Airlock Digital
This Connector integrates Airlock Digital with Swimlane Turbine.
Prerequisites
To set up the asset, you need the following:
- URL
- API Key
Capabilities
This Connector provides the following capabilities:
- Add Hash to Application
- Add Hash to Blocklist
- Agent Find
- Lookup Hash
- Move Agent to Group
- Remove Hash from all Applications
- Remove Hash from All Blocklists
- Remove Hash from Application by ID
- Remove Hash from Blocklist by ID
- Retrieve Execution History Logs
- Retrieve Execution History with Filters
- Retrieve OTP
- Retrieve Policy of Group
- Revoke OTP
Notes
Additional Documentation
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
x-apikey | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Hash to Application
Add a hash value into an Application Capture. The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.
Endpoint
- URL: /v1/hash/application/add
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
applicationid | string | Optional | Unique identifier |
hashes | array | Optional | Parameter for Add Hash to Application |
Input Example
{"json_body":{"applicationid":"1567080520","hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Add Hash to Blocklist
Adds a single or multiple hashes to a blocklist ID
Endpoint
- URL: /v1/hash/blocklist/add
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
blocklistid | string | Optional | Unique identifier |
hashes | array | Optional | Parameter for Add Hash to Blocklist |
Input Example
{"json_body":{"blocklistid":"1567080520","hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Agent Find
Returns a listing of computers and their details within Airlock.
Endpoint
- URL: /v1/agent/find
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
hostname | string | Optional | Name of the resource |
agentid | string | Optional | Unique identifier |
username | string | Optional | Name of the resource |
domain | string | Optional | Parameter for Agent Find |
groupid | string | Optional | Unique identifier |
ip | string | Optional | Parameter for Agent Find |
os | string | Optional | Parameter for Agent Find |
status | number | Optional | Status value |
Input Example
{"hostname":"Example Name","agentid":"string","username":"Example Name","domain":"string","groupid":"string","ip":"string","os":"string","status":123}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
response | object | Output field: response |
response.agents | object | Output field: response.agents |
response.agents.agentid | string | Unique identifier |
response.agents.hostname | string | Name of the resource |
response.agents.username | string | Name of the resource |
response.agents.domain | string | Output field: response.agents.domain |
response.agents.groupid | string | Unique identifier |
response.agents.lastcheckin | string | Output field: response.agents.lastcheckin |
response.agents.ip | string | Output field: response.agents.ip |
response.agents.os | string | Output field: response.agents.os |
response.agents.status | number | Status value |
response.agents.freespace | string | Output field: response.agents.freespace |
response.agents.clientversion | string | Output field: response.agents.clientversion |
response.agents.policyversion | string | Output field: response.agents.policyversion |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success","response":{"agents":{}}}}
Lookup Hash
Query the Airlock file repository by specifying the hash value(s) you would like to lookup.
Endpoint
- URL: /v1/hash/query
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
hashes | array | Optional | Parameter for Lookup Hash |
Input Example
{"json_body":{"hashes":["1F15E65E742C2F93C0BC4A765621C37F1A82837B74E35FFFF051765A1F8657D3","41526AFF3HFA2F93C0BC4A765621C34941JH1231J4E35FF222KAN1029418AJ05"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Move Agent to Group
Move an agent within Airlock by specifying the 'agentid' you wish to move and the destination 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint and unique 'agentid' parameters can be obtained from the /agent/find endpoint.
Endpoint
- URL: /v1/agent/move
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
agentid | string | Optional | Unique identifier |
groupid | string | Optional | Unique identifier |
Input Example
{"json_body":{"agentid":"5a57f007-214c-4604-960e-1706f3bf10cd","groupid":"a2d3b733-1261-4449-b91e-33f6fa59abbe"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Remove Hash from all Applications
Remove the specified hashes from all application captures, without specifying a specific application ID.
Endpoint
- URL: /v1/hash/application/remove/all
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
hashes | array | Optional | Parameter for Remove Hash from all Applications |
Input Example
{"json_body":{"hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Remove Hash from All Blocklists
Remove the specified hashes from all blocklists, without specifying a specific blocklist ID.
