - contextPath: File.Malicious.Vendor
    1094. 

  1094.       description: For malicious files, the vendor that made the decision.
    1095. 

  1095.       type: string
    1096. 

  1096.     - contextPath: File.Malicious.Description
    1097. 

  1097.       description: For malicious files, the full description.
    1098. 

  1098.       type: string
    1099. 

  1099.     description: Returns indicators that are related to a specific incident.
    1100. 

  1100.   - name: tc-update-indicator
    1101. 

  1101.     arguments:
    1102. 

  1102.     - name: indicator
    1103. 

  1103.       required: true
    1104. 

  1104.       description: The name of the updated indicator.
    1105. 

  1105.     - name: rating
    1106. 

  1106.       description: The threat rating of the updated indicator.
    1107. 

  1107.     - name: confidence
    1108. 

  1108.       description: The confidence rating of the updated indicator.
    1109. 

  1109.     - name: size
    1110. 

  1110.       description: The size of the file of the updated indicator.
    1111. 

  1111.     - name: dnsActive
    1112. 

  1112.       description: The active DNS indicator (only for hosts).
    1113. 

  1113.     - name: whoisActive
    1114. 

  1114.       description: The active indicator (only for hosts).
    1115. 

  1115.     - name: updatedValues
    1116. 

  1116.       description: A comma-separated list of field:value pairs to update. For example, "rating=3",
    1117. 

  1117.         "confidence=42", and "description=helloWorld".
    1118. 

  1118.     - name: falsePositive
    1119. 

  1119.       auto: PREDEFINED
    1120. 

  1120.       predefined:
    1121. 

  1121.       - "True"
    1122. 

  1122.       - "False"
    1123. 

  1123.       description: The updated indicator set as a false positive. Can be "True" or
    1124. 

  1124.         "False".
    1125. 

  1125.     - name: observations
    1126. 

  1126.       description: The number observations on the updated indicator.
    1127. 

  1127.     - name: securityLabel
    1128. 

  1128.       auto: PREDEFINED
    1129. 

  1129.       predefined:
    1130. 

  1130.       - TLP:RED
    1131. 

  1131.       - TLP:GREEN
    1132. 

  1132.       - TLP:AMBER
    1133. 

  1133.       - TLP:WHITE
    1134. 

  1134.       description: The security label applied to the incident. Can be "TLP:RED", "TLP:GREEN",
    1135. 

  1135.         "TLP:AMBER", or "TLP:WHITE".
    1136. 

  1136.     - name: threatAssessConfidence
    1137. 

  1137.       description: Assesses the confidence rating of the indicator.
    1138. 

  1138.     - name: threatAssessRating
    1139. 

  1139.       description: Assesses the threat rating of the indicator.
    1140. 

  1140.     outputs:
    1141. 

  1141.     - contextPath: TC.Indicator.Name
    1142. 

  1142.       description: The name of the indicator.
    1143. 

  1143.       type: string
    1144. 

  1144.     - contextPath: TC.Indicator.Type
    1145. 

  1145.       description: The type of the indicator.
    1146. 

  1146.       type: string
    1147. 

  1147.     - contextPath: TC.Indicator.ID
    1148. 

  1148.       description: The ID of the indicator.
    1149. 

  1149.       type: string
    1150. 

  1150.     - contextPath: TC.Indicator.Description
    1151. 

  1151.       description: The description of the indicator.
    1152. 

  1152.       type: string
    1153. 

  1153.     - contextPath: TC.Indicator.Owner
    1154. 

  1154.       description: The owner of the indicator.
    1155. 

  1155.       type: string
    1156. 

  1156.     - contextPath: TC.Indicator.CreateDate
    1157. 

  1157.       description: The date on which the indicator was created.
    1158. 

  1158.       type: date
    1159. 

  1159.     - contextPath: TC.Indicator.LastModified
    1160. 

  1160.       description: The last date on which the indicator was modified.
    1161. 

  1161.       type: date
    1162. 

