Analyst1

Analyst1 is a cybersecurity platform that provides advanced threat intelligence and analysis capabilities.

Analyst1 is a comprehensive threat intelligence platform that provides enriched data for security operations. This connector enables seamless integration with Swimlane Turbine, allowing users to perform batch checks, retrieve sensor configurations, and access detailed information on indicators, malware, and rules. By leveraging Analyst1's capabilities, Swimlane Turbine users can enhance their threat detection and response processes, streamline security workflows, and gain deeper insights into potential threats.

Prerequisites

Before you can use the Analyst1 connector for Turbine, you'll need access to the Analyst1 API. This requires the following:

HTTP Basic authentication using the following parameters:

URL: The endpoint URL for accessing Analyst1 services.

Email Address: Your registered email address for Analyst1 account access.

Password: The password associated with your Analyst1 account.

Asset Setup

The asset for this Connector requires the following inputs:

Username

Password

Capabilities

This Connector provides the following capabilities:

Get Batch Check

Get Config File For Sensor

Get Indicators

Get Indicator by ID

Get Indicators For Sensor

Get Malware by ID

Get Rules By Sensor ID

Get Sensors By ID

Get Taskings By Sensor ID

Indicator Query

Search Malware

Submit Evidence

Notes

For more information on Analyst1 is found at: Analyst1 Main Site

API Documentation Link

Analyst1 API Documentation Link

Additional Documentation

Analyst1 Connector Documentation

Analyst1 API Documentation

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Email Address	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Batch Check

Perform a match operation on a collection of values across various entities in Analyst1, requiring specific parameters.

Endpoint

URL: /api/1_0/batchCheck

Method: GET

Input

Argument Name	Type	Required	Description
parameters.values	array	Required	The values to search for separated by commas.

Input Example

{"parameters":{"values":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.searchedValue	string	Value for the parameter
results.matchedValue	string	Value for the parameter
results.id	number	Unique identifier
results.entity	object	Result of the operation
results.entity.key	string	Result of the operation
results.entity.title	string	Result of the operation
results.type	object	Type of the resource
results.type.key	string	Type of the resource
results.type.title	string	Type of the resource
results.benign	boolean	Result of the operation
results.actor	array	Result of the operation
results.actor.id	number	Unique identifier
results.actor.title	string	Result of the operation
results.actor.akas	array	Result of the operation
results.malware	array	Result of the operation
results.malware.id	number	Unique identifier
results.malware.title	string	Result of the operation
results.malware.akas	array	Result of the operation
results.system	array	Result of the operation
results.system.id	number	Unique identifier
results.system.title	string	Result of the operation
results.system.akas	array	Result of the operation

Output Example

{"results":[{"searchedValue":"string","matchedValue":"string","id":123,"entity":{},"type":{},"benign":true,"actor":[],"malware":[],"system":[]}]}

Get Config File For Sensor

Retrieve the current configuration file for a specified sensor in Analyst1 using its unique identifier.

Endpoint

URL: /api/1_0/sensors/{{id}}/taskings/config

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get Config File For Sensor action

Input Example

{"path_parameters":{"id":7671}}

Output

Parameter	Type	Description
file	object	Output field: file
file.file	string	Output field: file.file
file.file_name	string	Name of the resource
file.contentType	string	Type of the resource

Output Example

{"file":{"file":"string","file_name":"Example Name","contentType":"text/plain"}}

Get Indicator By ID

Retrieve detailed information for a specific indicator in Analyst1 using the unique identifier 'id'.

Endpoint

URL: /api/1_0/indicator/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Requested resource id

Input Example

{"path_parameters":{"id":983}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
expand	string	Output field: expand
type	string	Type of the resource
value	object	Value for the parameter
value.name	string	Name of the resource
value.classification	string	Value for the parameter
description	object	Output field: description
description.name	string	Name of the resource
description.classification	string	Output field: description.classification
activityDates	array	Output field: activityDates
activityDates.date	string	Date value
activityDates.classification	string	Output field: activityDates.classification
reportedDates	array	Output field: reportedDates
reportedDates.date	string	Date value
reportedDates.classification	string	Output field: reportedDates.classification
targets	array	Output field: targets
targets.name	string	Name of the resource
targets.id	number	Unique identifier
targets.classification	string	Output field: targets.classification
attackPatterns	array	Output field: attackPatterns
attackPatterns.name	string	Name of the resource
attackPatterns.id	number	Unique identifier
attackPatterns.classification	string	Output field: attackPatterns.classification
actors	array	Output field: actors