Endpoint
- URL: /v1/hash/blocklist/remove/all
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
hashes | array | Optional | Parameter for Remove Hash from All Blocklists |
Input Example
{"json_body":{"hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Remove Hash from Application by ID
Remove a hash value from an Application Capture. The hash value must already exist within the Airlock repository, only SHA256 hashes are supported.
Endpoint
- URL: /v1/hash/application/remove
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
applicationid | string | Optional | Unique identifier |
hashes | array | Optional | Parameter for Remove Hash from Application by ID |
Input Example
{"json_body":{"applicationid":"1567080520","hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Remove Hash from Blocklist by ID
Remove a single or multiple hashes from blocklist using ID.
Endpoint
- URL: /v1/hash/blocklist/remove
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
blocklistid | string | Optional | Unique identifier |
hashes | array | Optional | Parameter for Remove Hash from Blocklist by ID |
Input Example
{"json_body":{"blocklistid":"1567080520","hashes":["a0ecd6e9d2430cbcb9aaff4d93953d13ad9dd0b16c113f49be02ae6542d7a0ce","152bb373088a420532fb38851084b984040f9d42e5504cd9772ecf6f125575f3"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Retrieve Execution History Logs
Retrieves Execution History logs.
Endpoint
- URL: /v1/logging/exechistories
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
type | array | Optional | Type of the resource |
checkpoint | string | Optional | Parameter for Retrieve Execution History Logs |
policy | array | Optional | Parameter for Retrieve Execution History Logs |
Input Example
{"json_body":{"type":[2,3,5,8],"checkpoint":"601d275487bacb01e3470713","policy":["Workstations Adelaide","Servers London"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
response | object | Output field: response |
response.exechistories | array | Output field: response.exechistories |
response.exechistories.checkpoint | string | Output field: response.exechistories.checkpoint |
response.exechistories.type | number | Type of the resource |
response.exechistories.username | string | Name of the resource |
response.exechistories.hostname | string | Name of the resource |
response.exechistories.netdomain | string | Output field: response.exechistories.netdomain |
response.exechistories.filename | string | Name of the resource |
response.exechistories.ppolicy | string | Output field: response.exechistories.ppolicy |
response.exechistories.policyname | string | Name of the resource |
response.exechistories.policyver | string | Output field: response.exechistories.policyver |
response.exechistories.commandline | string | Output field: response.exechistories.commandline |
response.exechistories.publisher | string | Output field: response.exechistories.publisher |
response.exechistories.pprocess | string | Output field: response.exechistories.pprocess |
response.exechistories.sha256 | string | Output field: response.exechistories.sha256 |
response.exechistories.datetime | string | Time value |
Output Example
{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"error":"Success","response":{"exechistories":[]}}}
Retrieve Execution History with Filters
Returns Execution History with filters.
Endpoint
- URL: /v1/getexechistory
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
category | string | Optional | Parameter for Retrieve Execution History with Filters |
Datefrom | string | Optional | Parameter for Retrieve Execution History with Filters |
Dateto | string | Optional | Parameter for Retrieve Execution History with Filters |
hostname | string | Optional | Name of the resource |
contains | array | Optional | Parameter for Retrieve Execution History with Filters |
username | string | Optional | Name of the resource |
Netdomain | string | Optional | Parameter for Retrieve Execution History with Filters |
Filename | string | Optional | Name of the resource |
Ppolicy | string | Optional | Parameter for Retrieve Execution History with Filters |
Policyname | string | Optional | Name of the resource |
Policyver | string | Optional | Parameter for Retrieve Execution History with Filters |
Commandline | string | Optional | Parameter for Retrieve Execution History with Filters |
Publisher | string | Optional | Parameter for Retrieve Execution History with Filters |
Pprocess | string | Optional | Parameter for Retrieve Execution History with Filters |
Sha256 | string | Optional | Parameter for Retrieve Execution History with Filters |
Limit | string | Optional | Parameter for Retrieve Execution History with Filters |
Input Example
{"json_body":{"category":"blocked","Datefrom":"2019-10-05","Dateto":"2019-10-14","hostname":"desktop-g3g","contains":["hostname"],"username":"string","Netdomain":"","Filename":"","Ppolicy":"","Policyname":"","Policyver":"","Commandline":"","Publisher":"","Pprocess":"","Sha256":"","Limit":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
hostname | string | Name of the resource |
username | string | Name of the resource |
netdomain | string | Output field: netdomain |
filename | string | Name of the resource |
ppolicy | string | Output field: ppolicy |
datetime | string | Time value |
type | string | Type of the resource |
policyname | string | Name of the resource |
policyver | string | Output field: policyver |
commandline | string | Output field: commandline |
publisher | string | Output field: publisher |
pprocess | string | Output field: pprocess |
sha256 | string | Output field: sha256 |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"hostname":"DESKTOP-G3GJO5S","username":"admin","netdomain":"DESKTOP-G3GJO5S","filename":"C:\\Users\\admin\\Downloads\\hellovbs.vbs","ppolicy":"Canada","datetime":"2019-10-08 15:58:55 +0000 UTC","type":"blocked","policyname":"Workstation Audit","policyver":"v22","commandline":"","publisher":"Not Signed","pprocess":"cmd.exe","sha256":"3c...
