--- title: Analyst1 slug: connectors/analyst1 docTags: createdAt: 2026-06-09T16:30:08.785Z --- Analyst1 is a cybersecurity platform that provides advanced threat intelligence and analysis capabilities. Analyst1 is a comprehensive threat intelligence platform that provides enriched data for security operations. This connector enables seamless integration with Swimlane Turbine, allowing users to perform batch checks, retrieve sensor configurations, and access detailed information on indicators, malware, and rules. By leveraging Analyst1's capabilities, Swimlane Turbine users can enhance their threat detection and response processes, streamline security workflows, and gain deeper insights into potential threats. ## Prerequisites Before you can use the Analyst1 connector for Turbine, you'll need access to the Analyst1 API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing Analyst1 services. - Email Address: Your registered email address for Analyst1 account access. - Password: The password associated with your Analyst1 account. ## Asset Setup The asset for this Connector requires the following inputs: - Username - Password ## Capabilities This Connector provides the following capabilities: - Get Batch Check - Get Config File For Sensor - Get Indicators - Get Indicator by ID - Get Indicators For Sensor - Get Malware by ID - Get Rules By Sensor ID - Get Sensors By ID - Get Taskings By Sensor ID - Indicator Query - Search Malware - Submit Evidence ## Notes For more information on Analyst1 is found at: [Analyst1 Main Site](https://analyst1.com) ## API Documentation Link [Analyst1 API Documentation Link](https://partner.cloud.analyst1.com/guide/viewer?category=API\&guide=2.7.0%20REST%20API) ## Additional Documentation - [Analyst1 Connector Documentation](https://docs.swimlane.com/connectors/analyst1) - [Analyst1 API Documentation](https://analyst1.com) # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Email Address | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Batch Check Perform a match operation on a collection of values across various entities in Analyst1, requiring specific parameters. ### Endpoint - **URL:** `/api/1_0/batchCheck` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.values` | array | Required | The values to search for separated by commas. | ### Input Example `{"parameters":{"values":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.searchedValue` | string | Value for the parameter | | `results.matchedValue` | string | Value for the parameter | | `results.id` | number | Unique identifier | | `results.entity` | object | Result of the operation | | `results.entity.key` | string | Result of the operation | | `results.entity.title` | string | Result of the operation | | `results.type` | object | Type of the resource | | `results.type.key` | string | Type of the resource | | `results.type.title` | string | Type of the resource | | `results.benign` | boolean | Result of the operation | | `results.actor` | array | Result of the operation | | `results.actor.id` | number | Unique identifier | | `results.actor.title` | string | Result of the operation | | `results.actor.akas` | array | Result of the operation | | `results.malware` | array | Result of the operation | | `results.malware.id` | number | Unique identifier | | `results.malware.title` | string | Result of the operation | | `results.malware.akas` | array | Result of the operation | | `results.system` | array | Result of the operation | | `results.system.id` | number | Unique identifier | | `results.system.title` | string | Result of the operation | | `results.system.akas` | array | Result of the operation | ### Output Example `{"results":[{"searchedValue":"string","matchedValue":"string","id":123,"entity":{},"type":{},"benign":true,"actor":[],"malware":[],"system":[]}]}` ## Get Config File For Sensor Retrieve the current configuration file for a specified sensor in Analyst1 using its unique identifier. ### Endpoint - **URL:** `/api/1_0/sensors/{{id}}/taskings/config` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Get Config File For Sensor action | ### Input Example `{"path_parameters":{"id":7671}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | ----------------------- | | `file` | object | Output field: file | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | | `file.contentType` | string | Type of the resource | ### Output Example `{"file":{"file":"string","file_name":"Example Name","contentType":"text/plain"}}` ## Get Indicator By ID Retrieve detailed information for a specific indicator in Analyst1 using the unique identifier 'id'. ### Endpoint - **URL:** `/api/1_0/indicator/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------- | | `path_parameters.id` | number | Required | Requested resource id | ### Input Example `{"path_parameters":{"id":983}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `expand` | string | Output field: expand | | `type` | string | Type of the resource | | `value` | object | Value for the parameter | | `value.name` | string | Name of the resource | | `value.classification` | string | Value for the parameter | | `description` | object | Output field: description | | `description.name` | string | Name of the resource | | `description.classification` | string | Output field: description.classification | | `activityDates` | array | Output field: activityDates | | `activityDates.date` | string | Date value | | `activityDates.classification` | string | Output field: activityDates.classification | | `reportedDates` | array | Output field: reportedDates | | `reportedDates.date` | string | Date value | | `reportedDates.classification` | string | Output field: reportedDates.classification | | `targets` | array | Output field: targets | | `targets.name` | string | Name of the resource | | `targets.id` | number | Unique identifier | | `targets.classification` | string | Output field: targets.classification | | `attackPatterns` | array | Output field: attackPatterns | | `attackPatterns.name` | string | Name of the resource | | `attackPatterns.id` | number | Unique identifier | | `attackPatterns.classification` | string | Output field: attackPatterns.classification | | `actors` | array | Output field: actors | ### Output Example `{"expand":"string","type":"string","value":{"name":"Example Name","classification":"string"},"description":{"name":"Example Name","classification":"string"},"activityDates":[{"date":"2024-01-01T00:00:00Z","classification":"string"}],"reportedDates":[{"date":"2024-01-01T00:00:00Z","classification":"string"}],"targets":[{"name":"Example Name","id":123,"classification":"string"}],"attackPatterns":[{"name":"Example Name","id":123,"classification":"string"}],"actors":[{"name":"Example Name","id":123,...` ## Get Indicators Browse and list various indicators from Analyst1 for further analysis. ### Endpoint - **URL:** `/api/1_0/indicator` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.page` | number | Optional | Parameters for the Get Indicators action | | `parameters.pageSize` | number | Optional | Parameters for the Get Indicators action | | `parameters.descSort` | boolean | Optional | Parameters for the Get Indicators action | | `parameters.sortBy` | string | Optional | Parameters for the Get Indicators action | | `parameters.type` | string | Optional | Parameters for the Get Indicators action | | `parameters.benign` | boolean | Optional | Parameters for the Get Indicators action | | `parameters.tasked` | boolean | Optional | Parameters for the Get Indicators action | | `parameters.status` | string | Optional | Parameters for the Get Indicators action | | `parameters.tlp` | string | Optional | Parameters for the Get Indicators action | | `parameters.verified` | boolean | Optional | Parameters for the Get Indicators action | | `parameters.searchTerm` | string | Optional | Parameters for the Get Indicators action | | `parameters.indicatorValueOnlySearch` | boolean | Optional | Parameters for the Get Indicators action | | `parameters.sources` | array | Optional | Parameters for the Get Indicators action | | `parameters.expand` | string | Optional | Parameters for the Get Indicators action | ### Input Example `{"parameters":{"page":1,"pageSize":10,"descSort":true,"sortBy":"id","type":"domain","benign":true,"tasked":true,"status":"aab","tlp":"UNDETERMINED","verified":true,"searchTerm":"Description","indicatorValueOnlySearch":true,"sources":[301,302],"expand":"sources"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.expand` | string | Result of the operation | | `results.links` | boolean | Result of the operation | | `results.id` | number | Unique identifier | | `results.type` | string | Type of the resource | | `results.value` | object | Value for the parameter | | `results.value.name` | string | Name of the resource | | `results.value.classification` | string | Value for the parameter | | `results.status` | string | Status value | | `results.tlp` | string | Result of the operation | | `pageSize` | number | Output field: pageSize | | `page` | number | Output field: page | | `totalResults` | number | Result of the operation | | `totalPages` | number | Output field: totalPages | | `links` | boolean | Output field: links | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"results":[{}],"pageSize":1,"page":1,"totalResults":10,"totalPages":10,"links":true}}` ## Get Indicators For Sensor Retrieve indicators associated with a specific sensor in Analyst1 using the sensor's unique identifier. ### Endpoint - **URL:** `/api/1_0/sensors/{{id}}/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | number | Required | Sensor ID | | `status` | string | Optional | Indicator status filter. Allowed values are 'u' for Unable To Act, 'aab' for Awaiting Ability, 'aw' for Awaiting Intention, 'aal' for Awaiting Allowed, 'ar' for Awaiting Rule, & 'rc' for Rule Created. | | `type` | string | Optional | Filter results based on Indicator type. Allowed values are 'domain', 'ip', 'file', 'email', 'string', 'ipv6', 'mutex', 'httpRequest', & 'url'. | | `value` | string | Optional | Indicator value filter. | | `actor` | number | Optional | actor query no Indicator actor filter. | | `verified` | boolean | Optional | Indicator verified status filter. If absent, indicators with both verified and unverified status are included. | | `page` | number | Optional | The requested results page, 1-indexed. If