Cyware Orchestrate

Add Custom Aliases

This action adds custom aliases to threat data objects such as threat actors, malware, attack patterns, campaigns, infrastructures, intrusion sets, and tools.

Add Note to Threat Data Object

This action adds a note to a threat data object.

Add Subscriber

This action adds a subscriber to Intel Exchange.

Add Tag to Threat Data

This action adds a tag to a threat object.

Bulk Add Analyst Score

This action adds an analyst score to multiple threat data objects.

Bulk Add or Remove Watchlist

This action adds or removes multiple threat data objects from the watchlist.

Bulk Add Relation

This action adds a relation to multiple threat data objects.

Bulk Add Tags

This action adds tags to multiple threat data objects.

Bulk Add TLP

This action adds TLP to multiple threat data objects.

Bulk IOC Advanced Lookup

This action performs a bulk lookup for threat data objects in the intel exchange platform and retrieves their basic details, enriched information, and related objects.

Bulk Lookup And Create Intel

This action performs a lookup for IOCs to retrieve the list of objects available in the Intel Exchange platform. If some IOCs are not available, you can choose to create intel and ingest the missing iocs. This action is available in Intel Exchange from the release v3.3.1 and later versions.

Bulk Remove Tags

This action removes tags from multiple threat data objects.

Bulk Run Rule

This action runs a rule on multiple threat data objects.

Create Bulk Notes

This action creates notes in bulk for multiple threat data objects.

Create Collection

This action creates a collection on Intel Exchange.

Create Intel

This action is used to create intel by providing minimal details of indicators, SDOs, relations, custom objects, and indicators parsed from free text.

Create Saved Search

This action creates a saved search on Intel Exchange.

Create Tag

This action creates a tag on Intel Exchange.

Create Task in Multiple Objects

This action creates a task in multiple threat data objects.

Create Task in Threat Data Object

This action creates a task for a threat data object.

Create Task to Parse IOCs

This action creates an IOC parsing task to extract STIX objects from free text data or a web page.

Create Threat Defender Content

This action creates a threat defender content record.

Delete Note From Threat Data Object

This action deletes a note by its unique ID.

Delete Report

This action deletes a report from Intel Exchange. Note: This action is irreversible.

Delete Saved Search

This action deletes a saved search using the specified ID.

Delete Task From Threat Data Object

This action deletes a task of a threat data object.

Enrich Threat Data

This action retrieves the enriched data of a threat data object using the enrichment tool.

Export File

This action retrieves the export data in CSV format.

Filter Relations by Source

This action retrieves source-specific relations of a threat data object.

Generate Export Link

This action is used to generate an export link, which can be used to share data on Intel Exchange

Get Accounts for Integration Tool

This action lists all accounts of an integration tool in Intel Exchange.

Get Action Overview

This action retrieves an overview of the action data of a threat data object.

Get Action Statistics

This action retrieves the statistics of the actions performed on a threat data object.

Get Advanced Details for a Threat Data Object

This action retrieves additional information about a threat data object, such as kill chain phases and published collections.

Get Key Evidence of Confidence Score

This action retrieves the key evidence for the intel exchange confidence score calculation.

Get Kill Chain Details

This action retrieves the details of a STIX kill chain phase.

Get License Details

This action retrieves the license details.

Get Note Details

This action retrieves the details of the specified note.

Get Object Source Details

This action retrieves source-specific details of a threat data object.

Get Object Source Details in List View

This action lists all the occurrences when the specified threat data object was ingested into the platform by the given source.

Get Quick Action Details

This action retrieves the status of the quick actions performed on a threat data object.

Get Related Objects

This action retrieves the related objects of an object type.

Get Relations Overview

This action retrieves the overall relations statistics of a threat data object.

Get Report Details

This action retrieves the details of a report.

Get Report Run Logs

This action retrieves the report run logs.

Get Result of Parse IOCs Task

This action retrieves the result after successfully processing the create parse IOCs task action.

Get Rule Details

This action retrieves the details about a rule.

Get Saved Search Details

This action retrieves the details of a saved search.

Get Signed in User Details

This action retrieves details of the currently logged-in user.

Get Task Details in Threat Data Object

This action retrieves the details of a task.

Get Task Details of Parsing IOCs

This action retrieves the details of the specified parse IOCs task.

Get Task Overview in Threat Data Object

This action retrieves an overview of the tasks created for a threat data object.

Get Threat Data Object Details

This action retrieves basic correlated details of a threat data object in Intel Exchange.

Get User Details

This action retrieves the details of the specified user.

Get User Group Details

This action retrieves the details of the specified user group.

Get Widget Data

This action retrieves the data of a particular widget present in Intel Exchange.

Import Intel

This action imports threat data to Intel Exchange.

Ingest STIX Data

This action is used to ingest STIX 2.1 data into Intel Exchange.

List Actions

This action retrieves a list of actions performed on a threat data object.

List All Collections

This action lists all collections on Intel Exchange.

List All Tags

This action lists all tags from Intel Exchange.

List API Feeds

This action lists all api feeds available on Intel Exchange.

List Custom Attributes of Threat Data Object

This action retrieves the custom attributes of a threat data object with respect to all the sources the object has received.

List Enriched Objects

This action lists the enriched data of the specified threat data object.

List Integrations

This action lists integrations configured in Intel Exchange.

List Intel History

This action retrieves the history of an intel added to Intel Exchange through various sources.

List IOC Types

This action lists all valid indicators of compromise (IOC) types supported by the intel exchange platform.

List Kill Chain Phases

This action retrieves kill chain information of a threat data object.

List Notes in Threat Data Object

This action retrieves a list of notes associated with a threat data object.

List Published Collections of a Threat Object

This action retrieves the published collections of a threat data object.

List Relations of Threat Data Object

This action retrieves the list of relations and their details for a given threat data object.

List Reports

This action lists reports on Intel Exchange.

List Rules

This action lists all the enrichment rules.

