v1

latestOpenAPI 3.1.12026-07-242899061.7 MB

Soar

Fetch risk information for a set of indicators

Retrieve risk scores, triggered rules, and evidence for up to 1,000 indicators across six entity types in a single batch call.

post/enrichment

Query parameters

metadataboolean

Include metadata in response. Annotates the response with additional metadata explaining the response data elements.

Request body

ipstring[]

IPs to enrich

domainstring[]

Domains to enrich

urlstring[]

URLs to enrich

hashstring[]

Hashes to enrich

vulnerabilitystring[]

Vulnerabilities to enrich

companybydomainstring[]

Companies to enrich, identified by their domain name.

Example request

{
  "ip": [
    "8.8.8.8"
  ],
  "domain": [
    "google.com"
  ],
  "url": [
    "https://phishing-example.net"
  ],
  "hash": [
    "458d1f83e087d0f613c505086538436d"
  ],
  "vulnerability": [
    "CVE-2021-44228"
  ],
  "companybydomain": [
    "recordedfuture.com"
  ]
}

Response

output

Example response

{
  "data": {
    "results": [
      {
        "risk": {
          "score": 15,
          "level": 1,
          "rule": {
            "summary": [
              {
                "level": 1,
                "count": 3
              }
            ],
            "mostCritical": "Historically Reported Spam or Unwanted Content",
            "count": 3,
            "maxCount": 52
          }
        },
        "entity": {
          "id": "idn:google.com",
          "name": "google.com",
          "type": "InternetDomainName"
        }
      }
    ]
  },
  "counts": {
    "returned": 1,
    "total": 1000
  }
}