Cyware Orchestrate

Username

Enter the RiskIQ username.

Example:

user@host.com

Text

Required

Note: You require Illuminate license level to access the APIs.

API Key

Enter the RiskIQ API token for authentication. The supported maximum length is 64 characters.

Example:

1231156778659867

Password

Required

Project ID

Enter the project ID that the artifact will associate with.

Example:

"cy716-9769-16cb-4660-6gt4b8n6"

Text

Required

Query

Enter the artifact query to create an artifact.

Example:

exampledomain.org

Text

Required

IOC Type

Enter the type of IOC.

Example:

"domain"

Text

Optional

Tags List

Enter the list of tags to add to the artifact.

Example:

["exampletag1", "exampletag2"]

List

Optional

[
    {
        "project_id": "st56-8976-hg78-i254h-87hsfd6",
        "query": "exampledomain.org",
        "ioc_type": "domain", 
        "tag_list": "registered"
    }
]

Artifact ID

Enter the artifact ID for which the associated artifact is deleted.

Example:

"a872564-1111-176g-d422-e878ghhdfd"

Text

Required

[
    {
        "artifact": "646fb067-d2c6-4a3f-8686-cb7e72822bc0"
    }
]

Artifact ID

Enter the artifact ID to associate the tags to.

Example:

"a872564-1111-176g-d422-e878ghhdfd"

Text

Required

Tags List

Enter the tags to add to the artifact.

Example:

["malicious", "suspicious"]

List

Required

[
    {
        "tags": ["malicious", "suspicious"],
        "artifact_id": "646fb067-d2c6-4a3f-8686-cb7e72822bc0"
    }
]

Artifact ID

Enter the artifact ID to retrieve all the associated tags.

Example:

"a872564-1111-176g-d422-e878ghhdfd"

Text

Required

[
    {
        "artifact_id": "646fb067-d2c6-4a3f-8686-cb7e72822bc0"
    }
]

Domain

Enter the domain to be queried.

Example:

"exampledomain.org"

Any

Required

History

Enter True to return historical results. Otherwise, enter False.

Boolean

Required

[
    {
        "domain": "google.com",
        "history": true
    }
]

Query

Enter the domain or IP to retrieve the cookies information.

Example:

"exampledomain.org"

Text

Required

Extra Params

Enter any additional parameters as key-value pairs to fetch the cookies.

Example:

"start": "2020-12-12"

Key Value

Optional

Allowed values:

[
    {
        "query": "exampledomain.org",
        "start": "2020-12-12"
    }
]

Query

Enter the domain or IP being queried.

Example:

"exampledomain.org"

Text

Required

Start Time

Enter the start timestamp.

Example:

'yyyy-MM-dd', 'yyyy-MM-dd HH:mm:ss'

Text

Required

End Time

Enter the end timestamp.

Example:

'yyyy-MM-dd', 'yyyy-MM-dd HH:mm:ss'

Text

Required

Timeout

Enter the timeout to use for external resources.

Example:

"10"

Integer

Optional

Default value:

7

[
    {
        "domain": "google.com",
        "end_timestamp": "2021-09-01 21:40:49",
        "start_timestamp": "2019-09-01 21:40:49",
        "timeout": "7" 
    }
]

Queries List

Enter the domains to set the classification status.

Example:

["exampledomain.com","sampleURL.com"]

List

Required

Classification

Enter the classification status to set for the domains.

Example:

"suspicious"

Text

Required

Allowed values:

[
    {
        "queries_list": ["04zyp.trudemocracy.com", "bad.net"],
        "classification": "suspicious"
    }
]

Queries List

Enter the list of domains to retrieve the classification status.

Example:

["exampledomain.com", "sampleURL.com"]

List

Required

[
    {
        "query_list": ["04zyp.trudemocracy.com", "bad.net"]
    }
]

Query

Enter the domain for which the classification status is set.

Example:

"exampledomain.com"

Text

Required

Classification

Enter the classification status to set for the specified domain.

Example:

"suspicious"

Text

Required

Allowed values:

[
    {
        "query": "bad.net",
        "classification": "suspicious"
    }
]

Domain

Enter the domain to set the compromised status for.

Example:

"exampledomain.com"

Text

Required

Status

Enter True if the domain has ever been compromised. Otherwise, enter False.

Boolean

Required

Allowed values:

[
    {
        "domain": "bad.net",
        "status": true
    }
]

Query

Enter the domain to set the dynamic DNS status.

Example:

"exampledomain.com"

Text

Required

Status

Enter True if the domain's DNS records are updated through dynamic DNS. Otherwise, enter False

Boolean

Required

[
    {
        "query": "bad.net",
        "status": true
    }
]

Query

Enter the domain for which the dynamic DNS status is retrieved.

Example:

"exampledomain.com"

Text

Required

[
    {
        "query": "bad.net"
    }
]

Query

Enter the domain to check if it is monitored or not.

Example:

"exampledomain.com"

Text

Required

[
    {
        "query": "riskiq.net"
    }
]

Query

Enter the IP address to check for sinkhole status.