List Saved Result Set

This action retrieves saved result sets from Intel Exchange.

List Saved Searches

This action lists saved searches on Intel Exchange.

List Source Collections

This action retrieves a list of collections for the sources.

List Source Details

This action retrieves the source information for the given object type and object ID.

List Source External References

This action lists all external references associated with a threat data object.

List Sources

This action lists all the feed sources.

List Source Types

This action retrieves the types of feed sources available in the Intel Exchange platform.

List Subscribers

This action lists the subscribers configured in Intel Exchange.

List Tasks in Threat Data Object

This action retrieves the list of tasks associated with a threat data object.

List Threat Data

This action retrieves a list of threat data objects available for use in the Threat Investigations Canvas in Intel Exchange.

List Threat Data Object Details in Table View

This action retrieves threat data object details in a tabular format.

List Threat Data Object Sources

This action retrieves a list of feed sources associated with a threat data object, along with their description, fanged description, and de-fanged description.

List User Groups

This action retrieves a list of user groups from Intel Exchange.

List Users

This action lists all the users of the Intel Exchange application.

List Widgets

This action lists widgets present in Intel Exchange.

Perform Action on Threat Data Object

This action performs an action on a threat data object. You can perform actions, such as deprecate, undeprecate, add analyst tlp, add analyst score, and more.

Perform Bulk Action on Rules

This action updates multiple rules in one operation.

Perform Bulk Action on Threat Data

This action performs an action on multiple threat data objects.

Pin Saved Search

This action pins a saved search to the top.

Preview Threat Data Object

This action retrieves specific details of a threat data object.

Quick Add Intel

This action is used to add indicator data to Intel Exchange

Remove Pinned Saved Search

This action removes a saved search from the pinned search list.

Retrieve Download Link

This action retrieves a download URL for the export file, which includes the file ID and a token.

Retrieve Intel Statistics

This action retrieves the statistics history for the specified Intel component.

Retrieve Quick Add Intel Relation Objects

This action retrieves details of threat objects ingested and linked as relationship objects to the report created through the quick add intel submission.

Retrieve Quick Add Intel Status

This action retrieves the intel creation status of a quick add intel submission.

Run Report

This action runs a specific report.

Run Rule

This action runs a rule in Intel Exchange.

Update Note in Threat Data Object

This action updates the details of a note in Intel Exchange.

Update Pinned Saved Search

This action updates the order of a pinned saved search.

Update Saved Search

This action updates a saved search using the specified ID.

Update Task in Threat Data Object

This action updates a task of a threat data object.

Update User Details

This action is used to update the user details on Intel Exchange.

Update User Group Details

This action updates the user group details on Intel Exchange.

Generic Action

This is a generic action to perform any additional use case that you want on Cyware Intel Exchange.

Base URL

Enter the base URL of Cyware Intel Exchange.

Example:

https://<tenant_code>.cyware.com/ctixapi

Text

Required

Access ID

Enter the Intel Exchange access ID to authenticate with.

Password

Required

Secret Key

Enter the Intel Exchange secret key for authentication.

Password

Required

SSL Verification

Choose your preference to verify SSL or TLS while making requests. It is recommended to set this option to yes. Passing no may result in incorrectly establishing the connection.

Boolean

Optional

By default, verification is enabled.

Timeout

Enter the timeout value in seconds. This is the number of seconds requests will wait to connect to Intel Exchange and read the response.

Integer

Optional

Allowed range:

15-120

Default value:

15

Object ID

Enter the ID of the threat data object to add custom aliases.

Example:

903f519f-feb1-49b8-8c80-18ff8de99e8c

Text

Required

You can retrieve the object ID using the Action: List Threat Data.

Custom Aliases

Enter the list of custom aliases to add to the threat actor.

Example:

$LIST[sample alias 1,sample alias 2]

List

Required

Text

Enter the note to add to the object.

Example:

sample note

Text

Required

Ensure that the JSON content passed is stringified if the Is JSON parameter is set to true.

Note Type

Enter the note type to create.

Text

Required

Allowed value:

report

Object ID

Enter the object ID to update the note for.

Example:

2b8d0163-da03-4a1d-86c5-f981f0920c0d

Text

Required

You can retrieve this using the action List Threat Data.

Metadata

Enter any additional metadata associated with the note.

Example:

report_id: 2b8d0163-da03-4a1d-86c5-f981f0920c0d

Key Value

Optional

Is JSON

Choose true if you want to send the note in JSON format.

Boolean

Optional

Default value:

false

Subscriber Name

Enter the name of the subscriber.

Example:

John Doe

Text

Required

Primary Contact Name

Enter the primary contact name of the subscriber.

Text

Required

Email

Enter the email ID of the subscriber.

Text

Required

Score

Enter the score for the subscriber.

Integer

Required

Collection IDs

Enter the ID of the collections to which the subscriber needs to be added.

Example:

$LIST[9251d39e-c6d4-4c63-a55f-8201fd0d583d]

List

Required

IP Addresses

Enter IP addresses to establish a secure exchange of intel.

Example:

$LIST[0.0.0.0/0 , 1.12.34.8]

List

Required

Send Mail

Choose true to send mail.

Boolean

Optional

Default value:

true

Whitelisted IP Ranges

Enter any IP ranges to whitelist to access this collection.

Example:

$LIST[1.1.1.1 , 1.12.34.8]

List

Optional

Additional Params

Enter any additional parameters to pass with the request.

Key Value

Optional

Object ID

Enter the object ID to add a tag to.

Example:

03694ab0-0e9f-45f4-a4c4-2b6eaedd4803

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data object to add the tag to.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Tag

Enter the name of the tag to add to this object.

Example:

restricted_ip

Text

Required

Create Tag

Choose true to create a tag if the specified tag does not exist in Intel Exchange.

Boolean

Optional

Default value:

false

Tag Colour

Enter the color of the tag to assign if creating a tag.

