Updated outputs to cmds ip and abuseipdb-check-cidr-block (#31946)

* Updated outputs to cmds ip and abuseipdb-check-cidr-block * Updated outputs to cmds ip and abuseipdb-check-cidr-block * remove comma * fix: return to previous arg name * Update Packs/AbuseDB/ReleaseNotes/1_0_30.md --------- Co-authored-by: Yuval Cohen <86777474+yucohen@users.noreply.github.com>
demisto · Jan 8, 2024 · 5618dcd · 5618dcd
1 parent 52e378e
commit 5618dcd
Show file tree

Hide file tree

Showing 5 changed files with 171 additions and 11 deletions.
diff --git a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.py
@@ -143,17 +143,30 @@ def analysis_to_entry(info, reliability, threshold=THRESHOLD, verbose=VERBOSE):
     for analysis in info:
         ip_ec = {
             "Address": analysis.get("ipAddress"),
-            "Geo": {"Country": analysis.get("countryName") or analysis.get("countryCode")}
+            "Geo": {
+                "Country": analysis.get("countryName"),
+                "CountryCode": analysis.get("countryCode")
+            }
         }
         abuse_ec = {
             "IP": {
                 "Address": analysis.get("ipAddress"),
-                "Geo": {"Country": analysis.get("countryName") or analysis.get("countryCode")},
+                "Geo": {
+                    "Country": analysis.get("countryName"),
+                    "CountryCode": analysis.get("countryCode")
+                },
                 "AbuseConfidenceScore": analysis.get('abuseConfidenceScore'),
-                "TotalReports": analysis.get("totalReports") or analysis.get("numReports") or "0",
+                "TotalReports": analysis.get("totalReports") or analysis.get("numReports") or 0,
                 "ISP": analysis.get("isp"),
                 "UsageType": analysis.get("usageType"),
-                "Domain": analysis.get("domain")
+                "Domain": analysis.get("domain"),
+                "Hostnames": analysis.get("hostnames"),
+                "IpVersion": analysis.get("ipVersion"),
+                "IsPublic": analysis.get("isPublic"),
+                "IsTor": analysis.get("isTor"),
+                "IsWhitelisted": analysis.get("isWhitelisted"),
+                "LastReportedAt": analysis.get("lastReportedAt"),
+                "NumDistinctUsers": analysis.get("numDistinctUsers")
             }
         }
 

diff --git a/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml b/Packs/AbuseDB/Integrations/AbuseDB/AbuseDB.yml
@@ -116,6 +116,9 @@ script:
     - contextPath: IP.Geo.Country
       description: The country in which the IP address is located.
       type: String
+    - contextPath: IP.Geo.CountryCode
+      description: The country code in which the IP address is located.
+      type: String
     - contextPath: IP.Malicious.Vendor
       description: The vendor reporting the IP address as malicious.
       type: String
@@ -134,6 +137,30 @@ script:
     - contextPath: AbuseIPDB.IP.Geo.Country
       description: The country associated with the IP Address.
       type: String
+    - contextPath: AbuseIPDB.IP.Geo.CountryCode
+      description: The country code associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Hostnames
+      description: The hostame(s) of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IpVersion
+      description: The version of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsPublic
+      description: Is the IP address public.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsTor
+      description: Is the IP address a Tor IP.
+      type: String¨
+    - contextPath: AbuseIPDB.IP.IsWhitelisted
+      description: Is the IP address whitelisted.
+      type: String
+    - contextPath: AbuseIPDB.IP.LastReportedAt
+      description: When the IP address was last reported.
+      type: String
+    - contextPath: AbuseIPDB.IP.NumDistinctUsers
+      description: The distinct number of users.
+      type: String
     - contextPath: AbuseIPDB.IP.Reports
       description: The reports summary (for "verbose" reports).
       type: String
@@ -192,6 +219,9 @@ script:
     - contextPath: IP.Geo.Country
       description: The country in which the IP address is located.
       type: String
+    - contextPath: IP.Geo.CountryCode
+      description: The country code in which the IP address is located.
+      type: String
     - contextPath: IP.Malicious.Vendor
       description: The vendor reporting the IP address as malicious.
       type: String
@@ -211,8 +241,32 @@ script:
       description: The number of times this address has been reported.
       type: Unknown
     - contextPath: AbuseIPDB.IP.Geo.Country
-      description: The country associated with this IP Address.
-      type: Unknown
+      description: The country associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Geo.CountryCode
+      description: The country code associated with the IP Address.
+      type: String
+    - contextPath: AbuseIPDB.IP.Hostnames
+      description: The hostame(s) of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IpVersion
+      description: The version of the IP address.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsPublic
+      description: Is the IP address public.
+      type: String
+    - contextPath: AbuseIPDB.IP.IsTor
+      description: Is the IP address a Tor IP.
+      type: String¨
+    - contextPath: AbuseIPDB.IP.IsWhitelisted
+      description: Is the IP address whitelisted.
+      type: String
+    - contextPath: AbuseIPDB.IP.LastReportedAt
+      description: When the IP address was last reported.
+      type: String
+    - contextPath: AbuseIPDB.IP.NumDistinctUsers
+      description: The distinct number of users.
+      type: String
     - contextPath: AbuseIPDB.IP.Reports
       description: Reports summary (for "verbose" reports).
       type: Unknown
@@ -285,7 +339,7 @@ script:
   script: ''
   subtype: python3
   type: python
-  dockerimage: demisto/python3:3.10.13.80014
+  dockerimage: demisto/python3:3.10.13.83255
 fromversion: 5.0.0
 tests:
 - AbuseIPDB Test
diff --git a/Packs/AbuseDB/Integrations/AbuseDB/README.md b/Packs/AbuseDB/Integrations/AbuseDB/README.md
@@ -99,10 +99,50 @@
 </tr>
 <tr>
 <td style="width: 268px;">AbuseIPDB.IP.Geo.Country</td>
-<td style="width: 58px;">unknown</td>
+<td style="width: 58px;">String</td>
 <td style="width: 414px;">Country associated with this IP Address</td>
 </tr>
 <tr>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.CountryCode</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Country code associated with this IP Address</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.Hostnames</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The hostame(s) of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IpVersion</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The version of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsPublic</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address public.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsTor</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address a Tor IP.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsWhitelisted</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address whitelisted.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.LastReportedAt</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">When the IP address was last reported.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.NumDistinctUsers</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The distinct number of users.</td>
+</tr>
+<tr>
 <td style="width: 268px;">AbuseIPDB.IP.Address.Reports</td>
 <td style="width: 58px;">unknown</td>
 <td style="width: 414px;">Reports summary (for "verbose" reports)</td>
@@ -214,11 +254,51 @@
 <td style="width: 414px;">Confidence score fetched from AbuseIPDB</td>
 </tr>
 <tr>
-<td style="width: 271px;">AbuseIPDB.IP.Geo.Country</td>
-<td style="width: 55px;">unknown</td>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.Country</td>
+<td style="width: 58px;">String</td>
 <td style="width: 414px;">Country associated with this IP Address</td>
 </tr>
 <tr>
+<td style="width: 268px;">AbuseIPDB.IP.Geo.CountryCode</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Country code associated with this IP Address</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.Hostnames</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The hostame(s) of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IpVersion</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The version of the IP address.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsPublic</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address public.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsTor</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address a Tor IP.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.IsWhitelisted</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">Is the IP address whitelisted.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.LastReportedAt</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">When the IP address was last reported.</td>
+</tr>
+<tr>
+<td style="width: 268px;">AbuseIPDB.IP.NumDistinctUsers</td>
+<td style="width: 58px;">String</td>
+<td style="width: 414px;">The distinct number of users.</td>
+</tr>
+<tr>
 <td style="width: 271px;">AbuseIPDB.IP.TotalReports</td>
 <td style="width: 55px;">unknown</td>
 <td style="width: 414px;">The number of times this address has been reported</td>

diff --git a/Packs/AbuseDB/ReleaseNotes/1_0_30.md b/Packs/AbuseDB/ReleaseNotes/1_0_30.md
@@ -0,0 +1,13 @@
+#### Integrations
+##### AbuseIPDB
+- Added more outputs to the ***ip*** and ***abuseipdb-check-cidr-block*** commands. The following outputs were added:
+    - *IP.Geo.CountryCode*
+    - *AbuseIPDB.IP.Geo.CountryCode*
+    - *AbuseIPDB.IP.Hostnames*
+    - *AbuseIPDB.IP.IpVersion*
+    - *AbuseIPDB.IP.IsPublic*
+    - *AbuseIPDB.IP.IsTor*
+    - *AbuseIPDB.IP.IsWhitelisted*
+    - *AbuseIPDB.IP.LastReportedAt*
+    - *AbuseIPDB.IP.NumDistinctUsers*
+- Updated the Docker image to: *demisto/python3:3.10.13.83255*.
diff --git a/Packs/AbuseDB/pack_metadata.json b/Packs/AbuseDB/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "AbuseIPDB",
     "description": "Central repository to report and identify IP addresses that have been associated with malicious activity online. Check the Detailed Information section for more information on how to configure the integration.",
     "support": "xsoar",
-    "currentVersion": "1.0.29",
+    "currentVersion": "1.0.30",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",