Output Example

{"expand":"string","type":"string","value":{"name":"Example Name","classification":"string"},"description":{"name":"Example Name","classification":"string"},"activityDates":[{"date":"2024-01-01T00:00:00Z","classification":"string"}],"reportedDates":[{"date":"2024-01-01T00:00:00Z","classification":"string"}],"targets":[{"name":"Example Name","id":123,"classification":"string"}],"attackPatterns":[{"name":"Example Name","id":123,"classification":"string"}],"actors":[{"name":"Example Name","id":123,...

Get Indicators

Browse and list various indicators from Analyst1 for further analysis.

Endpoint

URL: /api/1_0/indicator

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	number	Optional	Parameters for the Get Indicators action
parameters.pageSize	number	Optional	Parameters for the Get Indicators action
parameters.descSort	boolean	Optional	Parameters for the Get Indicators action
parameters.sortBy	string	Optional	Parameters for the Get Indicators action
parameters.type	string	Optional	Parameters for the Get Indicators action
parameters.benign	boolean	Optional	Parameters for the Get Indicators action
parameters.tasked	boolean	Optional	Parameters for the Get Indicators action
parameters.status	string	Optional	Parameters for the Get Indicators action
parameters.tlp	string	Optional	Parameters for the Get Indicators action
parameters.verified	boolean	Optional	Parameters for the Get Indicators action
parameters.searchTerm	string	Optional	Parameters for the Get Indicators action
parameters.indicatorValueOnlySearch	boolean	Optional	Parameters for the Get Indicators action
parameters.sources	array	Optional	Parameters for the Get Indicators action
parameters.expand	string	Optional	Parameters for the Get Indicators action

Input Example

{"parameters":{"page":1,"pageSize":10,"descSort":true,"sortBy":"id","type":"domain","benign":true,"tasked":true,"status":"aab","tlp":"UNDETERMINED","verified":true,"searchTerm":"Description","indicatorValueOnlySearch":true,"sources":[301,302],"expand":"sources"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.expand	string	Result of the operation
results.links	boolean	Result of the operation
results.id	number	Unique identifier
results.type	string	Type of the resource
results.value	object	Value for the parameter
results.value.name	string	Name of the resource
results.value.classification	string	Value for the parameter
results.status	string	Status value
results.tlp	string	Result of the operation
pageSize	number	Output field: pageSize
page	number	Output field: page
totalResults	number	Result of the operation
totalPages	number	Output field: totalPages
links	boolean	Output field: links

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"results":[{}],"pageSize":1,"page":1,"totalResults":10,"totalPages":10,"links":true}}

Get Indicators For Sensor

Retrieve indicators associated with a specific sensor in Analyst1 using the sensor's unique identifier.

Endpoint

URL: /api/1_0/sensors/{{id}}/indicators

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Sensor ID
status	string	Optional	Indicator status filter. Allowed values are 'u' for Unable To Act, 'aab' for Awaiting Ability, 'aw' for Awaiting Intention, 'aal' for Awaiting Allowed, 'ar' for Awaiting Rule, & 'rc' for Rule Created.
type	string	Optional	Filter results based on Indicator type. Allowed values are 'domain', 'ip', 'file', 'email', 'string', 'ipv6', 'mutex', 'httpRequest', & 'url'.
value	string	Optional	Indicator value filter.
actor	number	Optional	actor query no Indicator actor filter.
verified	boolean	Optional	Indicator verified status filter. If absent, indicators with both verified and unverified status are included.
page	number	Optional	The requested results page, 1-indexed. If absent, the first page is always returned.
pagesize	number	Optional	The requested results per page. When present, must be between 1 and 100 inclusive.
descSort	boolean	Optional	The sort direction. True for a descending sort, false for a ascending sort.
sortBy	string	Optional	The value to sort results on. Allowed values are 'id', 'type', 'value', 'reportCount', 'benign', 'tasked'.
expand	string	Optional	Determines which child resources to return details for. Valid options are hitStats', 'sources', and 'enrichmentResults'. Selected options will be returned in the 'expand' response value

