mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Lou Stella
77 lines
2.1 KiB
JSON
77 lines
2.1 KiB
JSON
{
|
|
"create_time": "2021-11-30T14:20:41.840902+00:00",
|
|
"custom_function_id": "5febf154c78c6815119c08f9dfaba9a661a992d6",
|
|
"description": "Collect all indicators in a container and separate them by data type. Additional output data paths are created for each data type. Artifact scope is ignored. ",
|
|
"draft_mode": false,
|
|
"inputs": [
|
|
{
|
|
"contains_type": [
|
|
"phantom container id"
|
|
],
|
|
"description": "The current container",
|
|
"input_type": "item",
|
|
"name": "container",
|
|
"placeholder": "container:id"
|
|
}
|
|
],
|
|
"outputs": [
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "all_indicators.*.cef_key",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "all_indicators.*.cef_value",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "all_indicators.*.data_types",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "all_indicators.*.artifact_id",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "domain.*.cef_key",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [
|
|
"domain"
|
|
],
|
|
"data_path": "domain.*.cef_value",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "domain.*.artifact_id",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [
|
|
"file name"
|
|
],
|
|
"data_path": "file_name.*.cef_key",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [
|
|
"file name"
|
|
],
|
|
"data_path": "file_name.*.cef_value",
|
|
"description": ""
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"data_path": "file_name.*.artifact_id",
|
|
"description": ""
|
|
}
|
|
],
|
|
"platform_version": "5.1.0.70187",
|
|
"python_version": "3"
|
|
} |