Cisco Umbrella Investigate Operation
Overview
The Cisco Umbrella Investigate Operation for ThreatQuotient enables a user to enrich indicators in ThreatQ with context from Cisco Umbrella.
The operation provides the following actions:
The operation provides the following actions:
- Enrich - enriches a domain with contextual or historical metadata.
- Get Samples - retrieves Cisco Threat Grid samples that are related to a given domain, IP, or URL.
- Reverse WHOIS - retrieves domains related to a given email address.
- Get Associated Names - retrieves domains related to a given IP Address.
- Latest Malicious Domains - retrieves a list of malicious domains related to a given IP Address.
The operation is compatible with the following indicator types:
- Email Address
- FQDN
- IP Address
- URL