Input Example

{"json_body":{"status":"u","type":"domain","value":"value","actor":1,"verified":true,"page":1,"pagesize":10,"descSort":false,"sortBy":"id","expand":"sources"},"path_parameters":{"id":7671}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.expand	string	Result of the operation
results.type	string	Type of the resource
results.value	object	Value for the parameter
results.value.name	string	Name of the resource
results.value.classification	string	Value for the parameter
results.description	object	Result of the operation
results.description.name	string	Name of the resource
results.description.classification	string	Result of the operation
results.activityDates	array	Result of the operation
results.activityDates.date	string	Result of the operation
results.activityDates.classification	string	Result of the operation
results.reportedDates	array	Result of the operation
results.reportedDates.date	string	Result of the operation
results.reportedDates.classification	string	Result of the operation
results.targets	array	Result of the operation
results.targets.name	string	Name of the resource
results.targets.id	number	Unique identifier
results.targets.classification	string	Result of the operation
results.attackPatterns	array	Result of the operation
results.attackPatterns.name	string	Name of the resource
results.attackPatterns.id	number	Unique identifier
results.attackPatterns.classification	string	Result of the operation

Output Example

{"results":[{"expand":"string","type":"string","value":{},"description":{},"activityDates":[],"reportedDates":[],"targets":[],"attackPatterns":[],"actors":[],"malwares":[],"status":"active","hashes":[],"fileNames":[],"fileSize":{},"path":{}}],"pageSize":123,"page":123,"totalResults":123,"totalPages":123,"links":{"next":{"href":"string"},"first":{"href":"string"},"last":{"href":"string"},"self":{"href":"string"}}}

Get Malware by ID

Retrieve detailed information for a specific malware entry using its unique identifier in the Analyst1 platform.

Endpoint

URL: /api/1_0/malware/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get Malware by ID action

Input Example

{"path_parameters":{"id":301}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
links	boolean	Output field: links
id	number	Unique identifier
title	object	Output field: title
title.name	string	Name of the resource
title.classification	string	Output field: title.classification

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"links":true,"id":301,"title":{"name":"SpyNote","classification":"secretFvey"}}}

Get Rules By Sensor ID

Retrieve the set of rules associated with a specific sensor in Analyst1 using the sensor's unique identifier.

Endpoint

URL: /api/1_0/sensors/{{id}}/rules

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Sensor ID.
type	string	Optional	Rule type (i.e., sensor manufacturer). May be one of 'UNKNOWN', SNORT', 'MCAFEE_HIPS', 'PALO_ALTO', 'JUNIPER', 'YARA', SURICATA', 'SYMANTEC_PROXYSG',CISCO_ASA','TIPPING_POINT_IPS', 'TANIUM_BLOCKLIST', 'OTHER_AUTO'
exploitStage	number	Optional	Rule exploit stage. Lookup valid IDs in the /api/1_0/exploitStage endpoint.
source	string	Optional	Rule source. May be one of 'INTERNAL', 'AUTO_INDICATOR', 'PROOFPOINT_SNORT', 'PROOFPOINT_SURICATA'.
tlp	string	Optional	Rule traffic light protocol color. May be one of 'UNDETERMINED', 'CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', & 'RED'
page	number	Optional	The requested results page, 1-indexed. If absent, the first page is always returned.
pageSize	number	Optional	The requested results per page. When present, must be between 1 and 100 inclusive.
descSort	boolean	Optional	The sort direction. True for a descending sort, false for a ascending sort.
sortBy	string	Optional	The value to sort results on. Allowed values are 'id', 'type' (sensor manufacturer), 'source', 'context', 'exploitStage', 'tasked', 'taskedCount', 'tlp', 'sid', 'otherSid'

