> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/reputation-and-dbot-score.md). # Reputation and DBot score DBot is the Cortex XSIAM machine learning bot, which ingests information about indicators to determine if they are malicious. Since DBot requires a very specific dataset, you must format the data as follows. As described in [Generic reputation commands](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/generic-commands.md#UUID-67e7ba5f-4f74-45fc-8f2f-1aab4ef77100), when developing an integration that implements a generic reputation command, it is necessary also to create a corresponding DBot score object. **Context format** ```programlisting "DBotScore": {  "Indicator" : "foo@demi.com",  "Type": "email",  "Vendor": "JoeSecurity",  "Score": 3,  "Reliability": "A - Completely reliable" }  ``` The DBot score must be at the root level of the context and contain all the following required keys. | Key | Meaning | Required? | | ----------- | ------------------------------------------------------------------------------------------------------------------ | --------- | | Indicator | The indicator value. | Yes | | Type | The indicator type. Can be: ip, file, email, url, cve, account, cider, domainglob, certificate, or cryptocurrency. | Yes | | Vendor | The vendor reporting the score of the indicator. | Yes | | Score | An integer regarding the status of the indicator. See Score Types below. | Yes | | Reliability | The reliability of the source providing the intelligence data. See Reliability Level below. | Yes | | Message | Optional message to show an API response. For example, `Not found`. | Optional | **Reliability level** When merging indicators, the reliability of an intelligence data source influences the reputation of an indicator and the values assigned to indicator fields. An integration that outputs a DBotScore object and defines each indicator's reliability should allow the user to manually configure the default reliability for the created indicator's DBot Score. This is done by implementing a `Source Reliability` parameter (named `integration_reliability`) in the YAML file. This parameters is later used to determine the reliability level when creating the DBotScore object. **Example of implementing a reliability parameter in an integration YAML file** ```programlisting - name: integration_reliability display: Source Reliability additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: C - Fairly reliable options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 ``` {% hint style="info" %} ### Note The values are case sensitive. {% endhint %} **Score values** DBot uses an integer to represent the reputation of an indicator. | Number | Reputation | | ------ | ---------- | | 0 | Unknown | | 1 | Benign | | 2 | Suspicious | | 3 | Malicious | **Unknown** An unknown score can be interpreted in the following ways: * The vendor returns an `Unknown` score for the indicator. * The vendor returns nothing on the indicator. **Malicious** If the DBot score is returned as a `3` or `Malicious`, you need to add to the context that a malicious indicator was found. To do this, add an additional key to the `URL`, `IP`, or `File` context called `Malicious` as follows: ```programlisting demisto.results({     "Type": entryTypes["note"],     "EntryContext": {        "URL": {            "Data": "STRING, The URL",            "Malicious": {                "Vendor": "STRING, Vendor reporting the malicious status",                "Description": "STRING, Description of the malicious url"            }        },         "File": {            " SHA1/MD5/SHA256": "STRING, The File Hash",            "Malicious": {                "Vendor": "STRING, Vendor reporting the malicious status",                "Description": "STRING, Description of the malicious hash"            }        },         "IP": {            "Address": "STRING, The IP",            "Malicious":{                "Vendor": "STRING, Vendor reporting malicious",                "Description": "STRING, Description about why IP was determined malicious"        },        },         "Domain": {            "Name": "STRING, The Domain",            "Malicious": {                "Vendor": "STRING, Vendor reporting the malicious status",                "Description": "STRING, Description of the malicious domain"            }        }    } }) ``` Malicious has two key values: `Vendor` and `Description`. The vendor is the entity reporting the malicious indicator. The description explains briefly what was found. For example: ```programlisting "URL": {    "Data": "http://viruswarehouse.com",    "Malicious": {        "Vendor": "VirusTotal",        "Description": "Wannacry ransomware detected"    } } ``` {% hint style="info" %} ### Note It is not possible to use the Cortex XSIAM Transformers (DT) within the DBot score context. For example, using the following in your DBot context, will not work: ```programlisting DBotScore(val.Indicator == obj.Indicator) ``` {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/reputation-and-dbot-score.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.