absent, the first page is always returned. | | `pagesize` | number | Optional | The requested results per page. When present, must be between 1 and 100 inclusive. | | `descSort` | boolean | Optional | The sort direction. True for a descending sort, false for a ascending sort. | | `sortBy` | string | Optional | The value to sort results on. Allowed values are 'id', 'type', 'value', 'reportCount', 'benign', 'tasked'. | | `expand` | string | Optional | Determines which child resources to return details for. Valid options are hitStats', 'sources', and 'enrichmentResults'. Selected options will be returned in the 'expand' response value | ### Input Example `{"json_body":{"status":"u","type":"domain","value":"value","actor":1,"verified":true,"page":1,"pagesize":10,"descSort":false,"sortBy":"id","expand":"sources"},"path_parameters":{"id":7671}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.expand` | string | Result of the operation | | `results.type` | string | Type of the resource | | `results.value` | object | Value for the parameter | | `results.value.name` | string | Name of the resource | | `results.value.classification` | string | Value for the parameter | | `results.description` | object | Result of the operation | | `results.description.name` | string | Name of the resource | | `results.description.classification` | string | Result of the operation | | `results.activityDates` | array | Result of the operation | | `results.activityDates.date` | string | Result of the operation | | `results.activityDates.classification` | string | Result of the operation | | `results.reportedDates` | array | Result of the operation | | `results.reportedDates.date` | string | Result of the operation | | `results.reportedDates.classification` | string | Result of the operation | | `results.targets` | array | Result of the operation | | `results.targets.name` | string | Name of the resource | | `results.targets.id` | number | Unique identifier | | `results.targets.classification` | string | Result of the operation | | `results.attackPatterns` | array | Result of the operation | | `results.attackPatterns.name` | string | Name of the resource | | `results.attackPatterns.id` | number | Unique identifier | | `results.attackPatterns.classification` | string | Result of the operation | ### Output Example `{"results":[{"expand":"string","type":"string","value":{},"description":{},"activityDates":[],"reportedDates":[],"targets":[],"attackPatterns":[],"actors":[],"malwares":[],"status":"active","hashes":[],"fileNames":[],"fileSize":{},"path":{}}],"pageSize":123,"page":123,"totalResults":123,"totalPages":123,"links":{"next":{"href":"string"},"first":{"href":"string"},"last":{"href":"string"},"self":{"href":"string"}}}` ## Get Malware by ID Retrieve detailed information for a specific malware entry using its unique identifier in the Analyst1 platform. ### Endpoint - **URL:** `/api/1_0/malware/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Get Malware by ID action | ### Input Example `{"path_parameters":{"id":301}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `links` | boolean | Output field: links | | `id` | number | Unique identifier | | `title` | object | Output field: title | | `title.name` | string | Name of the resource | | `title.classification` | string | Output field: title.classification | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"links":true,"id":301,"title":{"name":"SpyNote","classification":"secretFvey"}}}` ## Get Rules By Sensor ID Retrieve the set of rules associated with a specific sensor in Analyst1 using the sensor's unique identifier. ### Endpoint - **URL:** `/api/1_0/sensors/{{id}}/rules` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | number | Required | Sensor ID. | | `type` | string | Optional | Rule type (i.e., sensor manufacturer). May be one of 'UNKNOWN', SNORT', 'MCAFEE\_HIPS', 'PALO\_ALTO', 'JUNIPER', 'YARA', SURICATA', 'SYMANTEC\_PROXYSG',CISCO\_ASA','TIPPING\_POINT\_IPS', 'TANIUM\_BLOCKLIST', 'OTHER\_AUTO' | | `exploitStage` | number | Optional | Rule exploit stage. Lookup valid IDs in the /api/1\_0/exploitStage endpoint. | | `source` | string | Optional | Rule source. May be one of 'INTERNAL', 'AUTO\_INDICATOR', 'PROOFPOINT\_SNORT', 'PROOFPOINT\_SURICATA'. | | `tlp` | string | Optional | Rule traffic light protocol color. May be one of 'UNDETERMINED', 'CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', & 'RED' | | `page` | number | Optional | The requested results page, 1-indexed. If absent, the first page is always returned. | | `pageSize` | number | Optional | The requested results per page. When present, must be between 1 and 100 inclusive. | | `descSort` | boolean | Optional | The sort direction. True for a descending sort, false for a ascending sort. | | `sortBy` | string | Optional | The value to sort results on. Allowed values are 'id', 'type' (sensor manufacturer), 'source', 'context', 'exploitStage', 'tasked', 'taskedCount', 'tlp', 'sid', 'otherSid' | ### Input Example `{"json_body":{"type":"UNKNOWN","exploitStage":1,"source":"INTERNAL","tlp":"UNDETERMINED","page":1,"pageSize":10,"descSort":false,"sortBy":"id"},"path_parameters":{"id":7671}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.id` | number | Unique identifier | | `results.name` | string | Name of the resource | | `results.tlp` | string | Result of the operation | | `results.source` | string | Result of the operation | | `results.tlpJustification` | string | Result of the operation | | `results.tlpCaveats` | string | Result of the operation | | `results.tlpReevaluateDate` | string | Result of the operation | | `results.ruleStatus` | string | Status value | | `results.ruleDefinition` | string | Result of the operation | | `results.ruleType` | string | Type of the resource | | `results.tasked` | boolean | Result of the operation | | `results.context` | string | Result of the operation | | `results.exploitStage` | object | Result of the operation | | `results.exploitStage.id` | number | Unique identifier | | `results.exploitStage.name` | string | Name of the resource | | `results.exploitStage.classification` | string | Result of the operation | | `results.sid` | string | Unique identifier | | `results.otherSid` | string | Unique identifier | | `results.taskedCount` | number | Result of the operation | | `results.actors` | object | Result of the operation | | `results.actors.idNamePairs` | array | Unique identifier | | `results.actors.idNamePairs.id` | number | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Wed, 04 Oct 2023 15:49:27 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"close","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"","json_body":{"results":[{}],"pageSize":10,"page":1,"totalResults":4,"totalPages":1,"links":{"first":{},"last":{},"self":{}}...` ## Get Sensors By ID Retrieve detailed information for a specific sensor by its ID in Analyst1. ### Endpoint - **URL:** `/api/1_0/sensors/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | number | Required | Sensor ID. | ### Input Example `{"path_parameters":{"id":7672}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `name` | string | Name of the resource | | `logicalLocation` | string | Output field: logicalLocation | | `org` | object | Output field: org | | `org.id` | number | Unique identifier | | `org.name` | string | Name of the resource | | `type` | string | Type of the resource | | `currentVersionNumber` | number | Output field: currentVersionNumber | | `latestConfigVersionNumber` | number | Output field: latestConfigVersionNumber | | `comments` | array | Output field: comments | | `firmwareVersion` | string | Output field: firmwareVersion | | `installDate` | string | Date value | | `modelNumber` | string | Output field: modelNumber | | `networkSpeed` | string | Output field: networkSpeed | | `numIndicators` | number | Output field: numIndicators | | `numSignatures` | number | Output field: numSignatures | | `physicalAddress` | string | Output field: physicalAddress | | `purchaseDate` | string | Date value | | `serialNumber` | number | Output field: serialNumber | ### Output Example `{"id":123,"name":"Example Name","logicalLocation":"string","org":{"id":123,"name":"Example Name"},"type":"string","currentVersionNumber":123,"latestConfigVersionNumber":123,"comments":["string"],"firmwareVersion":"string","installDate":"string","modelNumber":"string","networkSpeed":"string","numIndicators":123,"numSignatures":123,"physicalAddress":"string"}` ## Get Taskings By Sensor ID Retrieve differences in taskings between the latest and a past version for a given sensor ID and version in Analyst1. ### Endpoint - **URL:** `/api/1_0/sensors/{{id}}/taskings/diff/{{version}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.id` | number | Required | The Sensor's ID | | `path_parameters.version` | number | Required | One-based, past version of a Sensor | ### Input Example `{"path_parameters":{"id":7669,"version":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | number | Unique identifier | | `version` | number | Output field: version | | `latestVersion` | number | Output field: latestVersion | | `indicatorsAdded` | array | Output field: indicatorsAdded | | `indicatorsRemoved` | array | Output field: indicatorsRemoved | | `rulesAdded` | array | Output field: rulesAdded | | `rulesRemoved` | array | Output field: rulesRemoved | | `links` | object | Output field: links | | `links.self` | object | Output field: links.self | | `links.self.href` | string | Output field: links.self.href | ### Output Example `{"id":123,"version":123,"latestVersion":123,"indicatorsAdded":["string"],"indicatorsRemoved":["string"],"rulesAdded":["string"],"rulesRemoved":["string"],"links":{"self":{"href":"string"}}}` ## Indicator Query Perform an exact match query for indicators in Analyst1 using type and value parameters. ### Endpoint - **URL:** `/api/1_0/indicator/match` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------- | | `parameters.type` | string | Required | The indicator type. | | `parameters.value` | string | Required | The indicator value. | ### Input Example `{"parameters":{"type":"ip","value":"45.89.53.46"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `expand` | string | Output field: expand | | `type` | string | Type of the resource | | `value` | object | Value for the parameter | | `value.name` | string | Name of the