Input Example

{"json_body":{"type":"UNKNOWN","exploitStage":1,"source":"INTERNAL","tlp":"UNDETERMINED","page":1,"pageSize":10,"descSort":false,"sortBy":"id"},"path_parameters":{"id":7671}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.id	number	Unique identifier
results.name	string	Name of the resource
results.tlp	string	Result of the operation
results.source	string	Result of the operation
results.tlpJustification	string	Result of the operation
results.tlpCaveats	string	Result of the operation
results.tlpReevaluateDate	string	Result of the operation
results.ruleStatus	string	Status value
results.ruleDefinition	string	Result of the operation
results.ruleType	string	Type of the resource
results.tasked	boolean	Result of the operation
results.context	string	Result of the operation
results.exploitStage	object	Result of the operation
results.exploitStage.id	number	Unique identifier
results.exploitStage.name	string	Name of the resource
results.exploitStage.classification	string	Result of the operation
results.sid	string	Unique identifier
results.otherSid	string	Unique identifier
results.taskedCount	number	Result of the operation
results.actors	object	Result of the operation
results.actors.idNamePairs	array	Unique identifier
results.actors.idNamePairs.id	number	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 04 Oct 2023 15:49:27 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"close","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"","json_body":{"results":[{}],"pageSize":10,"page":1,"totalResults":4,"totalPages":1,"links":{"first":{},"last":{},"self":{}}...

Get Sensors By ID

Retrieve detailed information for a specific sensor by its ID in Analyst1.

Endpoint

URL: /api/1_0/sensors/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Sensor ID.

Input Example

{"path_parameters":{"id":7672}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
name	string	Name of the resource
logicalLocation	string	Output field: logicalLocation
org	object	Output field: org
org.id	number	Unique identifier
org.name	string	Name of the resource
type	string	Type of the resource
currentVersionNumber	number	Output field: currentVersionNumber
latestConfigVersionNumber	number	Output field: latestConfigVersionNumber
comments	array	Output field: comments
firmwareVersion	string	Output field: firmwareVersion
installDate	string	Date value
modelNumber	string	Output field: modelNumber
networkSpeed	string	Output field: networkSpeed
numIndicators	number	Output field: numIndicators
numSignatures	number	Output field: numSignatures
physicalAddress	string	Output field: physicalAddress
purchaseDate	string	Date value
serialNumber	number	Output field: serialNumber

Output Example

{"id":123,"name":"Example Name","logicalLocation":"string","org":{"id":123,"name":"Example Name"},"type":"string","currentVersionNumber":123,"latestConfigVersionNumber":123,"comments":["string"],"firmwareVersion":"string","installDate":"string","modelNumber":"string","networkSpeed":"string","numIndicators":123,"numSignatures":123,"physicalAddress":"string"}

Get Taskings By Sensor ID

Retrieve differences in taskings between the latest and a past version for a given sensor ID and version in Analyst1.

Endpoint

URL: /api/1_0/sensors/{{id}}/taskings/diff/{{version}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	The Sensor's ID
path_parameters.version	number	Required	One-based, past version of a Sensor

Input Example

{"path_parameters":{"id":7669,"version":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
version	number	Output field: version
latestVersion	number	Output field: latestVersion
indicatorsAdded	array	Output field: indicatorsAdded
indicatorsRemoved	array	Output field: indicatorsRemoved
rulesAdded	array	Output field: rulesAdded
rulesRemoved	array	Output field: rulesRemoved
links	object	Output field: links
links.self	object	Output field: links.self
links.self.href	string	Output field: links.self.href

Output Example

{"id":123,"version":123,"latestVersion":123,"indicatorsAdded":["string"],"indicatorsRemoved":["string"],"rulesAdded":["string"],"rulesRemoved":["string"],"links":{"self":{"href":"string"}}}

Indicator Query

Perform an exact match query for indicators in Analyst1 using type and value parameters.

Endpoint

URL: /api/1_0/indicator/match

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	The indicator type.
parameters.value	string	Required	The indicator value.

