integration-BitDam.yml

commonfields:
  id: BitDam
  version: -1
name: BitDam
display: BitDam
category: Email Gateway
image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAyCAYAAACXpx/YAAAAAXNSR0IArs4c6QAAE4tJREFUeAHtWwlwVVWa/s+57963ZE9IzAIJIBJDdlAExG5cC+2xWtzGpcvppuxyRiHgiqOWUpZVU109LQLa3XaPbevYPe3WPdMKTretIiIIErKQsMQEiYEsZH0vL2+525nvvPBCQt4DtJSya96pJPfes/zn3O8//3puiBIlgUACgQQCCQQSCCQQSCCQQCCBQAKBBAIJBBIIJBBIIJBAIIHA3wMCLN4iS6s3VHLTuoEx4sQdE7rZtkmp8xaTHQqQv3EXcdU11i6YsIixISZEB7P5ftPs+6y5ea0+1iFxc1YRiMvgRct3P8d0ujvYvp+sYR8xzkkwTjYxEkIQcydRUuVFFD50gMyeI8TRjpaxxQvcC9vQGbH9ROwNywi/1NR0f8dYh8TNWUFAiTdLsmPRlUzTFqhFM8jOyCZrZIg8oQHK5T6apgzSNLOLcgYOUv6sacT6j1DIMCggFLLAWCZMAndBmimM8VzG1ctIYbfm5l6t93RftJtoy4mdEG8BifqvBYG4EnznVf+8fiCYVWMGnFRekEQFfIg0EaLhoWHyBS0KcyeYKMitCMrKzyant5u8wyFqtPOpwciloHCQyqCtjy8TjIbmdpBtG7+3dH5Xc/M9/q/lDRJETolAFP9Jner/sXIj11NWDJiMPCn99EbvfNqWdB0NTyklu7OFjKOHMGZ0uJaZTVklJZTdspWqfHU0VQtQrZFPW/Ui0mHCVSj2aOHYGLYdfkvlA7fU1q4NROsT128GgbgqOuy6c+kr3gUX/c/w+bRPz6eSrC/oqqR3KDfYRL6sajLPKSNHYJCUkJ9YcJj0oUEKFF9M9cpMauojKuNddLW7jXzCRUetVGhoqG68g4APBiYX25aW3tP9zuZv5rUSVKMIxJXgkqpn16mKulrYYbJshUzY1yynjy7J2UsXZTUZrc6F5l+15eTr8ZL++X4SpkHMoZJ7djlRcppz5EgnLxg8SMvoU+q3XfSmXkYjpJFqG5G5GVOErQeubdr/8KboYuJd5817Pg1tHqLJAi9rPOQJ1Nbe5Y03/kvWs9LS11SifTGGzaE5c8h6/fWbrRiN38qquAyuKF+3jinaakFgCOynLFIGdUulbNfgzR8t/NfGh9pXmjsXbeAj//uqHT52DD1CRF4fpVx3a2pSwYzzhjs6ltlDAzdeZjY4qnx7aPNwITWkVZPDpZHTnUykUF1X+4FFh7f8CAPjl4qq9W/BUVsspPM2uUiHbQTRXDtj7M8Kczx/gtmCVVRvvIGR41xO5m/q6mp65fCqqnXpFlNWKOTw2GS1NdatfCFKtqJqw2qmqHcJ24zhCApEjSwEHNo4Y2/bZuD1xsYHR6Jjv43XuAyuXLZlPRmixvCCcQGESUYA1lSGuJxCnFe11NU0nMkLLVi+6+bggO+3uUaP+1r/FlKn5NJ7oSI6GEolSkonR3b2stoXqv/7VLTKqzfs4ExdIBkMyceGi7FsGbohXret8Me6yr5/YNeK/srKDfNJ4TsVxUOm6f9FY13N3XKesrnPlSgk9nHuhnYK7G/c019GtDbiKFRWb9jIFfcK29ZH55q0MMn30fmFbX1qkvXj5jPEYhKps1AxMYMxbsK7i15WlORs6hU51G3m0RfD0+hYH6PhPi/xkUDcceNIRG4/+c381yoXPH9JT3L2iuedV1OFNURXpB6lpVoLtWZW074jn99WS3RKBoMQwJfAIgIX5me4DU+YR4gkGPaZwjJJUVwXq0aoBu1PoHMApt9rCyMNoyPSK8cpDmEJww7D2UMoQMEoc2Ub9okp/QT8Yrj1GapOzAXxxdzYmVQoIwLkBi5UbPvtyspnL29oWNEix3/bSlxGvbUzx0x3mpSuNVGWZzflprgomFFA/oKpxJyZdGDnmb/KlMryTYqprwiFTNpvn0N7lSrK8wzS3IFmWsrbvnPH5XdkXf/ey/2npCilFuDbzL6p5Nz85vF99+3rdXPNeowzxxqZZQNTL0P7E8XFeftbWrp+ZHNlGhj66k03vaa0tnZn6rrIhtN3XA0ItbT0uVxF4bYv0+VjQz6pCiR5n+1QriiZnt0Znau3dx8LBjM9QYNdAOY/ha2ykHN1qsXCG5csWfu9LVvWTrIhs2ZtcLrdDk9Wlju4BaYI/oSKUDFf0nS59GM7dtwXLL3wuVzNdDp1fSDc3PxQt2yTZsR2JieHhwa8Bw+uGZZ10SJpmKadY1lhs6lpdU+0PtY1LoMPBGcIhg1um2EAZpMK9eiCjU1Xuygt6XAsWnHrbhtY7WWKAyYXFg+K3jSdFHakUm/mDGpwV+T0sqI59N7LH8UlMK5BFS4zhpPjLy9f9yuE3qshWU7ImVsOOdDavRjz/hrssoWDzz7QenSTwp0vKbaJ9+bqcZteomjmXhm+pQ75nke2LnSc8zZxQ48xlw+k3wcDroFa+Qvmms/JcWXvYMYlqP9AzitLxdwNl3Ch3IkNOR/Z29QBr99fUb1+h26FFM4d1zGg4Q/T/WDWi4YR2mJzXqBors+hDW4ERPdB43yPGaFUlyepv6J6wx/JCj8h7T38kTtN27xHcHu6wh1mZfWzTYLZjzfuqYmJX1wG/3hqpyNFx8YJeUlzqqRoGvJSMlEBJoHhp9Opo685+ndH8prCQTWDJHJcZeRS4XFjw/j9goI9BjMGPzsPPWMucDwdeQ8JnSQlsp5zBWqYccZho23zkKyDrfRAq2Ydt5npJJRMRXFnE6JzqOfRLki0c0WbonBN1k1F5ZjEChuLjVPq6+8dqqxc/zCmfBebCkyzl6ErGLyWV1RlPAmnbw1IO6QuwKqkccGdmD2q/pHwlfl9m5K9vjD3JLMMtMHrpJlg3N8UJWmakDlBaCNidqrC3ffjLhn+QS9TXI9FLEXEjEifxLEEKeE3S6qfvXB/3Yp20JhQ4jK4vtOwdMzrY9nwnFPI4pnEMqeSkjedWDLM0KYNEwjFe5iyXKSUOF68a5ZRTxZiZmhpCmPry5SmpoXJmeakoTRP4bZ4BCbWA3BRXVa9UdrBE0WwDADzOFS0KixjENbzGdnImA1UJcRgPVxpwVmtZQb/3bKNLM7ZHUJEdsMxywq+Mmpz6X2wYokceybFNAc/5jyjBZ57CcbNlWPA3DVccT4qIARw1OQhC5gusOFYEaT9MjAeJzMRZqMqwnVcpY+BH2JJcGKTLGvkQ9wflu+K5wqsD13oLkQScCJDX2CzbEXEIDFYKoShca5lO+zwLXj+CX4nlPgMTp1LDifCT4Q0SloWaZmZkGQo2eAAKcNj/soEYjEe2OKOpzZ+kpp96TY9nZxQzR7dS0nmCKXgJMPDTcpwBMmwe2Wce+oyigWYJP4QsZDjeksJkTGXlBLbtu5vali1fVxz9FbdW7vyAB4exG4vUoV9G8BDotXu2Ltn1f3RTgiTrozen+4qT8mgPluxe0rAsoyyuc9U4ETmEclc0IUtZT9orFvxXpROVdXGi7H+3yESKIrWjb/KCMEW5hN762qelPURO0xsO+pL5DMkusHg1tX7a+/tks8VVRuf4IpjbWRzCHaRrDu5xGXwdy4VjqxML2W5cajgOUZuMQh/c5iSjT5Kd3hpwcmUYj+LB877j5c6rJLFvcq0cy3LwCItaFCTRBhhCOy7okSeJYfOqMCpQb9Y3XF6JbNkivIA7B9Cn5pP4hF0cOGOCMxoB+yXtfJXitBXKZHMDTSExQW/iXEtGQzGj3X/3vpVY8yVhOvrV36Mta2EpvkTHmFLxhepxs1BZoV/Ga2VZgAbbhv2YYTB2Ly/jTJX9rHI2oz3eALtmF7A9EwucRm8b/NBwwGJTXIP0dSsPpqd30XTsvsRc3DqCKRMphSnZvHP2z+49ql3fnCNufl9GtTcQb+bksO9lBY4TFoYWTCtkIbIHSJ6Nw6F49WjXrRlW8bj2MtHI0oXTRIWhCscvsECXJYzps5BiuyV4uKfVNu2Yikni/upZ/nSrdhWuViC1LojWExxZEW2eYws9Z1YxFTmfA8RWgd8gekkInvjeDdpWSkECR5fKdvGJVLEhAMabOYQRF5aO/BRyJ0/qcRl8O2OFkWxVRoaYuTv06h730zq04qoMHeAZuRAmr9E+fNjc3atu+HR7b1a0eX9rkwyUrNJS8kn11AH6SNuOqbmjTk2pyFrqya9Wtu0qi1GvxehLs9hTHwfUn6u5haXwEEBOCcJSoyBX7VKqnqoRyRJpPYQrdhqTBmdztD1YXgbk4vXG7aSUihmG7YJs21nLPUUIRTd1FGq0FjY9qfewXEZ/NJwqZWsKuQBokkZLvKkpoEp6TQIO9EQgMDRX6PznPaKFdvFKbd3ehwKFQ42U5m3gfLSEXQN+slSDCpx+j5/87RURjuYinRSYhc4Hgej6htg5+IbhM9i9/x6anEcei9nWsThw9yb4TTNlJShMvOcHtd83E5Q0bLNk0rVJHihtNNno8RlsF66WBmBt6wzMIEGyWF8QVnmR5Rrt1EyyVDwy5Vlh15Mviyzgwpch2hvTgG1T10Ij9pFM1wfB/zZOc10hhxmzJKe6aSCeHKKIfQrCBpLplPhJfdJiZKa/TQFSMe0vyLMrcmnGyAmEw2IMVZBelZIxw6e7BG3RpuCQWWWcBhr4bkjzaU8XTZvw/VNtTVj2qas7GfT4IStxw7QpNSfjRKXwXenr+MpLEhh/zDBH6KhkJs6A1m0XZSTF6p6XEx/2nW+uOSH6XPO33phxsxuyi/spCJ7DzW1NVD3QC4N9aiN/1L1+/ZIkvhUlEa9aMVm7JeVczdM2GFoYrqtlyIIniVJIFbuV7m2XbfDVbFUNHwSG34QekrmUH551cbrYL9n6Lb5NirhCUbAT/IYtAaJhXH2SGpEkQO630XcfeEokyI76NGdO2vkmvYgb/6CgsMKOD8VSGN+hOf/wqcOSK/ayBzxW6DEIb0yfgWPz0KJy+Df7S43dZYksy0UxpkuwW66CgpJS/YQmUjffonyZPeiJ2c5iqfenvc3crZNp1c/XkwtnfnAwE0jBnv9hy98aJ2a3JgcgocqYsmJYilbpcqT4gqWWQgvH8KJUl959To4HqNGEZI2Nshh+XsMSuqDMi0ArTyo1D/B6UGg7MsAATg5ksHMiQOOR3CQfdLSMAOTX6bJegGnz3y8sb7m5WgnW1ceYFoYcbZ2IzEtTyF2X3QjRFYHDTNWhA0i+JFri5CL/B1rHr05sW50lL1OLsfrxjCa0B6Xwb1GllBTM0ktyCRP5hRsQJv07iM03HKM2ofSYzoJUcqAh91culbdrhfNSXaFH7j2gt23Lymtp021F9AHTWVghCAVEah039wa+0NHdGCcK4AZmw9Zmwj8J3WFmmVDgvgeMPppxJERD1YRzByFRGLAxmjU1j7shUP2CAD7CdR5rqSFZEIYKKfhNyTjUZgC4D6OGeMmxBzwmNkuBEM/3Vs/Ole0WX6KhLz0rUO+Ke+Cb3ciHkaIIyAVUIdCNKOfjg21WPYHAshA58KQdGMirBHpPVXF7hlf2Il1w3ZP8LBhhmTuV7673MUT2qIk4jLYPXeRosKUhHo7ybuvmXSfn5KUAF2Q00lPL9r+i86hJd2/brmGhg0PTuRwvIPwSSYu1iRvo3/TM917fHnTKgrbz/unS7dpg36NnnrjJhr0J5MTaUpZIp/uWKHn6uprTutB4+x2uYOzTBbzFUBMJcT/1FO3554JtJDU344PhuYLh2AOxnsiEx//g6PDl8vKnvkLU3k51IILlrtN6ANtipJVAJu6FWo+oqfHj5FeLEAN2ly0N9WubBvfNv7++KHDr3C48cLBgz2FMo1qqcy399MP2quqFqUIrs6GHiBT5W0H6m7Wy+dtXIpcjRsZ1EB942ov0b1j5PBiP9OYeE3yT3M44USeKFYwr4U7uxbC5ZCZ/oETLSfuYol8pPWaq55a3zeQUqNZPpqZ1k0VOV1UdE6Iev0e+qj9XDroK4x86SE3XhhfexQ7+mmZdoD2hPKpzjmF/uHCnVSc/wX9cccC+uSz2VicSRySK4tMVgDA+oAmvts6arsi9Yk/Xz8CcRm87cEZzypCvSc7fYDqraX0oe8q2lnvoJ6uEDmgNVRIq0AI5oSOWOpoo/PdvfRpyhTKL+6isrwO2t06izbtmUchXYswN7p0eY4KhdiLQ9crv80H5dH1/r1f4zJ40ZX/+cyUWbmrKgpqaTrfhU9mR8g7yKnPn0H9yGQFwLjkY5yuT22mvNJO2uOeAofJSY2HptOOA+eTN+ghJ6RW2ttokZIL+9WFA/hb9tat3hqtT1y/OQTi2mA7Zwbv/MJPB7dnEbcvo4wUP52D3HQ+JHphWjstpKO0tbcU4WsxdTfPpa7eTOr3pUYcIBX5ZXkkGC2jTgsS6bYFd9m6u7ludawv2qLdE9evEYG4DB5p3IUjyyQ4UDKBDyse0iinh1FJn0Vd9gyqMZZQG+EYE8EG/qkF/WzS1Ki0yo/cob9lC/KtcCj2km38PDAsXmxtrUHglShnC4G4DMZZdV2W4m+dxXvYPLVLZPOA1WJliU36dHbIzIgwVZNfUUaVPHgbyQ+M6uQRqOKjyAo04J/RtvgGkrcfPnzqLyfP1gv/f5snyp6Y7y2WTMeHWIcjKRfWvxmSdzX6vUOzqDVm/2hla+tK5L7GGd9oQ+KaQCCBQAKBBAIJBBIIJBBIIJBAIIFAAoEEAgkEEggkEEggkEDgqyLwf29xHT2+qP2sAAAAAElFTkSuQmCC
description: BitDam secure email gateway protects from advanced content-borne threats
  with the most accurate prevention of known and unknown threats, at their source.
detaileddescription: |-
  In order to generate an API token, log in to BitDam Dashboard.
  Navigate to your profile, click on 'API token' tab and then 'Generate API Token'.
configuration:
- display: BitDam API URL
  name: url
  defaultvalue: http://cloud.bitdam.com/api/v1.0
  type: 0
  required: true
- display: API Token
  name: apitoken
  defaultvalue: ""
  type: 4
  required: true
- display: Trust any certificate
  name: insecure
  defaultvalue: ""
  type: 8
  required: false
- display: Use proxy settings
  name: proxy
  defaultvalue: ""
  type: 8
  required: false
script:
  script: |
    '''IMPORTS'''
    import requests
    import base64
    import json

    # disable insecure warnings
    requests.packages.urllib3.disable_warnings()

    '''INTEGRATION PARAMS'''
    API_TOKEN = demisto.params().get('apitoken')
    URL_BASE = demisto.params().get('url')
    USE_PROXY = demisto.params().get('proxy', False)
    UNSECURE = demisto.params().get('insecure', False)

    '''CONSTANTS'''
    READ_BINARY_MODE = 'rb'
    SLASH = '/'
    SCAN_FILE_URL = 'files/'
    GET_FILE_VERDICT_URL = 'files/?file_identifier_value={}&file_identifier_type={}'
    TOKEN_PREFIX = 'Bearer'
    RESPONSE_CODE_OK = 200
    STATUS_IN_PROGRESS = 'IN_PROGRESS'
    STATUS_DONE = 'DONE'
    VERDICT_MALICIOUS = 'MALICIOUS'
    VERDICT_CLEAN = 'CLEAN'
    BITDAM_COMMAND_PREFIX = 'bitdam'
    DBOTSCORE_CLEAN = 1
    DBOTSCORE_MALICIOUS = 3


    '''HANDLE PROXY'''
    if not USE_PROXY:
        del os.environ["HTTP_PROXY"]
        del os.environ["HTTPS_PROXY"]
        del os.environ["http_proxy"]
        del os.environ["https_proxy"]


    '''HELPER FUNCTIONS'''
    def get_file_bytes(entry_id):
        get_file_path_res = demisto.getFilePath(entry_id)
        file_path = get_file_path_res["path"]
        with open(file_path, READ_BINARY_MODE) as fopen:
            bytes = fopen.read()
        return base64.b64encode(bytes)


    def get_url_base_with_trailing_slash():
        '''
        Returns the intergation's base url parameter, making sure it contains an trailing slash
        '''
        url_base = URL_BASE
        return url_base if url_base.endswith(SLASH) else url_base + SLASH


    def get_auth_headers():
        headers = {}
        headers['Authorization'] = "{} {}".format(TOKEN_PREFIX, API_TOKEN)
        return headers


    def build_json_response(content, context, human_readable):
        return {
            'Type': entryTypes['note'],
            'ContentsFormat': formats['json'],
            'Contents': content,
            'ReadableContentsFormat': formats['markdown'],
            'HumanReadable': tableToMarkdown(human_readable, content),
            'EntryContext': context
        }


    def get_file_name(entry_id):
        get_file_path_res = demisto.getFilePath(entry_id)
        return get_file_path_res["name"]


    def verdict_to_dbotscore(verdict):
        if VERDICT_CLEAN == verdict:
            return DBOTSCORE_CLEAN
        elif VERDICT_MALICIOUS == verdict:
            return DBOTSCORE_MALICIOUS
        return None


    '''API_IMPL'''
    def scan_file():
        response = scan_file_command()
        returned_sha1 = parse_scan_file_response(response)
        # Build demisto reponse
        response_content = {'SHA1' : returned_sha1}
        response_context = {'BitDam' : {'FileScan' : {'SHA1' : returned_sha1}}}
        return build_json_response(response_content, response_context, "File was submitted successfully")


    def scan_file_command():
        # Get data to build the request
        entry_id = demisto.args().get('entryId')
        file_name = get_file_name(entry_id)
        file_bytes = get_file_bytes(entry_id)
        json_data = {'filename': file_name,
                         'file_data_base64': base64.b64encode(file_bytes)}
        raw_json = json.dumps(json_data, ensure_ascii=False)
        url = "{}{}".format(get_url_base_with_trailing_slash(), SCAN_FILE_URL)
        auth_headers = get_auth_headers()

        # Send the HTTP request
        response = requests.post(url, data=raw_json, headers=auth_headers, verify=not UNSECURE)
        return response


    def parse_scan_file_response(response):
        # Parse response
        if RESPONSE_CODE_OK != response.status_code:
            raise Exception("Scan file failed. Response code -{}, Data- '{}'".format(str(response.status_code), response.content))
        response_json = json.loads(response.content)
        if not response_json.has_key('data') or not response_json['data'].has_key('sha1'):
            raise Exception(
                "Scan file failed. Bad response json - {}".format(response.content))
        returned_sha1 = response_json['data']['sha1']
        return returned_sha1


    def get_file_verdict():
        identifier_type = demisto.args().get('idType')
        identifier_value = demisto.args().get('idValue')
        response = get_file_verdict_command(identifier_type, identifier_value)
        verdict, status = parse_get_file_verdict_response(response)
        response_content = {'STATUS' : status,
                            'VERDICT' : verdict,
                            'ID' : identifier_value}
        context = {}
        context['BitDam.Analysis(val.ID && val.ID == obj.ID)'] = {
                'Status' : status,
                'Verdict' : verdict,
                'ID' : identifier_value
            }

        if VERDICT_MALICIOUS == verdict:
            context[outputPaths['file']] = {'SHA1': identifier_value}
            context[outputPaths['file']]['Malicious'] = {
                'Vendor': 'BitDam',
                'Description': 'Process whitelist inconsistency by bitdam-get-file-verdict',
                'Name': identifier_value
            }

        dbotscore = verdict_to_dbotscore(verdict)
        if dbotscore:
            context[outputPaths['dbotscore']] = {
                        'Indicator': identifier_value,
                        'Type': 'File',
                        'Vendor': 'BitDam',
                        'Score': dbotscore
                    }
        response_context = context
        return build_json_response(response_content, response_context,
                                    "Get file verdict was performed successfully")

    def parse_get_file_verdict_response(response):
        # Parse results
        if RESPONSE_CODE_OK != response.status_code:
            raise Exception("Get file verdict failed. Response code -{}, Data- '{}'".format(str(response.status_code),response.content))
        response_json = json.loads(response.content)
        status = ''
        verdict = ''
        if not response_json.has_key('data') or not response_json['data'].has_key('Verdict'):
            # Still in progress
            status = STATUS_IN_PROGRESS
        else:
            status = STATUS_DONE
            if VERDICT_CLEAN.lower() in response_json['data']['Verdict'].lower():
                verdict = VERDICT_CLEAN
            else:
                verdict = VERDICT_MALICIOUS
        return verdict, status


    def get_file_verdict_command(identifier_type, identifier_value):
        # Get data to build the request
        scan_file_relative_url_formatted = GET_FILE_VERDICT_URL.format(identifier_value, identifier_type)
        auth_headers = get_auth_headers()
        url = "{}{}".format(get_url_base_with_trailing_slash(), scan_file_relative_url_formatted)
        # Send the request
        response = requests.get(url, headers=auth_headers, verify=not UNSECURE)
        return response


    def test_module():
        response = get_file_verdict_command('sha1', '111')
        if RESPONSE_CODE_OK == response.status_code:
            return True
        raise Exception("Status code - {}, Error- '{}'".format(str(response.status_code),
        response.content))


    '''COMMAND_CLASIFIER'''
    if demisto.command() == 'test-module':
        # This is the call made when pressing the integration test button.
        if test_module():
            demisto.results('ok')
        sys.exit(0)
    elif demisto.command() == 'bitdam-upload-file':
        demisto.results(scan_file())
    elif demisto.command() == 'bitdam-get-verdict':
        demisto.results(get_file_verdict())
  type: python
  commands:
  - name: bitdam-upload-file
    arguments:
    - name: entryId
      required: true
      description: File's entry ID from war room. Supported types are doc, dot, docx,
        docm, dotx, dotm, pdf, rtf, xls, xlt, xlsx, xlsm, xltx, xltm, xlsb, xlam,
        csv, ppt, pptx, pptm, potx, potm, ppam, ppsx, ppsm and pps.
    outputs:
    - contextPath: BitDam.FileScan.SHA1
      description: SHA 1
      type: string
    description: Upload a file sample to BitDam's service
  - name: bitdam-get-verdict
    arguments:
    - name: idValue
      required: true
      description: The value of the file's unique identifier (for example - file's
        SHA1)
    - name: idType
      description: Type of the identifier(default:sha1)
      defaultValue: sha1
    outputs:
    - contextPath: BitDam.Analysis.Status
      description: Status of the analysis. Can be either 'DONE' or 'IN_PROGRESS'
      type: string
    - contextPath: BitDam.Analysis.Verdict
      description: Final verdict of the analysis. Can be 'Clean', 'Malicious' or empty
        if analysis isn't finished.
      type: string
    - contextPath: BitDam.Analysis.ID
      description: Unique identifier
      type: string
    - contextPath: DBotScore.Indicator
      description: The Indicator
      type: string
    - contextPath: DBotScore.Score
      description: The DBot score
      type: number
    - contextPath: DBotScore.Type
      description: The Indicator Type
      type: string
    - contextPath: DBotScore.Vendor
      description: The DBot score vendor
      type: string
    - contextPath: File.Malicious.Name
      description: File's name
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason for the vendor to make the decision
      type: string
    description: Get verdict for a scanned file
  runonce: false
tests:
  - Detonate File - BitDam Test