The Threatbook component calls Threatbook APIs to retrieve file analysis reports and assess threats from IP addresses and domain names.
Prerequisites
Before you use the Threatbook component, go to and authorize your off-cloud IDC assets in the Multi-cloud Assets module. If you have already completed the authorization, you can skip this step. The procedure is as follows:
Add authorization and select IDC. In the asset access panel, configure the parameters as follows:
NoteBy default, ThreatBook is authorized for Agentic SOC. Other features are not supported.
Parameter
Description
Vendor
ThreatBook.
Product
Threat Intelligence Cloud API.
Account ID
The ThreatBook account ID.
API KEY
The ThreatBook API KEY.
Configure the policy: To prevent an invalid AccessKey from affecting your services, turn on AK Service Status Check.
Features
Action | Description |
fileReport | Gets detailed static and dynamic analysis reports for a file. The reports include a summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine detection results. |
iocReport | Analyzes IP addresses or domain names for outbound access scenarios, such as office or production networks. It uses rules to accurately determine if an IP address or domain name is malicious, its risk severity level, and its confidence level. It also identifies threats such as C2 servers, malware, and miner pools, and provides related security event or threat actor tags. |
ipReport | Analyzes IP addresses for inbound scenarios. It provides the geographic location and ASN information of the IP address. It uses rules to accurately determine if the IP address is malicious, its risk severity level, and its confidence level. It also identifies threat types, such as exploits and zombies, and provides related security event or threat actor tags. |
Configuration example
This topic provides configuration examples for each action in the Threatbook component. You can import these examples as test playbooks. The visual editor helps you understand and test the configuration parameters for each action. This makes it easy to learn the component's logic and how to use it. For more information, see Import a playbook.
Save the sample data as a JSON file.
fileReport
Retrieves detailed static and dynamic analysis reports for a file. The reports include a summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine detection results.
For more information, see the Threatbook document File Reputation Report.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
cloudUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | The hash of the file for which you want to get an analysis report. SHA256, SHA1, and MD5 are supported. | 44d88612*************1278abb02f |
Output parameters
Parameter | Description |
multiengines | The detection results from antivirus scan engines. This is a JSON object. The fields are described as follows:
|
summary | Summary information. This is a JSON object. The fields are described as follows:
|
signature | Behavioral signatures. This is a JSON array. Each item contains the following fields:
|
static | Static information. This is a JSON object. For a complete example of a static information report response, see Complete Example of a File Static Information Report Response. |
pstree | Process behavior. |
network | Network behavior.
|
dropped | Dropped file behavior. This is a JSON array. Each item contains the following fields:
|
strings | String-related information. This is a JSON object. Each item contains the following fields:
|
permalink | The URL of the web sandbox report page. |
iocReport
Analyzes IP addresses or domain names for outbound access scenarios, such as office or production networks. It uses rules to accurately determine if an IP address or domain name is malicious, its risk severity level, and its confidence level. It also identifies threats such as C2 servers, malware, and miner pools, and provides related security event or threat actor tags.
For more information, see the Threatbook document Compromise Detection.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
cloudUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | An IP address or domain name. You can query up to 100 resources in a batch. Separate them with commas. Note You can query an IP address with a port. | test.com or 0.0.0.0:80. |
Output parameters
Type | Parameter | Description |
ip | is_malicious | Indicates whether it is malicious.
|
confidence_level | The confidence level.
| |
severity | The overall severity of the threat.
| |
judgments | The threat type. Based on the malicious properties of the IOC, this includes different types:
| |
tags_classes | Information about related threat actors or security events. This is a JSON array. Each item contains the following fields:
| |
permalink | Link to intelligence details. The URL of the complete threat intelligence analysis page for the IP address or domain name. | |
domain | categories |
|
ipReport
Analyzes IP addresses and domain names involved in outbound connections from office and production networks. It uses rules to determine whether an IP address or domain name is malicious and assesses the associated risk, severity, and credibility. It detects threats such as Command and Control (C2), malware, and Miner Pools, and provides related information, such as security events and threat actor group tags.
For more information, see the Threatbook document IP Reputation.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
cloudUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | An IP address. You can query up to 100 IP addresses in a batch. Separate them with commas. | 0.0.0.0 |
Output parameters
Parameter | Description |
basic | basic returns a JSON object. The fields are described as follows:
|
is_malicious | Indicates whether the IP address is malicious.
|
confidence_level | The confidence level. This is the confidence level of the maliciousness, determined by the intelligence source and a confidence model.
|
severity | The severity level. This indicates the severity of the threat.
|
judgments | The comprehensive threat type determined from threat intelligence analysis. This is a JSON array.
|
tags_classes | Information about related threat actors or security events. This is a JSON array. Each item contains the following fields:
|
asn | ASN information. This is a JSON object that contains:
|
update_time | The last update time of the intelligence. |
scene | Application scenario. Examples include leased line and data center. For a complete list, see Application Scenario Classification. |
feature | Asset features. This is a JSON array that contains:
|
entity | Attributed entity. This is a JSON array that contains:
|
hist_behavior | Attack behavior. This is a JSON array that contains:
|
evaluation | Impact assessment. This is a JSON object that contains:
|
fraud | Fraudulent behavior. This is a JSON array that contains:
|
permalink | A link to the intelligence query result page for the IP address. |
Reference
For more information about Threatbook response status codes and message descriptions, see Response status codes and message descriptions.