Text

Optional

Default value:

#0068fa(blue)

Analyst Score

Enter the analyst score to add to the objects.

Example:

68

Integer

Required

Allowed range:

0-100

Object IDs

Enter the list of threat data object IDs to perform the bulk action.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects to perform the bulk action. example, indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Action Type

Enter watchlist to add objects to the watchlist, or un_watchlist to remove them.

Text

Required

Allowed values:

watchlist, un_watchlist

Object Names

Enter the list of values for the objects to add or remove from the watchlist.

Example:

$LIST[www.childalertfakt.eu, 3:bwcsn:ecsn]

List

Required

You can retrieve this using the action List Threat Data.

Object IDs

Enter the list of threat data object IDs to perform the bulk action.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Target ID

Enter the ID of an object to add as a relation.

Example:

85830a15-3ae2-49f1-987c-f52ccf40a0e3

Text

Required

You can retrieve this using the action List Threat Data.

Target Type

Enter the type of the object to add as a relation.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object IDs

Enter the list of threat data object IDs to perform the bulk action.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Relationship Type

Enter the relationship type to add to threat data objects.

Text

Optional

Allowed values:

For allowed, see the section Allowed values for the Relationship Type parameter.

Default value:

related-to

Target Name

Enter the name or value of the target object you are adding as a relation.

Example:

An IP address like 5.205.20.175 or a domain name like example.com

Text

Optional

Target Sub Type

Enter the subtype of the object.

Example:

ipv4-addr

Text

Optional

Tag IDs

Enter the ID of the tags to be added.

Example:

$LIST[ac542ff0-b423-4329-8c82-12e419e48e18, 3af3031b-e9fc-4def-9b67-0d6a984a84fc]

List

Required

You can retrieve this using the action List All Tags.

Object IDs

Enter the list of threat data object IDs to perform the bulk action.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Analyst TLP

Enter the analyst TLP to add to the objects.

Text

Required

Allowed values:

WHITE, GREEN, AMBER, RED

Object IDs

Enter the list of threat data object IDs to add TLPs.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object Type

Enter the type of threat data object to retrieve details for.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Enrichment Data

Choose true to retrieve the latest five enrichment data points of the threat data objects.

Boolean

Optional

Default value:

false

Relation Data

Choose true to retrieve the latest 100 relations details of threat data object details.

Boolean

Optional

Default value:

false

Object Value

Enter a list of up to 100 threat data object values to look up.

Example:

$LIST[47.92.78.238, www.facebook.com]

List

Optional

You can retrieve this using the action List Threat Data.

Object ID

Enter a list of up to 100 threat data object IDs to look up.

Example:

$LIST[2b8d0163-da03-4a1d-86c5-f981f0920c0d]

List

Optional

You can retrieve this using the action List Threat Data.

Fields to Retrieve

Enter a comma-separated list of fields to retrieve specific details of the objects.

Example:

relations,enrichment_data

Text

Optional

By default, it retrieves all field data.

Enrichment Tools

Enter the names of up to five enrichment tools, separated by commas, to enrich the threat data objects. For example, enter AbuseIPDB, VirusTotal to apply both the AbuseIPDB and VirusTotal enrichment tools.

Text

Optional

You can retrieve this using the action List Integrations.

Indicators

Enter the list of indicators to look up.

Example:

$LIST[76.77.213.225:80, 131.190.253.60, 56.15.255.238]

List

Required

You can enter a maximum of 1000 IOC values.

Enrichment

Choose true to add the last enriched information for each enriched object.

Boolean

Optional

Default value:

true

Create

Choose true to create new IOCs that were missed from the list of lookup IOCs.

Boolean

Optional

Default value:

true

Metadata

Enter any additional information about the objects, such as TLP, confidence score, and more, while creating intel.

Example:

{'tlp':'green'}

Key Value

Optional

Allowed keys:

description, labels, tlp, confidence

Collection Name

Enter the name of the collection to map the threat data objects.

Example:

testFeed-External

Text

Optional

Source Name

Pass the name of the source to map the intel. If the passed source name does not exist in the platform, then a new source is automatically created

Example:

OpenAPI Lookup

Text

Optional

Default source:

OpenAPI Lookup (OpenAPI) of the Miscellaneous source category.

Tag IDs

Enter the ID of the tags to be removed.

Example:

$LIST[ac542ff0-b423-4329-8c82-12e419e48e18, 3af3031b-e9fc-4def-9b67-0d6a984a84fc]

List

Required

You can retrieve this using the action List All Tags.

Object IDs

Enter the list of threat data object IDs to perform the bulk action.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Rule ID

Enter the ID of a rule to run.

Example:

5602232e-085b-4c15-89af-404ea45c5703

Text

Required

You can retrieve this using the action List Rules.

Object IDs

Enter the list of threat data object IDs to perform the bulk action on.

Example:

$LIST[49d5e95e-3889-42de-8280-1ebf5c7cb95a, 71cd9a67-aa10-4016-bd32-b44534b2e1b9]

List

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of threat data objects to perform the bulk action on.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object Type

Enter the type of the threat data object.

Text

Required

Allowed value:

threatdata

Text

Enter the note content to be added to the specified threat data objects.

Example:

This is a sample note

Text

Required

Object IDs

Enter the list of object IDs on which you want to add bulk notes.

Example:

$LIST[77b4c308-73bc-4e1e-9d05-aeeaa0423df,dd324b2-e8e2-42da-9bc9-f9f4470a13ef]

List

Required

You can retrieve this using the action List Threat Data.

Polling

Choose true to add this collection to the poll data.

Boolean

Required

Inbox

Choose true to add this collection to the inbox service.

Boolean

Required

Collection Name

Enter the name of the collection.

Example:

sample name

Text

Required

Description

Enter a description of the collection.

Example:

This is a sample description

Text

Required

Marking Config

Enter the data marking type.

Text

Optional

Allowed values:

tlp, acs

Default value:

tlp

Default Marking Definition

Enter the default data marking definition.

Text

Optional

Default value:

AMBER

Title

Enter the title of the indicator to create on Intel Exchange.

Example:

vulnerability report

Text

Required

Create Intel

Choose true to create an Intel feed.

Boolean

Optional

Default value:

false

Indicator

Enter the indicators to add to the intel. This should be a dictionary in the form of {indicator_type: indicator_value}.

Key Value

Optional

Allowed indicator types:

ipv4-addr, ipv6-addr, domain, url, email, md5, sha1, sha224, sha256, sha384, sha512, ssdeep

SDOs Object

Enter the SDO types and comma-separated SDO values.

Example:

{\"vulnerability\": \"cve-2021-21913\", \"cve-2021-219134\"}

Key Value

Optional

Confidence

Enter the source confidence score of the indicators being passed.

Integer

Optional

Allowed range:

1-100

TLP

Enter the TLP of the indicators.

Text

Optional

Allowed values:

GREEN, AMBER, RED, WHITE, NONE

Apply Metadata to All Objects

Choose true to apply the metadata to all objects of the intel. Choose false to apply the metadata to the report object that is created as part of the quick add intel submission only.

Boolean

Optional

Default value:

false

Custom Scores

Enter the custom score key and the score in key-value pairs.

Example:

{\"x_ctix_customscore_2\": 2,\"x_ctix_customscore_1\": \"medium\"}.

Key Value

Optional

Description

Enter a description for the intel within 1000 characters.

Example:

This is a sample description

Text

Optional

Labels

Enter a list of tag names to add to the intel.

Example:

$LIST[label_a,label_b]

Any

Optional

Additional Metadata

Enter any additional metadata to create intel.

Any

Optional

Parsed Indicators

Enter the IOC types and indicators parsed from free text.

Example:

{ips: $JSON[{values: [\"2.23.4.2\", \"32.34.1.1\"]}]}

Key Value

Optional

Observables

Enter the STIX cyber observable object (SCO) types and comma-separated SCO values.

Example:

{\"user-account\": \"test@cyware.com\"}

Key Value

Optional

Relations

Enter the objects to be associated with the report object created as part of this quick add submission.

Example:

$JSON[[{\"name\": \"1.1.1.100\",\"type\": \"indicator\",\"ioc_type\": \"ipv4-addr\",\"id\": \"30bafaad-b70d-4881-97f2-7915df322332\"},{\"name\": \"1.1.1.1\",\"type\": \"indicator\",\"ioc_type\": \"ipv4-addr\",\"id\": \"8c664a86-8da7-4cc5-a2a5-aa66b7ca1c8a\"}]]

Any

Optional

You can associate a maximum of 10 objects in a single quick add submission.

Extra data

Enter the extra data to pass in the payload.

Key Value

Optional

Saved Search Type

Enter the type of the saved search.

Example:

basic

Text

Optional

Allowed values:

basic, cql

Saved Search Name

Enter the name of the saved result set.

Text

Required

Query

Enter the query to create a saved search from.

Example:

\"type=\"indicator\" and sub_type=\"file\" and created>\"2021-07-28\"

Text

Required

Shared Type

Enter the visibility setting for the saved search.

Text

Optional

Allowed values:

private, global, specific users, systems

Default value:

private

Metadata

Enter the metadata to support transforming the saved search into a CQL query or threat data filters.

Example:

{\"object_type\":[\"malware\"]}

Text

Optional

Tag Name

Enter a unique name of the tag to add within 50 characters.

Example:

restricted_ip

Text

Required

Tag Color

Enter the hex key of a color code for the tag to assign.

Text

Required

Allowed values:

#5236e2, #0068fa, #eb9c00, #ff5330, #27865f, #c4c81d, #00a2c2, #c341e7, #ad6b76, #95a1b1

Object Type

Enter the type of threat data object to associate with the task.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object IDs

Enter a list of threat data object IDs to associate with the task.

Example:

$LIST[f7ad5e3d-5c31-4c44-bbb1-990516d5678e, f7ad5e3d-5c31-4c44-bbb1-990516d5678e]

List

Required

You can retrieve this using the action List Threat Data.

Assignee

Enter the ID of a user to assign the task.

Example:

8efe66c3-1701-4494-a192-5512e0c2c0af

Text

Required

Description Text

Enter the description of the task to be performed.

Example:

task_test

Text

Required

Task Status

Enter the status of the task.

Text

Optional

Allowed values:

not_started, in_progress, completed

Closure Comment

Enter the comment to close the task. This is required if the Task Status is completed.

Text

Optional

Additional Data

Enter the additional data to create a task in multiple threat data objects.

Key Value

Optional

Allowed keys:

type, deadline, priority

Assignee

Enter the ID of a user to assign the task.

Example:

5555f14c-6130-4e58-a2da-33e1a85b5a64

Text

Required

You can retrieve this using the action List Users.

Description Text

Enter the description of the task to be performed.

Example:

Verify this indicator

Text

Required

Threat Data Type

Enter the type of the threat data object.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the ID of the threat data object to associate with the task. If you do not enter this, the task is created as a global task.

Example:

92686150-58e5-4f15-be64-f3e123efd825

Text

Optional

You can retrieve this using the action List Threat Data.

Priority

Enter the priority of the task.

Text

Optional

Allowed values:

high, medium, low

Default value:

medium

Task Deadline

Enter the task deadline in epoch format to specify when the task should be completed.

Example:

1633393469

Integer

Optional

Status

Enter the status of the task.

Text

Optional

Allowed values:

not_started, in_progress, completed.

Default value:

not_started

Closure Comment

Enter the comment to close the task. This is required if Status is completed.

Text

Optional

Free Text Data

Enter free text (up to 50,000 characters) or a web page URL to extract STIX objects and retrieve the task ID.

Example:

1.2.3.11, 1.1.2.1, domain.com

Text

Required

Extract STIX Object

Choose true to extract STIX objects from a web page. If you choose false, then the URL passed in the data parameter is parsed as free text.

Boolean

Optional

Default value:

false

Get Parsed IOC Details

Choose true to retrieve the parsed IOC details.

Boolean

Optional

Default value:

false

Task Completion Wait Time

Enter the time (in seconds) to wait for the task to complete and retrieve its details.

Integer

Optional

Default value:

5

Tags

Enter the list of tag objects to apply to the content.

Example:

$JSON[[{\"id\": \"ef4fdadc-c98c-4e09-afd2-b9084706151e\", \"name\": \"yara\", \"colour_code\": \"#ff5330\"}]]

Any

Optional

Allowed keys:

id, name, colour_code

Rule

Enter the rule content.

Example:

'rule tdl1 : suspicious_file'

Text

Required

External Variables

Enter any external details to add to the threat data content.

Example:

$JSON[[{\"type\": \"boolean\", \"key\": \"some_string_var\", \"value\": true}]]

Any

Optional

Note ID

Enter the ID of the note to delete.

Example:

8003c6ba-5215-486d-881f-d940dcb78d35

Text

Required

You can retrieve this using the action List Notes in Threat Data Object.

Report ID

Enter the report ID to delete.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e

Text

Required

You can retrieve this using the action List Reports.

Report Type

Enter the report type.

Text

Optional

Allowed values:

basic, advanced

Default value:

basic

Saved Search ID

Enter the unique ID of a saved search to delete.

Example:

1a7d5c8a-848a-4a67-af82-e68f3d823c65

Text

Required

You can retrieve this using the action List Saved Searches.

Task ID

Enter the unique identifier of a task to delete.

Example:

2d83e656-4aca-4077-a1d7-4b572cc2fb53

Text

Required

You can retrieve this using the action List Tasks in Threat Data Object.

App Slug

Enter the slug of an enrichment tool to retrieve its enriched data.

Example:

comodo

Text

Required

You can retrieve this using the action List Integrations.

Object Value

Enter the value of the object to enrich.

Example:

1.1.1.1

Text

Required

Object ID

Enter the ID of an object. For indicators, enter the SCO ID object, and for vulnerabilities, enter the vulnerability object ID.

Example:

916e0c84-61a6-412b-a25c-e65d6bcdc96b

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type to enrich the object.

Text

Required

Allowed values:

indicator, vulnerability

Action Slug

Enter the enrichment action name to retrieve specific details.

Text

Required

Allowed values:

get_ip (for IPs), get_domain (for domain), get_url (for URL), get_cve (for vulnerability)

File ID

Enter the file ID generated by the Generate Export Link action.

Example:

df21ff51-0d9e-4380-be78-b75889860702

Text

Required

You can retrieve this using the action Generate Export Link.

Token

Enter the token that is generated by the Retrieve Download Link action.

Example:

61973ea7-5387-4e4b-a221-970fc1dca4xx

Password

Required

You can retrieve this using the action Retrieve Download Link.

Object ID

Enter the ID of a threat data object.

Example:

09730695-2f63-4a1c-a0fb-a042689588d5

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type to retrieve source-specific relations.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Format

Enter the format of the report.

Example:

csv

Text

Required

Allowed format:

csv

Component

Enter the component of the report to export.

Example:

threat_data

Text

Required

Allowed value:

threat_data

Query

Enter the CQL query to generate the report.

Example:

type='indicator'

Text

Required

Columns

Enter the list of columns you want to export.

Example:

$JSON[[{\"key\": \"name\",\"label\": \"value\"},{\"key\": \"type\",\"label\": \"type\"}]]

Any

Required

For the allowed list, see The Column Object.

Tool ID

Enter the integration tool ID to retrieve accounts.

Example:

7a7ac2cf-51e9-48fe-a2a8-32e7a684cc33

Text

Required

You can retrieve this using the action List Integrations.

Object ID

Enter the ID of a threat data object to retrieve the action overview.

Example:

916e0c84-61a6-412b-a25c-e65d6bcdc96b

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type to retrieve the action overview.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Layout

Enter the parameter to filter some fields according to the given layout.

Example:

overview

Text

Required

Page Number

Enter the page number to retrieve actions.

Example:

1

Integer

Optional

Default value:

1

Page Size

Enter the number of records to retrieve on each page.

Example:

3

Integer

Optional

Default value:

10

Object ID

Enter the ID of a threat data object to retrieve associated action statistics.

Example:

916e0c84-61a6-412b-a25c-e65d6bcdc96b

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type to retrieve action statistics.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Is Third Party Action

Choose true to retrieve third-party action statistics only.

Boolean

Optional

Default value:

false

Is Intel Exchange Action

Choose true to retrieve Intel Exchange action statistics only.

Boolean

Optional

Default value:

false

Object Type

Enter the type of the object.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the ID of the object to retrieve the details.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Threat Data.

Object ID

Enter the unique ID of an object.

Example:

dbd48dae-3505-4ace-9c0e-e617d9ccc269

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Text

Optional

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Default value:

indicator

Kill Chain ID

Enter the ID of a kill chain phase to retrieve the details.

Example:

ae78301c-4378-4348-b83e-2e7b4dd8438b

Text

Required

You can retrieve this using the action List Kill Chain Phases.

Note ID

Enter the note ID to retrieve the details.

Example:

711f396d-0bf9-40bf-8693-e31aff702bbf

Text

Required

You can retrieve this using the action List Notes in Threat Data Object.

Source Object ID

Enter the source object ID to retrieve the details of a threat data object ingested by a particular source at a given time.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e

Text

Required

You can retrieve this using the action List Threat Data Object Sources.

Object Type

Enter the object type.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Default value:

indicator

Object ID

Enter the ID of a threat data object.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Source ID

Enter the ID of a source to retrieve the instances of the source.

