ThreatCrowd

Integration version: 6.0

Configure ThreatCrowd integration in Google Security Operations

For detailed instructions on how to configure an integration in Google SecOps, see Configure integrations.

Actions

Enrich Entities

Description

Quickly identify related infrastructures and malware.

Parameters

N/A

Use cases

N/A

Run On

This action runs on the following entities:

IP Address
Hostname

Action Results

Entity Enrichment

Enrichment Field Name	Logic-When to Apply
permalink	Returns if it exists in JSON result
response_code	Returns if it exists in JSON result
votes	Returns if it exists in JSON result
references	Returns if it exists in JSON result
hashes	Returns if it exists in JSON result
resolutions	Returns if it exists in JSON result
domain	Returns if it exists in JSON result
last_resolved	Returns if it exists in JSON result

Insights

N/A

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
        "EntityResult": {
            "permalink": "https: //www.threatcrowd.org/ip.php?ip=1.1.1.1",
            "response_code": "1",
            "votes": -1,
            "references": [
                "http: //www.talosintelligence.com/feeds/ip-filter.blf",
                "https: //check.torproject.org/exit-addresses",
                "https: //otx.alienvault.com/pulse/56714a2867db8c3f8a46fe95/"
            ],
            "hashes": [],
            "resolutions": [{
                "domain": "afplink.net",
                "last_resolved": "2016-06-24"
            },{
                "domain": "jabber.zwiebeltoralf.de",
                "last_resolved": "2016-12-28"
            }]},
        "Entity": "1.1.1.1"
    }
]

Ping