ThreatConnect's reputation commands does not return correct results when no indicator found

[TPhan]

Hi all,

I am not sure if this is a bug in ThreatConnect pack since its reputation commands does not return correct results when it could not find the indicator. The correct behavior should be https://xsoar.pan.dev/docs/integrations/dbot#unknown. Since it does not return correct results in those cases, we have no idea if the command has ever run. In other words, it never returns `unknown` score for indicators.

Regards,

Thinh Phan

[MichaelHinderman · Accepted solution]

Hello,

Does this occur with several different IPs as well? I've reviewed the commands code, and it looks like the output from ThreatConnect is being sent directly as output to XSOAR. Your execution returned back an empty JSON object because that is what ThreatConnect returned back. XSOAR does not look at the text submitted, as input to the command, as the indicator to be created when the command finishes. It reviews the output from the command, and parses any indicators found from said output.

I believe this type of output is expected behavior. XSOAR, since it doesn't take into account the string provided by the ip argument, as a valid indicator, reviews the output of the command, and creates/sets reputations based on the findings of the service. You would have seen the unknown reputation appear if ThreatConnect returned back a finding for the given ip, and a reputation was not found for it.