Example:

bc8c1d21-3bf1-4b19-bf6b-f31db555c1ec

Text

Required

You can retrieve this using the action List Source Details.

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Layout

Enter the layout to filter the number of returned fields in the response.

Example:

tab

Text

Optional

Object Type

Enter the type of the threat data object.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the ID of a threat data object.

Example:

81f699f3-314d-4a6c-a26b-c5802552c0f7

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Related Object

Enter the related object to retrieve.

Example:

indicator

Text

Required

Related Object Value

Enter the related object value.

Example:

1.21.2.3

Text

Required

Object ID

Enter the object ID to retrieve the details.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Report ID

Enter the report ID to retrieve the details.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e

Text

Required

You can retrieve this using the action List Reports.

Report Type

Enter the report type.

Text

Required

Allowed values:

basic, advanced

Report ID

Enter the report ID to retrieve the run logs.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e.

Text

Required

You can retrieve this using the action List Reports.

Type

Enter the report type.

Text

Required

Allowed values:

basic, advanced

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Task ID

Enter the ID for the parse IOCs task to retrieve the result.

Example:

345

Integer

Required

You can retrieve this using the action Create Task to Parse IOCs.

Rule ID

Enter the rule ID to get details.

Example:

f44312d8-452a-4c7e-93b5-39af07d642db

Text

Required

You can retrieve this using the action List Rules.

Saved Search ID

Enter the ID of the saved search to get details.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e

Text

Required

You can retrieve this using the action List Saved Searches.

Task ID

Enter the unique ID of a task to retrieve the details.

Example:

e536dc79-9d34-4944-855a-64f832568b8c

Text

Required

You can retrieve this using the action List Tasks in Threat Data Object.

Task ID

Enter the ID of a parse IOCs task to retrieve the status.

Example:

345

Integer

Required

Fields

Enter the value to retrieve specific details about the task.

Text

Optional

Allowed values:

status, updated, queue_name, actor_name

Object ID

Enter the ID of an object to retrieve an overview of the associated tasks.

Example:

00a26ec9-1490-4cd5-a659-c25525ffc238

Text

Optional

You can retrieve this using the action List Threat Data.

Query

Enter the query to search for a task type.

Example:

indicator

Text

Optional

Priority

Enter the priority of the tasks.

Text

Optional

Allowed values:

high, medium, low

Additional Params

Enter the additional parameters to retrieve the task overview.

Key Value

Optional

Allowed keys:

type, status, created_by, assignee, deadline_gte, deadline_lte

Object ID

Enter the ID of the object to retrieve the details.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of the object to retrieve the details.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

User ID

Enter the user ID to retrieve the details.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Users.

User Group ID

Enter the user group ID to get details.

Example:

cf0e148b-5f7a-4f05-8f4d-081fa1743231

Text

Required

You can retrieve this using the action List User Groups.

Widget Slug

Enter the widget slug to get details.

Example:

ioc_vs_allowed

Text

Required

You can retrieve this using the action List Widgets.

Created From

Enter the timestamp in epoch to get data from.

Example:

1650375753

Integer

Optional

Created Until

Enter the timestamp in epoch to get data until.

Example:

1650375753

Integer

Optional

Page Size

Enter the number of records to retrieve on each page.

Integer

Optional

File Path

Enter the file path for the data to be imported.

Text

Optional

Allowed values:

.json, .xml, .csv, url

For more information, see Cyware Intel Exchange API documentation.

Collection ID

Enter the ID of the collection to which the file is imported.

Example:

603dd2cf-2c3e-4a6b-8200-505d3586df1f

Text

Optional

You can retrieve this using the action List All Collections.

Version

If the file format is STIX1 or STIX2, enter the STIX version.

Text

Optional

Allowed values:

1.0, 2.0, 2.1

Default value:

2.1

File Format

Enter the format for the import.

Text

Optional

Allowed values:

cy-csv, misp, openioc, stix1, stix2, stix20, stix1url, and csv-recorded-future

Default value:

stix2

URL Type

Enter URL information if the file format is STIX1 URL.

Example:

{\"id\": \"url\",\"name\": \"stix 1.x url\",\"type\": \"url\",\"accept\": \"url\",\"slug\": \"stix1url\"}

Key Value

Optional

STIX1 URL

Enter the URL to specify the location of a STIX 1.x file when the file format is stix1url.

Example:

https://www.exampledomain/sites/default/files/2023-12/aa23-335a.stix__0.xml

Text

Optional

Source ID

Enter the ID of the source to ingest the data in.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Sources.

Collection ID

Enter the ID of the collection to ingest the data into.

Example:

777775a5-5ad2-4239-b5eb-aba1e48f2113

Text

Required

You can retrieve this using the action List Source Collections.

Source Type

Enter the type of the source to ingest the data.

Example:

custom_stix_sources

Text

Required

Bundle

Enter the STIX bundle to ingest the data. Ensure that this is a valid STIX bundle.

Example:

$JSON[{ \"id\": \"bundle--eaa3295e-34bc-432b-9deb-111110fff237\", \"type\": \"bundle\", \"objects\": [ { \"type\": \"attack-pattern\", \"spec_version\": \"2.1\", \"id\": \"attack-pattern--0c7b5b88-8ff7-4a4d-aa9d-feb398cd0061\", \"name\": \"spear phishing\", \"confidence\": 0, \"revoked\": false } ] }]

Any

Required

Imported Timestamp

Enter the imported timestamp.

Example:

1436253893

Integer

Optional

Object ID

Enter the ID of a threat data object to retrieve actions.

Example:

916e0c84-61a6-412b-a25c-e65d6bcdc96b

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Text

Optional

Allowed values:

attack pattern, campaign, course of action, grouping, and more.

App Type

Enter the type of the app that performed the action.

Example:

ctix

Text

Optional

Action Type

Enter the type of actions to retrieve.

Text

Optional

Allowed values:

manual, automatic

Page Number

Enter the page number to retrieve actions.

