ThreatX

Use the ThreatX integration to enrich intel and automate enforcement actions on the ThreatX Next Gen WAF.

Use Cases

  • Add and remove CIDR ranges and IP addresses to various block lists or the whitelist
  • Gather Entity metadata for intel enrichment and DBot scoring
  • Set Entity notes for SOC integration or further automation

Configure ThreatX on Demisto

  1. Navigate to Settings > Integrations > Servers & Services .
  2. Search for ThreatX.
  3. Click Add instance to create and configure a new integration instance.
    • Name : a textual name for the integration instance.
    • Customer Name : Contact the ThreatX SOC for your Customer Name
    • ThreatX Server URL (e.g., https://provision.threatx.io/ )
    • API Key : Contact the ThreatX SOC for your API Key
    • DBot Score Threshold : Set the threshold ThreatX Risk score (1 to 100) which will be translated to Malicious DBot scores. Default is 70.
    • Use system proxy settings
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Temporarily block an IP address or CIDR: threatx-block-ip
  2. Unblock an IP address or CIDR: threatx-unblock-ip
  3. Blacklist an IP address or CIDR: threatx-blacklist-ip
  4. Remove an IP address or CIDR from the blacklist: threatx-unblacklist-ip
  5. Whitelist an IP address or CIDR: threatx-whitelist-ip
  6. Remove an IP address or CIDR from the whitelist: threatx-unwhitelist-ip
  7. Get entity information: threatx-get-entities
  8. Get entity notes: threatx-get-entity-notes
  9. Add a note to an entity: threatx-add-entity-note

1. Temporarily block an IP address or CIDR


Temporarily blocks an IP address or CIDR.

Base Command

threatx-block-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR that was blocked.

Command Example
!threatx-block-ip ip=12.12.12.12

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Blocklist entry for ip 12.12.12.12 added

2. Unblock an IP address or CIDR


Unblocks a blocked IP address or CIDR.

Base Command

threatx-unblock-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR that was unblocked.

Command Example
!threatx-unblock-ip ip=12.12.12.12

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Blocklist entry for ip 12.12.12.12 removed

3. Blacklist an IP address or CIDR


Adds an IP address or CIDR to the blacklist.

Base Command

threatx-blacklist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR that was added to the blacklist.

Command Example
!threatx-blacklist-ip ip=12.12.12.12

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Blacklist entry for ip 12.12.12.12 added

4. Remove an IP address or CIDR from the blacklist


Removes an IP address or CIDR from the blacklist.

Base Command

threatx-unblacklist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR that was removed from the blacklist.

Command Example
!threatx-unblacklist-ip ip=12.12.12.12
Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Blacklist entry for ip 12.12.12.12 removed

5. Whitelist an IP address or CIDR


Adds an IP address or CIDR to the whitelist.

Base Command

threatx-whitelist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR was added to the whitelist.

Command Example
!threatx-whitelist-ip ip=12.12.12.12

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Whitelist entry for ip 12.12.12.12 added

6. Remove an IP address or CIDR from the whitelist


Removes an IP address or CIDR from the whitelist.

Base Command

threatx-unwhitelist-ip

Input
Argument Name Description Required
ip IP address or CIDR, for example: "10.1.1.1" or "10.1.1.0/24". Required

Context Output
Path Type Description
IP.Address string IP address or CIDR that was removed from the whitelist.

Command Example
!threatx-unwhitelist-ip ip=12.12.12.12

Context Example
{
    "IP": [
        {
            "Address": "12.12.12.12"
        }
    ]
}

Human Readable Output
Result
Whitelist entry for ip 12.12.12.12 removed

7. Get entity information


Returns high-level entity information by Entity ID, Entity Name, or Entity IP.

Base Command

threatx-get-entities

Input
Argument Name Description Required
timeframe Look-back timeframe for the query. Options are 1-Hour, 1-Day, 1-Week, 1-Month, or 3-Months. Note: long look-back timeframes for a large number of Entities can timeout. Required
entity_name CSV list of Entity names. Optional
entity_id CSV list of Entity ID hashes. Optional
entity_ip CSV list of Entity IP addresses. Optional

Context Output
Path Type Description
Threatx.Entity.ID string ID hash of the Entity
Threatx.Entity.Name string Name of the Entity
Threatx.Entity.IP string IP address of the Entity
Threatx.Entity.Risk integer Risk score of the Entity

Command Example
!threatx-get-entities timeframe=1-Day entity_name=CynicalGraaf,OveconfidentRas

Context Example
{
    "Threatx": {
        "Entity": [
            {
                "ID": "1061035762581303669",
                "Name": "OveconfidentRas",
                "Risk": 0,
                "IP": [
                    201.93.212.87
                ]
            },
            {
                "ID": "566056709675514809",
                "Name": "CynicalGraaf",
                "Risk": 0,
                "IP": [
                    1.125.227.13
                ]
            }
        ]
    }
}

Human Readable Output
ThreatX Risk Score IP Addresses Name ID
0 201.93.212.87 OveconfidentRas 1061035762581303669
55 1.125.227.13 CynicalGraaf 566056709675514809

8. Get entity notes


Returns the notes attached to an entity by Entity ID.

Base Command

threatx-get-entity-notes

Input
Argument Name Description Required
entity_id ID hash of the Entity. To retrieve this value, run the threatx-get-entities command. Required

Context Output
Path Type Description
Threatx.Entity.ID string ID hash of the Entity
Threatx.Entity.Note.content string Content of the Note
Threatx.Entity.Note.timestamp string Timestamp of the Note
Threatx.Entity.Note.username string Author of the Note

Command Example
!threatx-get-entity-notes entity_id=566056709675514809

Context Example
{
    "Threatx": {
        "Entity": [
            {
                "ID": "566056709675514809",
                "Note": [
                    {
                        "content": "Demisto test note.",
                        "entity_id": "566056709675514809",
                        "timestamp": "2019-05-31 18:41:09",
                        "username": "user@domain.com"
                    }
                ]
            }
        ]
    }
}

Human Readable Output
Username Timestamp Entity Id Content
user@domain.com 2019-05-31 18:41:09 566056709675514809 Demisto test note.
user@domain.com 2019-05-30 23:36:23 566056709675514809 this is a test note
user@domain.com 2019-05-12 21:36:12 566056709675514809 Another test note
user@domain.com 2019-05-12 21:34:48 566056709675514809 test-note-from-demisto

9. Add a note to an entity


Adds a new note to an entity.

Base Command

threatx-add-entity-note

Input
Argument Name Description Required
entity_id ID hash of the Entity. To retrieve this value, run the threatx-get-entities command. Required
message Contents of the note. Required

Context Output

There is no context output for this command.

Command Example
!threatx-add-entity-note entity_id=566056709675514809 message="test note."

Human Readable Output
Result
Note for Entity<id=566056709675514809> created