DeepSight

Integration version: 7.0

Configure DeepSight integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Actions

Ping

Description

Test Connectivity.

Parameters

This action runs on all entities.

Run On

This action runs on all entities.

Action Results

Entity Enrichment

N/A

Insights

N/A

Script Result
Script Result Name Value Options Example
null True/False null:False
JSON Result
N/A

Scan Domain

Description

Scan a domain.

Parameters

N/A

Run On

This action runs on the following entities:

  • User
  • Hostname
  • URL

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
domain Returns if it exists in JSON result
whitelisted Returns if it exists in JSON result
schemaVersion Returns if it exists in JSON result
whois Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null N/A N/A
JSON Result
[{
   "EntityResult":
     {
      "domain": "example.com",
      "whitelisted": true,
      "schemaVersion": 2,
      "whois":
        {
          "city": "Reno",
          "updated": "2014-04-30T00: 00: 00Z",
          "created": "1994-11-01T00: 00: 00Z",
          "nameServers": ["NS1.P31.DYNECT.NET",
                          "NS2.P31.DYNECT.NET",
                          "NS3.P31.DYNECT.NET"],
          "country": "Us",
          "expires": "2022-10-31T00: 00: 00Z",
          "person": "Hostmaster,AmazonLegalDept.",
          "registrar": "MarkmonitorInc.",
          "postalCode": "89507",
        "organization": "AmazonTechnologies,Inc.",
          "email":"john_doe@example.com"
         }
      },
  "Entity": "example.com"
}]

Scan Email

Description

Scan an email.

Parameters

N/A

Run On

This action runs on the User entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
date Returns if it exists in JSON result
title Returns if it exists in JSON result
uri Returns if it exists in JSON result
id Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null N/A N/A
JSON Result
[{
   "EntityResult":
      {
       "date": "2015-04-27T01:10Z",
       "title": "Laziok Trojan Activity and Infrastructure\\u2014January to April 2015",
       "uri": "/v1/mati/reports/300156",
       "id": 300156
      },
   "Entity": "john_doe@example.com"
}]

Scan File Name

Description

Scan the name of the that was involved in an event.

Parameters

N/A

Run On

This action runs on the Filename entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
date Returns if it exists in JSON result
title Returns if it exists in JSON result
uri Returns if it exists in JSON result
id Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null True/False null:False
JSON Result
[{
   "EntityResult":
     {
       "date": "2015-04-27T01:10Z",
       "title": "Laziok Trojan Activity and Infrastructure\\u2014January to April 2015",
       "uri": "/v1/mati/reports/300156",
       "id": 300156
     },
   "Entity": "BadGuy1"
}]

Scan Hash

Description

Scan a hash.

Parameters

N/A

Run On

This action runs on the Filename entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
matiReports Returns if it exists in JSON result
intelligence Returns if it exists in JSON result
detection_name Returns if it exists in JSON result
Activity Returns if it exists in JSON result
schemaVersion Returns if it exists in JSON result
sha256 Returns if it exists in JSON result
events Returns if it exists in JSON result
md5 Returns if it exists in JSON result
reputation Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null N/A N/A
JSON Result
[{
   "EntityResult":
      {
        "matiReports":
           [{
              "date": "2015-04-27T01:10:47Z",
              "title": "Laziok Trojan Activity and Infrastructure\\u2014January to April 2015",
              "uri": "/v1/mati/reports/300156",
              "id": 300156
            }],
        "intelligence":
      {
        "countries": ["kor", "Gtm","are"],
        "paths": ["CSIDL_PROFILE\\\\appdata\\\\local\\\\searchlike"],
        "fileNames": ["SEARCHLIKE.EXE"],
        "parentProcesses": ["f8403ce30c3a2a42b4604c2cf952533ed828a3d7bdb289b0cec82b8844a72a5a"],
        "filesCreated": [{"path": "CSIDL_PROFILE\\\\appdata\\\\local\\\\searchlike",
                          "sha256": "6d873e6198f7aca685b4c697dfbf82e3450ed5277c5f3c55b1b6fb0338521e0f",
                          "fileName": "B_SEARCHLIKEEX.EXE"
                         }]
        },
   "detection_name": "Trojan.Mdropper",
   "Activity":
       {
         "dns": [{"type": "A",
                  "target": "acroipm2.adobe.com"}],
         "urls": [{"url":
"http://acroipm.adobe.com/assets/102.zip"}]
        },
   "schemaVersion": 3,
   "sha256": "e46d5472e49793017892cb18a0aa174ff9c5b79cec0a9451f1b70e21b19855c2",
   "events":
       [{
          "pid": 2528,
          "type": "PROCESS:CURRENT",
          "target": "C:\\\\Windows\\\\SysWOW64\\\\cmd.exe",
          "severity": 1,
          "details": "B41859D39D786D32B23A9D2E00F4011DEC7A02402AE"
        }],
    "md5": "a77e89bf60e931477f5858a004fb5e0a",
    "reputation": "Malicious"
     },
  "Entity": "a77e89bf60e931477f5858a004fb5e0a"
}]