  1162.     - contextPath: TC.Indicator.Rating
    1163. 

  1163.       description: The threat rating of the indicator.
    1164. 

  1164.       type: number
    1165. 

  1165.     - contextPath: TC.Indicator.Confidence
    1166. 

  1166.       description: The confidence rating of the indicator.
    1167. 

  1167.       type: number
    1168. 

  1168.     - contextPath: TC.Indicator.WhoisActive
    1169. 

  1169.       description: The active indicator (for domains only).
    1170. 

  1170.       type: string
    1171. 

  1171.     - contextPath: TC.Indicator.File.MD5
    1172. 

  1172.       description: The MD5 hash of the indicator of the file.
    1173. 

  1173.       type: string
    1174. 

  1174.     - contextPath: TC.Indicator.File.SHA1
    1175. 

  1175.       description: The SHA1 hash of the indicator of the file.
    1176. 

  1176.       type: string
    1177. 

  1177.     - contextPath: TC.Indicator.File.SHA256
    1178. 

  1178.       description: The SHA256 hash of the indicator of the file.
    1179. 

  1179.       type: string
    1180. 

  1180.     - contextPath: IP.Address
    1181. 

  1181.       description: The IP address of the indicator.
    1182. 

  1182.       type: string
    1183. 

  1183.     - contextPath: IP.Malicious.Vendor
    1184. 

  1184.       description: For malicious IP addresses, the vendor that made the decision.
    1185. 

  1185.       type: string
    1186. 

  1186.     - contextPath: IP.Malicious.Description
    1187. 

  1187.       description: For malicious IP addresses, the full description.
    1188. 

  1188.       type: string
    1189. 

  1189.     - contextPath: URL.Data
    1190. 

  1190.       description: The data of the URL of the indicator.
    1191. 

  1191.       type: string
    1192. 

  1192.     - contextPath: URL.Malicious.Vendor
    1193. 

  1193.       description: For malicious URLs, the vendor that made the decision.
    1194. 

  1194.       type: string
    1195. 

  1195.     - contextPath: URL.Malicious.Description
    1196. 

  1196.       description: For malicious URLs, the full description.
    1197. 

  1197.       type: string
    1198. 

  1198.     - contextPath: Domain.Name
    1199. 

  1199.       description: The domain name of the indicator.
    1200. 

  1200.       type: string
    1201. 

  1201.     - contextPath: Domain.Malicious.Vendor
    1202. 

  1202.       description: For malicious domains, the vendor that made the decision.
    1203. 

  1203.       type: string
    1204. 

  1204.     - contextPath: Domain.Malicious.Description
    1205. 

  1205.       description: For malicious domains, the full description.
    1206. 

  1206.       type: string
    1207. 

  1207.     - contextPath: File.MD5
    1208. 

  1208.       description: The MD5 hash of the file.
    1209. 

  1209.       type: string
    1210. 

  1210.     - contextPath: File.SHA1
    1211. 

  1211.       description: The SHA1 hash of the file.
    1212. 

  1212.       type: string
    1213. 

  1213.     - contextPath: File.SHA256
    1214. 

  1214.       description: The SHA256 hash of the file.
    1215. 

  1215.       type: string
    1216. 

  1216.     - contextPath: File.Malicious.Vendor
    1217. 

  1217.       description: For malicious files, the vendor that made the decision.
    1218. 

  1218.       type: string
    1219. 

  1219.     - contextPath: File.Malicious.Description
    1220. 

  1220.       description: For malicious files, the full description.
    1221. 

  1221.       type: string
    1222. 

  1222.     description: Updates the indicator in ThreatConnect.
    1223. 

  1223.   - name: tc-delete-indicator-tag
    1224. 

  1224.     arguments:
    1225. 

  1225.     - name: indicator
    1226. 

  1226.       required: true
    1227. 

  1227.       description: The name of the indicator from which to remove a tag.
    1228. 

  1228.     - name: tag
    1229. 

