Sign in

v1

latestOpenAPI 3.1.12026-07-242899061.7 MB
Soar

Triage multiple IOC entities

Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores.

post/triage/contexts/{context_name}

Path parameters

context_namestring required

The context in which to evaluate the given entities. Available contexts can be fetched using the separate endpoint.

Query parameters

format'phantom'

Allows for an output format suitable for Splunk SOAR (previously "Phantom"). If no value is given, the default format (used in the Enrichment endpoint) will be used.

metadataboolean

Include metadata in response. Annotates the response with additional metadata explaining the response data elements.

thresholdinteger

Determines which risk score should be used to deem an entity risky. Each context has its own default value and depends on the context.

threshold_type'min' | 'max'

Determines if the set of entities are deemed risky if a single entity is above the threshold (max) or if all entities have to be above the threshold (min). The default is specified by the context but is max for all contexts currently defined.

Request body

ipstring[]

IPs to enrich

domainstring[]

Domains to enrich

urlstring[]

URLs to enrich

hashstring[]

Hashes to enrich

vulnerabilitystring[]

Vulnerabilities to enrich

companybydomainstring[]

Companies to enrich, identified by their domain name.

Example request

{
  "ip": [
    "8.8.8.8"
  ],
  "domain": [
    "google.com"
  ],
  "url": [
    "https://phishing-example.net"
  ],
  "hash": [
    "458d1f83e087d0f613c505086538436d"
  ],
  "vulnerability": [
    "CVE-2021-44228"
  ],
  "companybydomain": [
    "recordedfuture.com"
  ]
}

Response

output

Example response

{
  "data": {
    "triage": {
      "threshold_type": "max",
      "context": "c2",
      "threshold": 80,
      "scores": {
        "max": 20
      }
    },
    "results": [
      {
        "risk": {
          "score": 15,
          "level": 1,
          "rule": {
            "summary": [
              {
                "level": 1,
                "count": 3
              }
            ],
            "mostCritical": "Historically Reported Spam or Unwanted Content",
            "count": 3,
            "maxCount": 52
          }
        },
        "entity": {
          "id": "idn:google.com",
          "name": "google.com",
          "type": "InternetDomainName"
        }
      }
    ]
  },
  "counts": {
    "returned": 1,
    "total": 1000
  }
}