Input Example

{"parameters":{"type":"ip","value":"45.89.53.46"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
expand	string	Output field: expand
type	string	Type of the resource
value	object	Value for the parameter
value.name	string	Name of the resource
value.classification	string	Value for the parameter
description	object	Output field: description
activityDates	array	Output field: activityDates
reportedDates	array	Output field: reportedDates
reportedDates.date	string	Date value
reportedDates.classification	string	Output field: reportedDates.classification
targets	array	Output field: targets
attackPatterns	array	Output field: attackPatterns
actors	array	Output field: actors
malwares	array	Output field: malwares
status	string	Status value
hashes	array	Output field: hashes
fileNames	array	Name of the resource
fileSize	object	Output field: fileSize
path	object	Output field: path
ports	array	Output field: ports
ipRegistration	object	Output field: ipRegistration
domainRegistration	object	Output field: domainRegistration
ipResolution	object	Output field: ipResolution

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 27 Jun 2024 18:01:03 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"","json_body":{"expand":"sources,hitStatsDetails,enrichmentResults,hitStats","type":"ip","value":{"name":"45.89.53.46","...

Search Malwares

Initiate a search for malware across the Analyst1 platform to identify potential threats and compile relevant data.

Endpoint

URL: /api/1_0/malware

Method: GET

Input

Argument Name	Type	Required	Description
parameters.actor	string	Optional	Parameters for the Search Malwares action
parameters.category	string	Optional	Parameters for the Search Malwares action
parameters.stage	string	Optional	Parameters for the Search Malwares action
parameters.text	string	Optional	Parameters for the Search Malwares action
parameters.page	number	Optional	Parameters for the Search Malwares action
parameters.pageSize	number	Optional	Parameters for the Search Malwares action

Input Example

{"parameters":{"actor":"COMMENT PANDA","category":"Backdoor","stage":"Title","text":"category","page":1,"pageSize":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.id	number	Unique identifier
results.title	object	Result of the operation
results.title.name	string	Name of the resource
results.title.classification	string	Result of the operation
pageSize	number	Output field: pageSize
page	number	Output field: page
totalResults	number	Result of the operation
totalPages	number	Output field: totalPages
links	boolean	Output field: links

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"results":[{}],"pageSize":1,"page":1,"totalResults":10,"totalPages":10,"links":true}}

Submit Evidence

Submit an evidence file for asynchronous processing in Analyst1, requiring a form_body input.

Endpoint

URL: /api/1_0/evidence

Method: POST

Input

Argument Name	Type	Required	Description
form_body	object	Required	Request body data
form_body.evidenceFile	object	Required	The evidence file.
form_body.evidenceFile.file	string	Required	Request body data
form_body.evidenceFile.file_name	string	Required	Request body data
form_body.evidenceFileClassification	string	Required	The evidence file's classification. Only used if a classification can not be determined during extraction.
form_body.tlp	string	Required	The evidence file's traffic light protocol (TLP) designation. Only used if a TLP can not be determined during extraction. Allowed values CLEAR, GREEN, AMBER, AMBER+STRICT, & RED
form_body.tlpJustification	string	Optional	The evidence file's specification of a justification for the TLP assigned; required when TLP color changes.
form_body.tlpCaveats	string	Optional	Request body data
form_body.tlpReevaluateDate	string	Optional	Request body data
form_body.sourceId	number	Optional	Request body data
form_body.sourceTitle	string	Optional	Request body data
form_body.sourceUrl	string	Optional	Request body data
form_body.disableIndicatorAutoEnrichment	boolean	Optional	Request body data

Input Example

{"form_body":{"evidenceFile":{"file":"string","file_name":"Example Name"},"evidenceFileClassification":"string","tlp":"string","tlpJustification":"string","tlpCaveats":"string","tlpReevaluateDate":"string","sourceId":123,"sourceTitle":"string","sourceUrl":"string","disableIndicatorAutoEnrichment":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
uuid	string	Unique identifier

Output Example

{"uuid":"12345678-1234-1234-1234-123456789abc"}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, private, max-age=0, must-revalidate
Connection	HTTP response header: Connection	close
Content-Type	The media type of the resource	application/json;charset=UTF-8
Date	The date and time at which the message was originated	Wed, 04 Oct 2023 07:38:39 GMT
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN