Security Center:Threatbook component

Prerequisites

Before you begin, ensure that you have:

• Access to System Settings > Feature Settings > Multi-cloud Configuration Management in Security Center

• A ThreatBook account with an API key

Configuration example

The following playbook configuration covers all three actions. Import it as a test playbook in the visual editor to explore the parameters for each action. For import instructions, see Import a playbook.

Save the sample data as a JSON file before importing.

{
	"cells": [{
		"position": {
			"x": -400,
			"y": -155
		},
		"size": {
			"width": 36,
			"height": 36
		},
		"attrs": {
			"body": {
				"fill": "white",
				"strokeOpacity": 0.95,
				"stroke": "#63ba4d",
				"strokeWidth": 2
			},
			"label": {
				"text": "start",
				"fontSize": 12,
				"refX": 0.5,
				"refY": "100%",
				"refY2": 4,
				"textAnchor": "middle",
				"textVerticalAnchor": "top"
			},
			"path": {
				"stroke": "#63ba4d"
			}
		},
		"visible": true,
		"shape": "circle",
		"id": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4",
		"zIndex": 1,
		"data": {
			"nodeType": "startEvent",
			"appType": "basic",
			"nodeName": "start",
			"icon": "icon-circle",
			"description": "The start node of the playbook. A playbook must have one and only one start node. You must configure input data for the playbook.",
			"cascaderValue": []
		},
		"markup": [{
			"tagName": "circle",
			"selector": "body"
		}, {
			"tagName": "text",
			"selector": "label"
		}],
		"isNode": true
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#63ba4d",
				"targetMarker": {
					"stroke": "#63ba4d"
				}
			}
		},
		"zIndex": 1,
		"id": "5293c3f9-e1c9-4a49-b0eb-635067dc67e8",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic",
			"icon": "icon-upper-right-arrow",
			"isRequired": true
		},
		"isNode": false,
		"source": {
			"cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
		},
		"target": {
			"cell": "19fca1bc-4cf1-491e-9ae4-ee5d3f0c2f61"
		},
		"router": {
			"name": "normal"
		},
		"visible": true,
		"vertices": [{
			"x": -382,
			"y": -247
		}]
	}, {
		"position": {
			"x": 140,
			"y": -155
		},
		"size": {
			"width": 36,
			"height": 36
		},
		"attrs": {
			"body": {
				"fill": "white",
				"strokeOpacity": 0.95,
				"stroke": "#d93026",
				"strokeWidth": 2
			},
			"path": {
				"r": 12,
				"refX": "50%",
				"refY": "50%",
				"fill": "#d93026",
				"strokeOpacity": 0.95,
				"stroke": "#d93026",
				"strokeWidth": 4
			},
			"label": {
				"text": "end",
				"fontSize": 12,
				"refX": 0.5,
				"refY": "100%",
				"refY2": 4,
				"textAnchor": "middle",
				"textVerticalAnchor": "top"
			}
		},
		"visible": true,
		"shape": "circle",
		"id": "317dd1be-2d20-460e-977e-1fc936ffb583",
		"zIndex": 1,
		"data": {
			"nodeType": "endEvent",
			"appType": "basic",
			"nodeName": "end",
			"icon": "icon-radio-off-full",
			"description": "end"
		},
		"markup": [{
			"tagName": "circle",
			"selector": "body"
		}, {
			"tagName": "circle",
			"selector": "path"
		}, {
			"tagName": "text",
			"selector": "label"
		}],
		"isNode": true
	}, {
		"position": {
			"x": -190,
			"y": -280
		},
		"size": {
			"width": 137,
			"height": 66
		},
		"view": "react-shape-view",
		"attrs": {
			"label": {
				"text": "file_report"
			}
		},
		"shape": "activity",
		"id": "19fca1bc-4cf1-491e-9ae4-ee5d3f0c2f61",
		"zIndex": 1,
		"data": {
			"isDebug": false,
			"nodeType": "action",
			"appType": "component",
			"nodeName": "file_report",
			"valueData": {
				"userId": "",
				"resource": "${event.file}",
				"cloudUserId": "7f7cd2ebedc544f7bf9be74dab7fcca4"
			},
			"description": "Gets detailed static and dynamic analysis reports for a file. The reports include a summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine detection results.",
			"advance": {