Example:

"8.8.8.8"

Text

Required

[
    {
        "query": "8.8.8.8"
    }
]

Query

Enter the IP address to set the sinkhole status.

Example:

"8.8.8.8"

Text

Required

Status

Enter True if you want to set an IP address as a sinkhole. Otherwise, enter False.

Boolean

Required

Allowed values:

[
    {
        "query": "8.8.8.8",
        "status": false
    }
]

Query

Enter the input tag to retrieve all the associated artifacts.

Example:

"suspicious"

Text

Required

[
    {
        "query": "suspicious"
    }
]

Query List

Enter the domains and IPs being queried for OSINT data.

Example:

["example.com", "sample.com"]

List

Required

[
    {
        "query_list": "['\"riskiq.net\"']"
    }
]

Query List

Enter the domains and IPs being queried for malware data.

Example:

"exampledomain.net"

List

Required

[
    {
        "query_list": "['\"riskiq.net\"']"
    }
]

Query List

Enter the domains and IPs being queried for enriched data.

Example:

"exampledomain.net"

List

Required

[
    {
        "query_list": "['\"riskiq.net\"']"
    }
]

Component Name

Enter the component name.

Example:

"apache"

Text

Required

Extra Params

Enter the extra parameters as key value pairs to get the address details.

Example:

"sort": "lastSeen"

Key Value

Optional

Allowed values:

[
    {
        "extra_params": {
            "sort": "lastSeen",
            "version": "null",
            "page": "1",
            "category": "server",
            "sort": "lastSeen"
        },
        "component_name": "apache"
    }
]

Component Name

Enter the component name.

Example:

"apache"

Text

Required

Extra Params

Enter the additional parameters as key-value pairs to retrieve the host information.

Key Value

Optional

Allowed values:

Allowed values:

[
    {
        "extra_params": {
            "sort": "lastSeen",
            "version": "null",
            "page": "1",
            "category": "server",
            "sort": "lastSeen"
        },
        "component_name": "apache"
    }
]

Domain

Enter the domain name.

Example:

"exampledomain.com"

Text

Required

Extra Params

Enter the extra parameters as key-value pairs to get the address information.

Example:

"order": "desc"

Key Value

Optional

Allowed values:

[
    {
        "domain": "riskiq.net",
        "extra_params": {
            "sort": "firstSeen",
            "page": "2",
            "order": "desc" 
        }
    }
]

Name

Enter the cookie name.

Example:

"email"

Text

Required

Extra Params

Enter the extra parameters as key-value pairs to get the address information.

Example:

"sort": "firstSeen"

Key Value

Optional

Allowed values:

[
    {
        "name": "handl_ref",
        "extra_params": {
            "page": "2",
            "sort": "firstSeen",
            "order": "desc"
        }
    }
]

Domain

Enter the cookie domain name.

Example:

"exampledomain.org"

Text

Required

Extra Params

Enter the extra parameters as key-value pairs to get the address information.

Example:

"sort": "firstSeen"

Key Value

Optional

Allowed values:

[
    {
        "domain": "pacific.com",
        "extra_params": {
            "page": "2",
            "sort": "firstSeen",
            "order": "desc"
         }
    }
]

Name

Enter the cookie name.

Example:

"email"

Text

Required

Extra Params

Enter the extra parameters as key-value pairs to get the hosts information.

Example:

"sort": "firstSeen"

Key Value

Option

Allowed values:

[
    {
        "name": "handl_ref",
        "extra_params": {
            "page": "2",
            "sort": "firstSeen",
            "order": "desc"
         }
    }
]

Query

Enter the domain or IP being queried to get trackers.

Example:

"exampledomain.com"

Text

Required

Extra Params

Enter the extra parameters as key-value pairs to get the trackers information.

Example:

"lastseen"

Key Value

Optional

Allowed values:

[
    {
        "query": "riskiq.net",
        "extra_params": {
            "lastSeen": "2017-01-19 18:40:12",
            "page": "2" 
        }
    }
]

Artifact ID

Enter the artifact to be queried to retrieve the associated tags.

Example:

"646fb067-d2c6-4a3f-8686-cb7e72822bc0"

Text

Required

[
    {
        "artifact": "646fb067-d2c6-4a3f-8686-cb7e72822bc0"
    }
]

Artifact

Enter the artifact ID.

Text

Required

Tags List

Enter the list of tags to be updated.

List

Required

[
    {
        "artifact": "646fb067-d2c6-4a3f-8686-cb7e72822bc0",
        "tags_list": ["\"a\""]
    }
]

Artifact

Enter the artifact ID.

Text

Required

Tags List

Enter the list of tags to be deleted.

List

Required

[
    {
        "artifact": "646fb067-d2c6-4a3f-8686-cb7e72822bc0",
        "tags_list": ["'maliciousIPs'"]
    }
]

Hash or IP Address

Enter the SHA-1 hash or associated IP address to retrieve the certificate history.