resource | | `value.classification` | string | Value for the parameter | | `description` | object | Output field: description | | `activityDates` | array | Output field: activityDates | | `reportedDates` | array | Output field: reportedDates | | `reportedDates.date` | string | Date value | | `reportedDates.classification` | string | Output field: reportedDates.classification | | `targets` | array | Output field: targets | | `attackPatterns` | array | Output field: attackPatterns | | `actors` | array | Output field: actors | | `malwares` | array | Output field: malwares | | `status` | string | Status value | | `hashes` | array | Output field: hashes | | `fileNames` | array | Name of the resource | | `fileSize` | object | Output field: fileSize | | `path` | object | Output field: path | | `ports` | array | Output field: ports | | `ipRegistration` | object | Output field: ipRegistration | | `domainRegistration` | object | Output field: domainRegistration | | `ipResolution` | object | Output field: ipResolution | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 27 Jun 2024 18:01:03 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"","json_body":{"expand":"sources,hitStatsDetails,enrichmentResults,hitStats","type":"ip","value":{"name":"45.89.53.46","...` ## Search Malwares Initiate a search for malware across the Analyst1 platform to identify potential threats and compile relevant data. ### Endpoint - **URL:** `/api/1_0/malware` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.actor` | string | Optional | Parameters for the Search Malwares action | | `parameters.category` | string | Optional | Parameters for the Search Malwares action | | `parameters.stage` | string | Optional | Parameters for the Search Malwares action | | `parameters.text` | string | Optional | Parameters for the Search Malwares action | | `parameters.page` | number | Optional | Parameters for the Search Malwares action | | `parameters.pageSize` | number | Optional | Parameters for the Search Malwares action | ### Input Example `{"parameters":{"actor":"COMMENT PANDA","category":"Backdoor","stage":"Title","text":"category","page":1,"pageSize":10}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.id` | number | Unique identifier | | `results.title` | object | Result of the operation | | `results.title.name` | string | Name of the resource | | `results.title.classification` | string | Result of the operation | | `pageSize` | number | Output field: pageSize | | `page` | number | Output field: page | | `totalResults` | number | Result of the operation | | `totalPages` | number | Output field: totalPages | | `links` | boolean | Output field: links | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"results":[{}],"pageSize":1,"page":1,"totalResults":10,"totalPages":10,"links":true}}` ## Submit Evidence Submit an evidence file for asynchronous processing in Analyst1, requiring a form\_body input. ### Endpoint - **URL:** `/api/1_0/evidence` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `form_body` | object | Required | Request body data | | `form_body.evidenceFile` | object | Required | The evidence file. | | `form_body.evidenceFile.file` | string | Required | Request body data | | `form_body.evidenceFile.file_name` | string | Required | Request body data | | `form_body.evidenceFileClassification` | string | Required | The evidence file's classification. Only used if a classification can not be determined during extraction. | | `form_body.tlp` | string | Required | The evidence file's traffic light protocol (TLP) designation. Only used if a TLP can not be determined during extraction. Allowed values CLEAR, GREEN, AMBER, AMBER+STRICT, & RED | | `form_body.tlpJustification` | string | Optional | The evidence file's specification of a justification for the TLP assigned; required when TLP color changes. | | `form_body.tlpCaveats` | string | Optional | Request body data | | `form_body.tlpReevaluateDate` | string | Optional | Request body data | | `form_body.sourceId` | number | Optional | Request body data | | `form_body.sourceTitle` | string | Optional | Request body data | | `form_body.sourceUrl` | string | Optional | Request body data | | `form_body.disableIndicatorAutoEnrichment` | boolean | Optional | Request body data | ### Input Example `{"form_body":{"evidenceFile":{"file":"string","file_name":"Example Name"},"evidenceFileClassification":"string","tlp":"string","tlpJustification":"string","tlpCaveats":"string","tlpReevaluateDate":"string","sourceId":123,"sourceTitle":"string","sourceUrl":"string","disableIndicatorAutoEnrichment":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `uuid` | string | Unique identifier | ### Output Example `{"uuid":"12345678-1234-1234-1234-123456789abc"}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------- | ------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, private, max-age=0, must-revalidate | | Connection | HTTP response header: Connection | close | | Content-Type | The media type of the resource | application/json;charset=UTF-8 | | Date | The date and time at which the message was originated | Wed, 04 Oct 2023 07:38:39 GMT | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |