X
App Vendor: X
App Category: IT Services, Messaging
Connector Version: 2.0.0
API Version: API - 2.0
Note
It is recommended to verify playbook compatibility before updating to a major app version.
About App
The X app (formerly Twitter) helps security teams monitor public conversations for threats and emerging risks. It enables analysts to search tweets and review user activity to support investigations and situational awareness.
The X app is configured with Cyware Orchestrate to perform the following actions:
Action Name | Description |
|---|---|
Generic Action | This is a generic action used to make requests to any X endpoint. |
Multiple Tweet Lookup | This action retrieves details of multiple Tweets. |
Search User By ID | This action searches for a user by ID. |
Search User By Name | This action retrieves details of a user by username. |
Tweet Lookup | This action retrieves details of a Tweet. |
Tweet Search | This action searches for a query on Twitter. |
User Timeline Lookup | This action retrieves tweets from a user's timeline. |
Configuration Parameters
The following configuration parameters are required for the X app to communicate with the X enterprise application. The parameters can be configured by creating instances in the app.
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
API Token | Enter the bearer token of your X Developer account to authenticate API requests. | Password | Required | |
Timeout | Enter the timeout value in seconds. This is the number of seconds that requests will wait to establish a connection with X. | Integer | Optional | Allowed range: 15-120 Default timeout: 15 |
Verify | Choose your preference to verify SSL or TLS while making requests. It is recommended to set this option to yes. Passing no may result in connection errors. | Boolean | Optional | By default, verification is enabled. |
Action: Multiple Tweet Lookup
This action retrieves details of multiple tweets
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Tweet IDs | Enter the ID of the Tweet to search in a comma-separated format. | Text | Required |
Example Request
{
"loop_keys": [],
"tweet_ids": "1346889436626259968,2008010564954714240"
}Action: Search User By ID
This action searches for a user by ID.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
User ID | Enter the user ID to search. | Text | Required |
Example Request
{
"loop_keys": [],
"user_id": "29873662"
}Action: Search User By Name
This action retrieves details of a user by username.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Username | Enter the name of the user to search. | Text | Required |
Example Request
{
"loop_keys": [],
"username": "JOHNDOE"
}Action: Tweet Lookup
This action retrieves details of a Tweet
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Tweet ID | Enter the ID of the Tweet to search. | Text | Required |
Example Request
{
"loop_keys": [],
"tweet_id": "1946253037745705035"
}Action: Tweet Search
This action is used to search for a query on Twitter.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Query | Enter the query string to perform. | Text | Required | |
Max Results | Specifies the number of Tweets to try and retrieve, up to a maximum of 100 per distinct request. | Integer | Optional | |
Start Time | YYYY-MM-DDTHH:mm:ssZ (ISO 8601/RFC 3339). The oldest or earliest UTC timestamp from which the Tweets will be provided. | Text | Optional | |
End Time | YYYY-MM-DDTHH:mm:ssZ (ISO 8601/RFC 3339). The oldest or earliest UTC timestamp from which the Tweets will be provided. | Text | Optional | |
Since ID | Returns results with an ID greater than (that is, more recent than) the specified ID. | Text | Optional | |
Until ID | Returns results with an ID less than (that is, older than) the specified ID. | Text | Optional | |
Pagination Token | Enter the token to paginate with. | Text | Optional |
Example Request
{
"loop_keys": [],
"query": "(from:TwitterDev OR from:TwitterAPI) has:media -is:retweet"
}Action: User Timeline Lookup
This action retrieves tweets from a user's timeline.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
User ID | Enter the ID of the tweet to search. | Text | Required | |
Max Results | Specifies the number of Tweets to try and retrieve, up to a maximum of 100 per distinct request. | Integer | Optional | |
Start Time | YYYY-MM-DDTHH:mm:ssZ (ISO 8601/RFC 3339). The oldest or earliest UTC timestamp from which the Tweets will be provided. | Text | Optional | |
End Time | YYYY-MM-DDTHH:mm:ssZ (ISO 8601/RFC 3339). The oldest or earliest UTC timestamp from which the Tweets will be provided. | Text | Optional | |
Since ID | Returns results with an ID greater than (that is, more recent than) the specified ID. | Text | Optional | |
Until ID | Returns results with an ID less than (that is, older than) the specified ID. | Text | Optional | |
Pagination Token | Enter the token to paginate with. | Text | Optional |
Example Request
{
"loop_keys": [],
"user_id": "1720665183188922368"
}Action: Generic Action
This is a generic action used to make requests to any X endpoint.
Action Input Parameters
Parameter | Description | Field Type | Required/Optional | Comments |
|---|---|---|---|---|
Method | Enter the HTTP method to make the request. | Text | Required | Allowed values: GET, PUT, POST, DELETE |
Endpoint | Enter the endpoint to make the request to. Example: tweets/search/recent | Text | Required | |
Query Params | Enter the query parameters to pass to the API. | Key Value | Optional | |
Payload | Enter the payload to pass to the API. | Any | Optional | |
Extra Fields | Enter the extra fields to pass to the API. | Key Value | Optional | Allowed keys: headers, payload_data, custom_output, download, filename, files, retry_wait, retry_count, and response_type |
Example Request
{
"endpoint": "users/by/username/x",
"extra_fields": {
"__loop_keys__": []
},
"loop_keys": [],
"method": "GET",
"query_params": {
"__loop_keys__": []
}
}Changelog
The following table shows the changelog for each app version:
Version | Changes |
|---|---|
v2.0.0 |
|