Example:

1

Integer

Optional

Default value:

1

Page Size

Enter the number of actions to retrieve on each page.

Example:

3

Integer

Optional

Default value:

10

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Sort By

Enter the sorting order for collections based on their creation time.

Text

Optional

Allowed values:

- created to sort in descending order, and created to sort in ascending order

Is Active

Choose true to retrieve active collections.

Boolean

Optional

Default value:

true

Created After

Enter the start time in EPOCH format to retrieve collections created after this timestamp.

Example:

1716958173

Integer

Optional

Created Before

Enter the end time in EPOCH format to retrieve collections before this timestamp.

Example:

1717012366

Integer

Optional

Collection Type

Enter the type of collection.

Text

Optional

Allowed values:

inbox, polling

Query

Enter a keyword to search collections based on the title.

Example:

custom

Text

Optional

Nominal

Choose true to retrieve collections with the ID and name of the collections.

Boolean

Optional

Default value:

false

Additional Params

Enter any additional params to pass with the request.

Key Value

Optional

Allowed values:

polling, inbox, is_editable, has_subscribed, created, marking_config, default_marking_definition

Page Number

Enter the page number to retrieve tags of a specific page.

Integer

Optional

Default value:

1

Page Size

Enter the number of items to retrieve on each page.

Integer

Optional

Default value:

10

Created After

Enter the start time in EPOCH format to filter tags created after this timestamp.

Example:

1716958173

Integer

Optional

Created Before

Enter the end time in EPOCH format to filter tags created before this timestamp.

Example:

1717012366

Integer

Optional

Created By

Enter the ID of the creator to filter tags.

Example:

5f51be4c-c2cf-4dac-9cee-7e289205143c

Text

Optional

You can retrieve this using the action List Users.

Modified From

Enter the modified from time in EPOCH format to filter tags.

Example:

1705363200

Integer

Optional

Modified To

Enter the modified time in EPOCH format to filter tags.

Example:

1706745599

Integer

Optional

Query

Enter the query to search.

Example:

tag-name

Text

Optional

Tag Type

Enter the tag type to filter tags.

Text

Optional

Allowed values:

automated and manual

Additional Params

Enter any additional parameters to pass with the payload.

Example:

'created_from': '1628361607'

Key Value

Optional

Page Number

Enter the page number to retrieve the results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of records to retrieve on each page.

Integer

Optional

Default value:

10

Retrieve Full List

Choose true to retrieve all API feed sources without pagination.

Boolean

Optional

Default value:

false

Query

Enter a query to filter intel feeds by. This is a free-text match.

Text

Optional

Is Active

Choose true to retrieve active API feed sources.

Boolean

Optional

By default, all available feed sources are retrieved.

Object ID

Enter the unique ID of an object.

Example:

dbd48dae-3505-4ace-9c0e-e617d9ccc269

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the type of the object.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Page Size

Enter the number of records to return on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results.

Integer

Optional

Default value:

1

Layout

Enter the layout to return the responses.

Example:

overview

Text

Optional

Tool

Enter the enrichment tool ID to return the responses.

Example:

03694ab0-0e9f-45f4-a4c4-2b6eaedd4803

Text

Optional

You can retrieve this using the action List Integrations.

Object Type

Enter the object type to return the responses.

Example:

indicator

Text

Optional

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the object ID to return the responses.

Example:

03694ab0-0e9f-45f4-a4c4-2b6eaedd4803

Text

Optional

You can retrieve this using the action List Threat Data.

Query

Enter the keyword or integration name to search the tool.

Example:

abuse

Text

Optional

Category

Enter the category to filter integrations by.

Example:

security_information_and_event_managment_system, threat_intelligence_enrichment, endpoint_detection_response, security_orchestration_automation_response, cyware_product

Text

Optional

Is Active

Choose true to retrieve active integrations.

Boolean

Optional

Default value:

false

Nominal

Choose true to retrieve the ID, title, and slug name of the tools.

Boolean

Optional

Default value:

false

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Additional Params

Enter any additional parameters to pass.

Example:

q, nominal

Key Value

Optional

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of items to retrieve on each page.

Integer

Optional

Default value:

10

Component

Enter the component name to retrieve the intel history for that specific source.

Text

Optional

Allowed values:

import-intel, openapi, rss_feed, rule, stix-form, and more

Default value:

quick-add-intel

Filter Query

Enter a query to search for an intel based on the title.

Example:

enter \"ip\" to list all intel items containing \"ip\" in the title.

Text

Optional

Intel Status

Enter a value to retrieve intel based on the status.

Text

Optional

Allowed values:

pending, processing, created, draft, failed, and published

Additional Params

Enter the additional parameters to filter the response.

Example:

'created_from': '1628361607'

Key Value

Optional

Allowed keys:

created_from, created_to, published_from, q, sort, published_to, created_by_id, status, page_size, page, and component.

Query Text

Enter the query to search for an IOC type.

Example:

art

Text

Optional

Object Type

Enter the object type.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the ID of a threat data object.

Example:

09730695-2f63-4a1c-a0fb-a042689588d5

Text

Required

You can retrieve this using the action List Threat Data.

Page Number

Enter the page number to retrieve the kill chain phases.

Example:

2

Integer

Optional

Default value:

1

Page Size

Enter the number of records to retrieve on each page.

Example:

4

Optional

Default value:

10

Object ID

Enter the ID of a threat data object to retrieve the associated notes.

Example:

916e0c84-61a6-412b-a25c-e65d6bcdc96b

Text

Required

You can retrieve this using the action List Threat Data.

Page Number

Enter the page number to go to a specific page.

Integer

Optional

Default value:

1

Page Size

Enter the number of items to retrieve on each page.

Integer

Optional

Default value:

10

Additional Params

Enter any additional parameters to pass with the payload.

Example:

created_from: 1628361607

Key Value

Optional

Object Type

Enter the object type.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the ID of a threat data object.