				"inputParamMode": false,
				"onError": "stop_cur_flow",
				"rspStatusType": 3,
				"rspStatusThreshold": 0
			},
			"componentName": "Threatbook",
			"actionName": "fileReport",
			"status": "success"
		},
		"isNode": true
	}, {
		"position": {
			"x": -190,
			"y": -170
		},
		"size": {
			"width": 137,
			"height": 66
		},
		"view": "react-shape-view",
		"attrs": {
			"label": {
				"text": "ioc_report"
			}
		},
		"shape": "activity",
		"id": "e0082b2e-d82c-464f-a22f-9b67eb47a363",
		"zIndex": 1,
		"data": {
			"isDebug": false,
			"nodeType": "action",
			"appType": "component",
			"nodeName": "ioc_report",
			"valueData": {
				"cloudUserId": "7f7cd2ebedc544f7bf9be74dab7fcca4",
				"resource": "${event.ioc}"
			},
			"description": "Analyzes IP addresses or domain names for outbound access scenarios, such as office or production networks. It uses rules to accurately determine if an IP address or domain name is malicious, its risk severity level, and its confidence level. It also identifies threats such as C2 servers, malware, and miner pools, and provides related security event or threat actor tags.",
			"advance": {
				"inputParamMode": false,
				"onError": "stop_cur_flow",
				"rspStatusType": 3,
				"rspStatusThreshold": 0
			},
			"componentName": "Threatbook",
			"actionName": "iocReport",
			"status": "failed",
			"customInput": false,
			"id": 0,
			"name": "iocReport",
			"operateType": "general",
			"parameters": [{
				"dataType": "String",
				"defaultValue": "",
				"description": "",
				"enDescription": "",
				"name": "userId",
				"needCascader": false,
				"required": false,
				"tags": ""
			}, {
				"dataType": "String",
				"defaultValue": "",
				"description": "The account ID configured for Threatbook in Security Center under Feature Settings > Multicloud Configuration Management.",
				"enDescription": "",
				"name": "cloudUserId",
				"needCascader": false,
				"required": true,
				"tags": ""
			}, {
				"dataType": "String",
				"defaultValue": "",
				"description": "An IP address or domain name. You can query up to 100 resources in a batch. Separate them with commas. You can query an IP address with a port to get high-confidence results. Example of IP addresses with ports in a request: 8.8.8.8:143,0.0.0.0:80 ",
				"enDescription": "",
				"name": "resource",
				"needCascader": false,
				"required": true,
				"tags": ""
			}],
			"riskLevel": 2,
			"actionDisplayName": "iocReport"
		},
		"isNode": true
	}, {
		"position": {
			"x": -190,
			"y": -55
		},
		"size": {
			"width": 137,
			"height": 66
		},
		"view": "react-shape-view",
		"attrs": {
			"label": {
				"text": "ip_reputation"
			}
		},
		"shape": "activity",
		"id": "8afdafcc-32aa-4ab2-b8b2-abafc4314e85",
		"zIndex": 1,
		"data": {
			"nodeType": "action",
			"appType": "component",
			"nodeName": "ip_reputation",
			"valueData": {
				"cloudUserId": "7f7cd2ebedc544f7bf9be74dab7fcca4",
				"resource": "${event.ip}"
			},
			"description": "Analyzes IP addresses for inbound scenarios. It provides the geographic location and ASN information of the IP address. It uses rules to accurately determine if the IP address is malicious, its risk severity level, and its confidence level. It also identifies threat types, such as exploits and zombies, and provides related security event or threat actor tags.",
			"advance": {
				"inputParamMode": false,
				"onError": "stop_cur_flow",
				"rspStatusType": 3,
				"rspStatusThreshold": 0
			},
			"componentName": "Threatbook",
			"actionName": "ipReputation"
		},
		"isNode": true
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#d93026",
				"targetMarker": {
					"stroke": "#d93026"
				}
			}
		},
		"zIndex": 1,
		"id": "ae6ca05c-ebd1-41f1-a94d-489fdc308861",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic"
		},