  1229.       required: true
    1230. 

  1230.       description: The name of the tag to remove from the indicator.
    1231. 

  1231.     outputs:
    1232. 

  1232.     - contextPath: TC.Indicator.Name
    1233. 

  1233.       description: The name of the indicator.
    1234. 

  1234.       type: string
    1235. 

  1235.     - contextPath: TC.Indicator.Type
    1236. 

  1236.       description: The type of the indicator.
    1237. 

  1237.       type: string
    1238. 

  1238.     - contextPath: TC.Indicator.ID
    1239. 

  1239.       description: The ID of the indicator.
    1240. 

  1240.       type: string
    1241. 

  1241.     - contextPath: TC.Indicator.Description
    1242. 

  1242.       description: The description of the indicator.
    1243. 

  1243.       type: string
    1244. 

  1244.     - contextPath: TC.Indicator.Owner
    1245. 

  1245.       description: The owner of the indicator.
    1246. 

  1246.       type: string
    1247. 

  1247.     - contextPath: TC.Indicator.CreateDate
    1248. 

  1248.       description: The date on which the indicator was created.
    1249. 

  1249.       type: date
    1250. 

  1250.     - contextPath: TC.Indicator.LastModified
    1251. 

  1251.       description: The last date on which the indicator was modified.
    1252. 

  1252.       type: date
    1253. 

  1253.     - contextPath: TC.Indicator.Rating
    1254. 

  1254.       description: The threat rating of the indicator.
    1255. 

  1255.       type: number
    1256. 

  1256.     - contextPath: TC.Indicator.Confidence
    1257. 

  1257.       description: The confidence rating of the indicator.
    1258. 

  1258.       type: number
    1259. 

  1259.     - contextPath: TC.Indicator.WhoisActive
    1260. 

  1260.       description: The active indicator (for domains only).
    1261. 

  1261.       type: string
    1262. 

  1262.     - contextPath: TC.Indicator.File.MD5
    1263. 

  1263.       description: The MD5 hash of the indicator of the file.
    1264. 

  1264.       type: string
    1265. 

  1265.     - contextPath: TC.Indicator.File.SHA1
    1266. 

  1266.       description: The SHA1 hash of the indicator of the file.
    1267. 

  1267.       type: string
    1268. 

  1268.     - contextPath: TC.Indicator.File.SHA256
    1269. 

  1269.       description: The SHA256 hash of the indicator of the file.
    1270. 

  1270.       type: string
    1271. 

  1271.     - contextPath: IP.Address
    1272. 

  1272.       description: The IP address of the indicator.
    1273. 

  1273.       type: string
    1274. 

  1274.     - contextPath: IP.Malicious.Vendor
    1275. 

  1275.       description: For malicious IP addresses, the vendor that made the decision.
    1276. 

  1276.       type: string
    1277. 

  1277.     - contextPath: IP.Malicious.Description
    1278. 

  1278.       description: For malicious IP addresses, the full description.
    1279. 

  1279.       type: string
    1280. 

  1280.     - contextPath: URL.Data
    1281. 

  1281.       description: The data of the URL of the indicator.
    1282. 

  1282.       type: string
    1283. 

  1283.     - contextPath: URL.Malicious.Vendor
    1284. 

  1284.       description: For malicious URLs, the vendor that made the decision.
    1285. 

  1285.       type: string
    1286. 

  1286.     - contextPath: URL.Malicious.Description
    1287. 

  1287.       description: For malicious URLs, the full description.
    1288. 

  1288.       type: string
    1289. 

  1289.     - contextPath: Domain.Name
    1290. 

  1290.       description: The domain name of the indicator.
    1291. 

  1291.       type: string
    1292. 

  1292.     - contextPath: Domain.Malicious.Vendor
    1293. 

  1293.       description: For malicious domains, the vendor that made the decision.
    1294. 

  1294.       type: string
    1295. 

  1295.     - contextPath: Dom…
    1296.