Example:

09730695-2f63-4a1c-a0fb-a042689588d5

Text

Required

You can retrieve this using the action List Threat Data.

Page Size

Enter the number of records to retrieve on each page.

Example:

4

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve the details.

Integer

Optional

Default value:

1

Additional Params

Enter additional parameters to list published collections.

Key Value

Optional

Object ID

Enter the object ID to get details of.

Example:

eee70fcc-a23b-4d3b-a968-fc78b121d112

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Sources

Enter the list of IDs of the sources to filter the results by.

Example:

$LIST['7a7ac2cf-51e9-48fe-a2a8-32e7a684cc33']

List

Optional

Page Number

Enter the page number of the response to fetch.

Integer

Optional

Default value:

1

Page Size

Enter the number of items to return on each page.

Integer

Optional

Default value:

10

Additional Data

Enter the additional data to pass to the query.

Example:

{'page_size': 10}

Key Value

Required

Type

Enter the report type to query.

Text

Required

Allowed values:

basic, advanced

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Repeat Type

Enter the frequency of the report run schedule.

Text

Optional

Allowed values:

daily, weekly, and monthly

Shared Type

Enter the visibility of the reports.

Text

Optional

Allowed values:

private, global

Created By

Enter the ID of the user who created the reports.

Text

Optional

You can retrieve this using the action List Users.

Modified By

Enter the ID of the user who modified the reports.

Text

Optional

You can retrieve this using the action List Users.

Additional Params

Enter any additional parameters to pass with the request.

Key Value

Optional

Allowed values:

created_from, created_to, modified_from, modified_to and more.

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of records to return on each page.

Integer

Optional

Default value:

10

Source

Enter a comma-separated list of source IDs to filter rules with matching source.

Example:

98230f-0e9f-45f4-a4c4-sdv89023hb3423,98230f-0e9f-45f4-a4c4-sdv89023hb3424

Text

Optional

You can retrieve this using the action List Sources.

Created By ID

Enter the Intel Exchange user ID to filter rules created by that user.

Example:

03694ab0-0e9f-45f4-a4c4-2b6eaedd4803

Text

Optional

Status

Enter the status of the rules.

Text

Optional

Allowed values:

draft, active, inactive

By default, rules with all statuses are retrieved.

Last Active Till

Enter the timestamp in epoch to filter successfully executed rules until the given value.

Example:

1579289600

Integer

Optional

Last Active From

Enter the timestamp in epoch to filter successfully executed rules from the given value.

Example:

1579289600

Integer

Optional

Created From

Enter the timestamp in epoch to filter rules created from the given timestamp.

Example:

1579289600

Integer

Optional

Created Until

Enter the timestamp in epoch to filter rules created until the given timestamp.

Example:

1579289600

Integer

Optional

Return Minimal Response

Choose true to return the minimal response. Choose false to retrieve complete details of the objects.

Boolean

Optional

Default value:

true

Is Manual Run

Choose true to retrieve rules that are configured for manual execution only.

Key Value

Optional

Default value:

false

Version

Enter the saved result set version.

Text

Optional

Allowed values:

v2 and v3

Default value:

v3

Label Name

Enter the tag name to filter data. All data associated with the passed tag will be returned.

Text

Optional

Published From

Enter the start of the published time range in epoch format to retrieve data from this time.

Example:

1649406695

Integer

Optional

Published Till

Enter the end of the published time range in epoch format to retrieve data up to this time.

Example:

1650265251

Integer

Optional

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of records to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Search Query

Enter the query to search for a saved search.

Example:

malware

Text

Optional

Additional Params

Enter the extra parameters to list saved searches.

Key Value

Optional

Allowed values:

page, page_size, and query

Source

Enter the unique ID of the source to retrieve associated collections.

Example:

5430d746-61ce-4ef7-b1d9-5c03446eca9a

Text

Optional

You can retrieve this using the action List Sources.

Nominal

Choose true to apply Cyware Query Language (CQL).

Boolean

Optional

CQL Query

Enter the CQL query to filter the source collections.

Str

Optional

Page Number

Enter the page number to retrieve collections.

Integer

Optional

Default value:

1

Page Size

Enter the number of collections to retrieve on each page.

Integer

Optional

Default value:

10

Fetch Imported Collections

Choose true to fetch imported collections.

Boolean

Optional

Default value:

true

Object Type

Enter the object type to retrieve source information.

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Object ID

Enter the object ID to retrieve source information.

Example:

09730695-2f63-4a1c-a0fb-a042689588d5

Text

Required

You can retrieve this using the action List Threat Data.

Page Number

Enter the page number to retrieve sources.

Example:

2

Integer

Optional

Default value:

1

Page Size

Enter the number of records to retrieve on each page.

Example:

4

Integer

Optional

Default value:

1

Object ID

Enter the object ID to retrieve external references.

Example:

5e7e2c2d-3e3d-4e7f-a6b3-6b3e6b3e6b3e

Text

Required

You can retrieve this using the action List Threat Data.

Object Type

Enter the object type.

Example:

indicator

Text

Required

Allowed values:

indicator, vulnerability, malware, campaign, threat-actor, intrusion-set, attack-pattern, incident, course-of-action, identity, tool, infrastructure, location, malware-analysis, custom-object, note, observed-data, opinion, report

Page Size

Enter the number of results to retrieve on each page.

Integer

Optional

Default value:

10

Page Number

Enter the page number to retrieve results from.

Integer

Optional

Default value:

1

Source Type

Enter a comma-separated list of the source type name to filter sources based on the type.

Example:

custom_stix_sources,web_scrapper

Text

Optional

Nominal

Choose true to apply Cyware Query Language (CQL).

Boolean

Optional

Default value:

false

Page Number

Enter the page number to retrieve sources from.

Integer

Optional

Default value:

1

Page Size

Enter the number of sources to be retrieved on each page.

Integer

Optional

Default value:

10