Guillaume BOURGEOIS
2b3b9fc10c
9 commands: IP/domain/URL/file reputation, pulse details + search, passive DNS and related URLs. API-key auth, stdlib-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
102 lines
3.4 KiB
YAML
102 lines
3.4 KiB
YAML
id: alienvault_otx
|
|
name: AlienVault OTX
|
|
version: 1.0.0
|
|
description: "AlienVault OTX (Open Threat Exchange, API v1) — reputation and threat context for IPs, domains, URLs and file hashes, pulse details and search, and passive DNS / related-URL pivots. API-key authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: IP/domain/URL/file reputation, pulse details and search, passive DNS and related URLs."
|
|
category: enrichment
|
|
|
|
config_schema:
|
|
properties:
|
|
api_key:
|
|
type: string
|
|
description: "AlienVault OTX API key (from your OTX account settings)"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- api_key
|
|
|
|
commands:
|
|
- id: ip_reputation
|
|
name: alienvault-otx-ip
|
|
description: "Threat context for an IP address (IPv4 or IPv6)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ip: { type: string, description: "IP address" }
|
|
required: [ip]
|
|
outputs_schema: { properties: {} }
|
|
- id: domain_reputation
|
|
name: alienvault-otx-domain
|
|
description: "Threat context for a domain."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
domain: { type: string, description: "Domain name" }
|
|
required: [domain]
|
|
outputs_schema: { properties: {} }
|
|
- id: url_reputation
|
|
name: alienvault-otx-url
|
|
description: "Threat context for a URL."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
url: { type: string, description: "URL" }
|
|
required: [url]
|
|
outputs_schema: { properties: {} }
|
|
- id: file_reputation
|
|
name: alienvault-otx-file
|
|
description: "Threat context for a file hash (MD5, SHA1 or SHA256)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
file: { type: string, description: "File hash" }
|
|
required: [file]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_pulse
|
|
name: alienvault-otx-get-pulse
|
|
description: "Get the details of a pulse (threat report) by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
pulse_id: { type: string, description: "Pulse ID" }
|
|
required: [pulse_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: search_pulses
|
|
name: alienvault-otx-search-pulses
|
|
description: "Search pulses by keyword."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
query: { type: string, description: "Search string" }
|
|
limit: { type: number, description: "Maximum pulses (default 20)" }
|
|
required: [query]
|
|
outputs_schema: { properties: {} }
|
|
- id: passive_dns
|
|
name: alienvault-otx-passive-dns
|
|
description: "Passive DNS records for an IP or domain indicator."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
indicator: { type: string, description: "IP or domain" }
|
|
indicator_type: { type: string, description: "IPv4, IPv6 or domain (default auto-detected)" }
|
|
required: [indicator]
|
|
outputs_schema: { properties: {} }
|
|
- id: related_urls
|
|
name: alienvault-otx-related-urls
|
|
description: "URLs associated with an IP or domain indicator."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
indicator: { type: string, description: "IP or domain" }
|
|
indicator_type: { type: string, description: "IPv4, IPv6 or domain (default auto-detected)" }
|
|
required: [indicator]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: alienvault-otx-test-connection
|
|
description: "Verify the API key (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|