Scan IP

Description

Scan an IP address.

Parameters

N/A

Run On

This action runs on the IP Address entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
geolocation Returns if it exists in JSON result
Network Returns if it exists in JSON result
targetIndustries Returns if it exists in JSON result
ip Returns if it exists in JSON result
whitelisted Returns if it exists in JSON result
behaviours Returns if it exists in JSON result
targetCountries Returns if it exists in JSON result
lastSeen Returns if it exists in JSON result
urls Returns if it exists in JSON result
domains Returns if it exists in JSON result
Organization Returns if it exists in JSON result
schemaVersion Returns if it exists in JSON result
firstSeen Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null N/A N/A
JSON Result
[{
    "EntityResult":
      {
        "geolocation":
            {
              "latitude": 39.91176055,
              "city": "Beijing",
              "longitude": 116.3792325,
              "country": "China"
             },
        "Network":
            {
              "carrier": "ChinaUnicomBeijingProvinceNetwork",
              "asn": 4808,
              "lineSpeed": "High",
              "ipRouting": "Fixed"
            },
        "targetIndustries":
            [{
              "name": "Utilities",
              "naics": 221
             },{
              "name": "Telecommunications",
              "naics": 517
            }],
        "ip": "1.1.1.1",
        "whitelisted": false,
        "behaviours":
            [{
               "behaviour": "Attacks",
               "type": "WWWAttacks",
               "description": "FakeBrowserUpdate"
            }],
        "targetCountries": ["fra", "tur", "twn"],
        "lastSeen": "2019-01-20T00: 00: 00Z",
        "urls":
            [{
              "url": "http: //iremedypro.com/assets/img/jQuery/014/LOGS/c1dabc02e7c9c23688fcdccb9c94379f",
              "uri": "/v1/urls/http: //iremedypro.com/assets/img/jQuery/014/LOGS/c1dabc02e7c9c23688fcdccb9c94379f"
            }],
        "domains":
            [{
              "domain": "iremedypro.com",
              "uri": "/v1/domains/iremedypro.com"
            }],
        "Organization":
             {
              "isic": "J6110",
              "type": "InternetServiceProvider",
              "name": "ChinaUnicomBeijingProvinceNetwork",
               "naics": 517110
               },
       "schemaVersion": 2,
       "firstSeen": "2016-01-01T00: 00: 00Z"
      },
   "Entity": "1.1.1.1"
 }]

Scan URL

Description

Scan a URL.

Parameters

N/A

Run On

This action runs on the URL entity.

Action Results

Entity Enrichment
Enrichment Field Name Logic - When to apply
url Returns if it exists in JSON result
host Returns if it exists in JSON result
whitelisted Returns if it exists in JSON result
schemaVersion Returns if it exists in JSON result
whois Returns if it exists in JSON result
Insights

N/A

Script Result
Script Result Name Value Options Example
null N/A N/A
JSON Result
[{
    "EntityResult":
       {
         "url": "https: //www.facebook.com",
         "host":
            {
              "domain": "facebook.com",
              "uri": "/v1/domains/facebook.com"
            },
         "whitelisted": true,
         "schemaVersion": 2,
         "whois":
             {
               "city": "MenloPark",
               "updated": "2015-08-25T00: 00: 00Z",
               "created": "1997-03-29T00: 00: 00Z",
               "nameServers": ["A.NS.FACEBOOK.COM", "B.NS.FACEBOOK.COM"],
               "country": "Us",
               "expires": "2020-03-30T00: 00: 00Z",
               "person": "DomainAdministrator",
               "registrar": "MarkmonitorInc.",
               "postalCode": "94025",
               "organization": "Facebook,Inc.",
               "email": "john_doe@example.com"
              }
        },
   "Entity": "https: //www.facebook.com"
 }]