Text

Required

[
    {
        "hash_or_ip_address": "google.com"
    }
]

Query

Enter the SHA-1 hash of the certificate to retrieve.

Text

Required

[
    {
        "query": "54861d96e46def086e71d59a422761032e827892"
    }
]

Project ID

Enter the unique project ID.

Text

Required

Tags List

Enter the tags to be associated with the project.

List

Required

[
    {
        "tags_list": ["\"phishing\""],
        "project_id": "55dc15d7-63d2-423e-9a03-e90a57e9834d"
    }
]

Project ID

Enter the unique project ID.

Text

Required

Tags List

Enter the tags to be deleted from the project.

Any

Required

[
    {
        "tags_list": ["phishing"],
        "project_id": "55dc15d7-63d2-423e-9a03-e90a57e9834d"
    }
]

Project ID

Enter the unique project ID.

Text

Optional

Visibility

Enter the visibility of the project.

Text

Optional

Allowed values:

Extra Params

Enter the extra parameters as key value pairs to find a project.

Example:

Key Value

Optional

[
    {
        "project_id": "55dc15d7-63d2-423e-9a03-e90a57e9834d",
        "visibility": "public",
        "extra_params": {
             "owner": "riskiq",
             "creator": sampleuser@testdomain.com,
             "organization": "testdomain"
        }
    }
]

Query

Enter the domain or IP to get the list of services.

Text

Required

[
    {
        "query": "8.8.8.8"
    }
]

Query

Enter the domain, host or IP to retrieve the reputation details.

Text

Required

[
    {
        "query": "2020-windows.com"
    }
]

Intel Profile ID

Enter the intel profile ID.

Text

Optional

[
    {
        "intel_profile_id": "5642-6756-87998"
    }
]

Article GUID

Enter the article GUID.

Text

Optional

Start Date

Enter the start date or publish date of articles where you want to start looking at indicators.

Format:

YYYY-MM-DD HH:mm:ss

Text

Optional

[
    {
        "start_date": "2022-06-15 00:00:00",
        "guid": "ff9861p9"
    }
]

Query

Enter the query or IOCs to retrieve the article details.

Text

Optional

Extra Params

Enter the extra parameters as key value pairs to retrieve the article details.

Example:

Key Value

Optional

[
    {
        "query": "sampledomain.site",
        "extra_params": {
            "type": "url",
            "count": 8,
            "source": "public"
        }
    }
]

Article GUID

Enter the GUID of the article to retrieve the article details.

Text

Required

[
    {
        "guid": "7b83636f"
    }
]

Sort Type

Enter the order in which the articles are sorted.

Example:

"publishedDate"

Text

Optional

Default value:

Created date

Page

Enter the page number for paging through results.

Example:

"0"

Integer

Optional

Default value:

0

Order

Enter the field name to sort by.

Example:

"asc"

Text

Optional

Default value:

desc

[
    {
       "order": "asc",
       "page": 0,
       "sort_type": "created"
    }
]

Query

Enter the domain, host or IP to be queried to get the summary card.

Text

Required

[
    {
        "query": "riskiq.org"
    }
]

Artifact ID

Enter the unique artifact ID to list the artifact dtails.

Text

Required

[
    {
        "artifact_id": "646fb067-d2c6-4a3f-8686-cb7e72822bc0"
    }
]

Domain

Enter the domain to check for compromised status.

Example:

"google.com"

Text

Required

[
    {
        "domain": "google.com"
    }
]

Domain

Enter the domain for which the classification status is retrieved.

Example:

"google.com"

Text

Required

[
    {
        "domain": "google.com"
    }
]

Query

Enter the domain or IP to retrieve the OSINT data.

Example:

"google.com"

Text

Required

[
    {
        "query": "google.com"
    }
]

Query

Enter the domain or IP to retrieve the malware data.

Example:

"google.com"

Text

Required

[
    {
        "query": "google.com"
    }
]

Query

"8.8.8.8"

Text

Required

[
    {
        "query": "8.8.8.8"
    }
]

Project

Enter the project to retrieve all the alerts.

Text

Required

Artifact

Enter the artifact ID to retrieve all the alerts.

Text

Optional

Start Time

Enter the start time to filter results to after this datetime.

Format: yyyy-MM-dd HH:mm:ss

Text

Optional

End Time

Enter the end time to filter results to before this datetime.

Format: yyyy-MM-dd HH:mm:ss

Text

Optional

Max Results

Enter the max number of results to display.

Integer

Optional

Default value:

25

Extra Params

Enter the extra params as key-value pairs to get alerts.

Key Value

Optional

[
    {
        "project": "15ddbca7-5f9a-49da-b217-57dadcd3d479",
        "artifact": "sample1223",
        "stat_time": "2017-04-15T00:34:44.260000",
        "end_time": "2021-04-15T00:34:44.260000",
        "size": "25", 
        "extra_params": 
        {
           "page": 0 
        }
    }
]

Query

Enter the domain or IP to retrieve the list of all sub domains.

Example:

"google.com"

Text

Required

[
    {
        "query": "google.com"
    }
]