The Threatbook component calls Threatbook APIs to retrieve file analysis reports and assess IP addresses and domain names for threats.
Prerequisites
Before using the ThreatBook component, navigate to and authorize your off-cloud IDC assets in the Multi-cloud Assets module. If you have already done so, skip this step.
Click Add Authorization and select IDC. In the asset access panel, configure the following parameters:
NoteBy default, Agentic SOC supports authorization only for ThreatBook.
Parameter
Description
Vendor
ThreatBook.
Product
Threat Intelligence Cloud API.
Account ID
Your ThreatBook account ID.
API key
Your ThreatBook API key.
Enable AK Service Status Check to prevent service disruptions from an invalid AccessKey.
Features
Actions | Description |
fileReport | Retrieves detailed static analysis and dynamic analysis reports for a file. The reports include a file summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine detection results. |
iocReport | Analyzes IP addresses or domain names associated with outbound traffic from an office or production network. It uses detection rules to determine if an IP address or domain name is malicious, as well as its risk severity and confidence levels. It also identifies threats such as C2 servers, malware, and miner pools, and provides related security events or threat actor tags. |
ipReport | Analyzes IP addresses involved in inbound connections and provides their geographic location and ASN information. It uses detection rules to determine if an IP address is malicious, as well as its risk severity and confidence levels. It also identifies threat types, such as exploits and zombies, and provides related security events or threat actor tags. |
Component configuration
This topic provides example parameter configurations for each action in the Threatbook component that you can import as test playbooks. The visual editor lets you intuitively understand and test the parameters for each action, which helps you master the component. For detailed instructions, see Import a playbook.
Save the sample data as a JSON file.
fileReport
Retrieves detailed static analysis and dynamic analysis reports for a file. The reports include a summary, network behavior, behavioral signatures, static information, dropped file behavior, process behavior, and antivirus scan engine results.
For more information, see the Threatbook document File Reputation Report.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
cloudUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | The hash (SHA256, SHA1, or MD5) of the file to analyze. | 44d88612*************1278abb02f |
Output parameters
Parameter | Description |
multiengines | The detection results from antivirus scan engines. This is a JSON object that contains the following fields:
|
summary | The summary. This is a JSON object that contains the following fields:
|
signature | The behavioral signatures. This is a JSON array. Each item contains the following fields:
|
static | The static information. This is a JSON object. For a complete example of a static information report response, see Complete Example of a File Static Information Report Response. |
pstree | The process behavior. |
network | The network behavior.
|
dropped | The dropped file behavior. This is a JSON array. Each item contains the following fields:
|
strings | String-related information. This is a JSON object that contains the following fields:
|
permalink | The URL of the web sandbox report page. |
iocReport
Analyzes IP addresses and domain names in outbound access scenarios, such as from an office network or a production network. It determines whether an IP address or domain name is malicious, assesses its severity and confidence level, identifies threats such as C2, malware, and mining pools, and provides associated security event or threat actor tags.
For more information, see the Threatbook document Compromise Detection.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
clouldUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | An IP address or domain name. To query multiple resources, separate them with commas. You can specify up to 100 resources. Note You can include a port number for an IP address. | test.com or 0.0.0.0:80 |
Output parameters
Type | Parameter | Description |
ip | is_malicious | Indicates whether the resource is malicious.
|
confidence_level | The confidence level of the assessment.
| |
severity | The overall severity of the threat.
| |
judgments | The threat type, which varies depending on whether the indicator of compromise (IOC) is malicious.
| |
tags_classes | Information about associated threat actors or security events, returned as a JSON array where each object contains the following fields:
| |
permalink | Link to intelligence details. A URL to the full threat intelligence analysis page for the resource. | |
domain | categories |
|
ipReport
Analyzes IP addresses and domain names in outbound access scenarios, such as from an office network or a production network. This feature assesses if an IP address or domain name is malicious and determines its severity level and confidence level. It identifies threats such as Command and Control (C2), malware, and mining pools, and provides associated security event or threat actor tags.
For more information, see the Threatbook document IP Reputation.
Input parameters
Parameter | Description | Example |
userId | The ID of the associated Alibaba Cloud account. Important
| XXX |
cloudUserId | The Threatbook account ID. For more information, see Prerequisites. | 7f7c*************7fcca4 |
resource | Up to 100 comma-separated IP addresses. | 0.0.0.0 |
Output parameters
Parameter | Description |
basic | A JSON object containing basic information, with the following fields:
|
is_malicious | Indicates if the IP address is malicious.
|
confidence_level | The confidence level of the assessment, which is determined by the intelligence source and a confidence model.
|
severity | The severity level, which indicates the degree of harm of the threat.
|
judgments | A JSON array of comprehensive threat types identified through threat intelligence analysis.
|
tags_classes | A JSON array describing associated threat actors or security events. Each object in the array contains the following fields:
|
asn | A JSON object containing ASN information, with the following fields:
|
update_time | The time when the intelligence was last updated. |
scene | The use case. Examples include leased line and data center. For a complete list, see Application Scenario Classification. |
feature | A JSON array of asset features, with the following fields:
|
entity | A JSON array of attributed entities, with the following fields:
|
hist_behavior | A JSON array of attack behaviors, with the following fields:
|
evaluation | A JSON object containing the impact assessment, with the following fields:
|
fraud | A JSON array of fraud and abuse behaviors, with the following fields:
|
permalink | A permalink to the threat intelligence query result page for the IP address. |
Reference
For Threatbook's response status codes and message descriptions, see Response status codes and message descriptions.