Retrieve OTP
Retrieve an OTP code for a particular computer (agent) within Airlock. You must specify the OTP 'duration' and unique 'agentid' to retrieve the code. Unique 'agentid' parameters can be obtained from the /agent/find endpoint.
Endpoint
- URL: /v1/otp/retrieve
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
duration | string | Optional | Parameter for Retrieve OTP |
agentid | string | Optional | Unique identifier |
purpose | string | Optional | Parameter for Retrieve OTP |
Input Example
{"json_body":{"duration":"15m","agentid":"5a57f007-214c-4604-960e-1706f3bf10cd","purpose":"testing"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
response | object | Output field: response |
response.otpcode | string | Output field: response.otpcode |
response.otpid | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success","response":{"otpcode":"12847518751","otpid":"1622521647"}}}
Retrieve Policy of Group
Retrieve the policy applied to a group by specifying Target 'groupid'. Unique 'groupid' parameters can be obtained from the /group endpoint.
Endpoint
- URL: /v1/group/policies
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
groupid | string | Optional | Unique identifier |
Input Example
{"json_body":{"groupid":"a2d3b733-1261-4449-b91e-33f6fa59abbe"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
response | object | Output field: response |
response.groupid | string | Unique identifier |
response.name | string | Name of the resource |
response.policyver | string | Output field: response.policyver |
response.parent | string | Output field: response.parent |
response.hashdb_ver | string | Output field: response.hashdb_ver |
response.agentstopcode | string | Output field: response.agentstopcode |
response.auditmode | number | Output field: response.auditmode |
response.enable_notifications | number | Output field: response.enable_notifications |
response.notification_message | string | Response message |
response.poll_time | number | Time value |
response.trusted_upload | number | Output field: response.trusted_upload |
response.pslockdown | number | Output field: response.pslockdown |
response.script_enabled | number | Output field: response.script_enabled |
response.modreload | number | Output field: response.modreload |
response.reflection | number | Output field: response.reflection |
response.batch | number | Output field: response.batch |
response.powershell | number | Output field: response.powershell |
response.command | number | Output field: response.command |
response.vbscript | number | Output field: response.vbscript |
response.javascript | number | Output field: response.javascript |
response.windowsinstaller | number | Output field: response.windowsinstaller |
Output Example
{"error":"string","response":{"groupid":"string","name":"Example Name","policyver":"string","parent":"string","hashdb_ver":"string","agentstopcode":"string","auditmode":123,"enable_notifications":123,"notification_message":"string","poll_time":123,"trusted_upload":123,"pslockdown":123,"script_enabled":123,"modreload":123,"reflection":123}}
Revoke OTP
Revoke an active OTP code by specifying the OTP ID.
Endpoint
- URL: /v1/otp/revoke
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
otpid | string | Optional | Unique identifier |
Input Example
{"json_body":{"otpid":"1622521647"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
Output Example
{"status_code":200,"response_headers":{"Content-Type":"application/json","Date":"Sat, 02 Sep 2023 04:05:44 GMT","Content-Length":"51"},"reason":"OK","json_body":{"error":"Success"}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Length | The length of the response body in bytes | 51 |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Sat, 02 Sep 2023 04:05:44 GMT |