The display name of the node within the flows.

If the IoC does not have an existing trust level, it will have its trust level set to the designated Default Trust Level.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

If checked, it will set the URLs trust level based on the Domain’s trust level.

The node is initially configured with the following IoC search locations for parsing.

• Domain: msg.payload.ioc.domain The format of the domain can be just “domain.tld”. If domain is supplied as a URL, the domain will be parsed into “domain.tld”.
• IP Address: msg.payload.ioc.ip
• MD5: msg.payload.ioc.md5
• SHA1: msg.payload.ioc.sha1
• SHA256: msg.payload.ioc.sha256
• URL: msg.payload.ioc.url Location of the URL. If Set URL Trust Level Based on Domain is checked, the default trust level of the URL IoC is set to the domain’s existing trust level. If the URL and domain are undefined, the trust level is set to the default trust level.

The display name of the node within the flows.

The minimum trust level for the incoming IoCs.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

The maximum trust level for the incoming IoCs.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

The information added at the Output Field location is a list (array) of IoCs which are currently associated with the Incident. The Output Field is relative to msg.payload. The default Output Field is associatedIoCs.
For example:

"payload": {
    "associatedIoCs": [
      {
        "ioc": "https://test10.com",
        "iocType": "url",
        "trustLevel": 0
      }
    ]
}

The display name of the node within the flows.

The Source may be any part of the incoming message. The IoC search scans the entire object hierarchy starting from the Source.
The following contexts are supported:

• msg: This selects part of the incoming message as the source of the data. This is typical choice.
• flow: This selects part of the flow context’s saved data as the source. This information is shared with only the nodes on a given tab.
• global: This selects part of the global context’s saved data as the source. This information is shared by all nodes regardless of tab.
• J: expression: JSONata expression language to perform query and transform operations on the payload.

When Include URLs is enabled, this node will output URLs and Domains in the Output Field. When not checked, only Domains will be sent out. Additionally, enabling this feature enables a secondary URL option.

If enabled, Remove Parameters from URLs removes all the parameters from the URL. When disabled, the parameters remain as part of the URL and are alphabetized by name.

When Ignore Special IPs is enabled, all IPv4 and IPv6 addresses for local host (loopback), private ranges, link-local ranges, carrier-grade NAT, and reserved ranges are ignored. Additionally, URLs containing those types IPv4 addresses are ignored as well. There is currently no support for ignoring IPv6 addresses in URLs.

The default Output Field is ioc and is placed within msg.payload.

The display name of the node within the flows.

The trust level the incomimg IoCs are set to.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

The node is initially configured with the following IoC search locations for parsing.

• Domain: Location of the Domain to set the trust level of. The format of the domain can be just “domain.tld”. If domain is supplied as a URL, the domain will be parsed into “domain.tld”.
• IP Address: Location of the IP Address.
• MD5: Location of the MD5 Hash.
• SHA1: Location of the SHA1 Hash.
• SHA256: Location of the SHA256 Hash.
• URL: Location of the URL.

The display name of the node within the flows.

When Use Trust Level Range is enabled, IoCs with a trust level greater than or equal to the Minimum Trust Level and less than or equal to the Maximum Trust Level are passed through the In Range output, IoCs with a trust level less than the Minimum Trust Level or greater than to the Maximum Trust Level are passed through the Outside Range output. IoCs without a set trust level are passed through the Undefined output.

By default, Use Trust Level Range is disabled. In this mode, IoCs with a trust level greater than or equal to the user defined Minimum Trust Level are passed through the In Range output. IoCs with a trust level less than the Minimum Trust Level are passed through the Outside Range output. IoCs without a set trust level are passed through the Undefined output.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

The node is initially configured with the following IoC search locations for parsing.

• Domain: Location of the Domain to set the trust level of. The format of the domain can be just “domain.tld”. If domain is supplied as a URL, the domain will be parsed into “domain.tld”.
• IP Address: Location of the IP Address.
• MD5: Location of the MD5 Hash.
• SHA1: Location of the SHA1 Hash.
• SHA256: Location of the SHA256 Hash.
• URL: Location of the URL.

The display name of the node within the flows.

The IoCs are checked against the set trust level and passed through the appropriate output.

• 0 (Malicious)
• 1
• 2
• 3
• 4
• 5 (Unknown)
• 6
• 7
• 8
• 9
• 10 (Trusted)

This node has the following set of available routing rules for processing the IoCs associated with the Incident.

• All IoCs == Reference Trust Level: Every IoC has a trust level of Reference Trust Level. This is a default Message Routing entry of the node.
• All IoCs < Reference Trust Level: Every IoC has a trust level less than the Reference Trust Level.
• Any IoCs < Reference Trust Level: Any IoC has a trust level less than the Reference Trust Level. This is a default Message Routing entry of the node.
• Most IoCs < Reference Trust Level: Most IoCs have a trust level less than the Reference Trust Level. If there are an even number of IoCs associated with the Incident, at least 1/2 the IoCs must have a trust level less than the Reference Trust Level.
• All IoCs > Reference Trust Level: Every IoC has a trust level greater than the Reference Trust Level.
• Any IoCs > Reference Trust Level: Any IoC has a trust level greater than the Reference Trust Level.
• Most IoCs > Reference Trust Level: Most IoCs have a trust level greater than the Reference Trust Level. If there are an even number of IoCs associated with the Incident, at least 1/2 the IoCs must have a trust level greater than the Reference Trust Level. This is a default Message Routing entry of the node.