		"router": {
			"name": "manhattan",
			"args": {
				"padding": 5,
				"excludeHiddenNodes": true,
				"excludeNodes": ["clone_node_id"]
			}
		},
		"source": {
			"cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
		},
		"visible": true,
		"target": {
			"cell": "e0082b2e-d82c-464f-a22f-9b67eb47a363"
		}
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#d93026",
				"targetMarker": {
					"stroke": "#d93026"
				}
			}
		},
		"zIndex": 1,
		"id": "8f084c6d-9afd-4ecb-8c9d-3c7824f9de2f",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic"
		},
		"router": {
			"name": "normal"
		},
		"source": {
			"cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
		},
		"visible": true,
		"target": {
			"cell": "8afdafcc-32aa-4ab2-b8b2-abafc4314e85"
		},
		"vertices": [{
			"x": -382,
			"y": -22
		}]
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#63ba4d",
				"targetMarker": {
					"stroke": "#63ba4d"
				}
			}
		},
		"zIndex": 1,
		"id": "e55e80d8-fab6-42ac-91ab-da7697ec80dd",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic"
		},
		"router": {
			"name": "normal"
		},
		"source": {
			"cell": "19fca1bc-4cf1-491e-9ae4-ee5d3f0c2f61"
		},
		"visible": true,
		"target": {
			"cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
		},
		"vertices": [{
			"x": 158,
			"y": -247
		}]
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#d93026",
				"targetMarker": {
					"stroke": "#d93026"
				}
			}
		},
		"zIndex": 1,
		"id": "ba2021dc-533b-4ba3-a1a7-69f05f3c7515",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic"
		},
		"router": {
			"name": "manhattan",
			"args": {
				"padding": 5,
				"excludeHiddenNodes": true,
				"excludeNodes": ["clone_node_id"]
			}
		},
		"source": {
			"cell": "8afdafcc-32aa-4ab2-b8b2-abafc4314e85"
		},
		"visible": true,
		"target": {
			"cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
		}
	}, {
		"shape": "custom-edge",
		"attrs": {
			"line": {
				"stroke": "#d93026",
				"targetMarker": {
					"stroke": "#d93026"
				}
			}
		},
		"zIndex": 1,
		"id": "c3c22836-585a-4f5e-a3ec-92ecedfad6ba",
		"data": {
			"nodeType": "sequenceFlow",
			"appType": "basic"
		},
		"router": {
			"name": "manhattan",
			"args": {
				"padding": 5,
				"excludeHiddenNodes": true,
				"excludeNodes": ["clone_node_id"]
			}
		},
		"source": {
			"cell": "e0082b2e-d82c-464f-a22f-9b67eb47a363"
		},
		"visible": true,
		"target": {
			"cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
		}
	}]
}

fileReport

Use this action to retrieve detailed static and dynamic analysis reports for a file, identified by its hash.

The report covers: summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine detection results.

For the full ThreatBook API specification, see File Reputation Report.

iocReport

Use this action to check whether an IP address or domain name involved in outbound connections — such as traffic from office networks or production environments — is malicious.

The action determines maliciousness, risk level, and confidence level. It also identifies threat types such as command and control (C2) servers, malware, and Miner Pools, and returns related security event and threat actor tags.

For the full ThreatBook API specification, see Compromise Detection.

ipReport

Use this action to assess the reputation of an inbound IP address — for example, source IPs from external connections hitting your infrastructure.

The action returns geographic location, ASN information, maliciousness, risk level, and confidence level. It also identifies threat types such as spam, zombies, and scanners, and returns related security event and threat actor tags.

For the full ThreatBook API specification, see IP Reputation.

Reference

For ThreatBook response status codes and message descriptions, see Response status codes and message descriptions.