---
title: Arcanna AI
slug: connectors/arcanna-ai
docTags: 
createdAt: 2026-06-09T16:30:22.079Z
---

Arcanna AI is an AI-driven platform that automates the analysis and management of security events.

Arcanna AI is an advanced AI-driven platform designed to enhance security operations by providing insightful event analysis and feedback mechanisms. This connector allows Swimlane Turbine users to seamlessly integrate with Arcanna AI, enabling automated retrieval and management of events and jobs, as well as the ability to send events and feedback for improved threat detection and response. By leveraging Arcanna AI's capabilities, users can enhance their security workflows, reduce manual intervention, and improve the accuracy of threat analysis within the Swimlane Turbine ecosystem.

This is a connector for Arcanna.ai. Arcanna.ai is an AI-Assisted Cybersecurity by bringing all the required data into a single place where it can be processed and analyzed in order to automate decision and post-decision tasks across the growing IT infrastructure.

## Prerequisites

Before you can use the Arcanna AI connector for Turbine, you'll need access to the Arcanna AI API. This requires the following:

- an API key authentication using the following parameters:
  - URL: The endpoint URL for accessing Arcanna AI services.
  - API Key: A unique key provided by Arcanna AI for authenticating API requests.

## Capabilities

This connector provides the following capabilities:

- Get Event Export
- Get Event Status
- Get Jobs List
- Send Bulk Events
- Send Event
- Send Event Feedback

## Additional Documentation

- [Arcanna AI Connector Documentation](https://docs.swimlane.com/connectors/arcanna-ai)
- [Arcanna AI API Documentation](https://arcanna.ai/docs/)
- [Arcanna AI Authentication Guide](https://docs.swimlane.com/authentication-guides/arcanna-ai)

# Configurations

## API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter**     | **Description**                    | **Type** | **Required** |
| ----------------- | ---------------------------------- | -------- | ------------ |
| url               | A URL to the target host.          | string   | Required     |
| x-arcanna-api-key | API key                            | string   | Required     |
| verify\_ssl       | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy       | A proxy to route requests through. | string   | Optional     |

# Actions

## Get Event Export

Retrieve an event from Arcanna AI in its raw format using job\_id and event\_id as path parameters.

### Endpoint

- **URL:** `/api/v1/events/{{job_id}}/{{event_id}}/export`
- **Method:** `GET`

### Input

| **Argument Name**          | **Type** | **Required** | **Description**                            |
| -------------------------- | -------- | ------------ | ------------------------------------------ |
| `path_parameters.job_id`   | number   | Required     | Parameters for the Get Event Export action |
| `path_parameters.event_id` | number   | Required     | Parameters for the Get Event Export action |

### Input Example

`{"path_parameters":{"job_id":123,"event_id":15427818711674}}`

### Output

| **Parameter**                 | **Type** | **Description**                             |
| ----------------------------- | -------- | ------------------------------------------- |
| `status_code`                 | number   | HTTP status code of the response            |
| `reason`                      | string   | Response reason phrase                      |
| `event_id`                    | string   | Unique identifier                           |
| `ingest_timestamp`            | string   | Output field: ingest\_timestamp             |
| `status`                      | string   | Status value                                |
| `arcanna_event`               | object   | Output field: arcanna\_event                |
| `arcanna_event.example_field` | string   | Output field: arcanna\_event.example\_field |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"15427818711674","ingest_timestamp":"2024-02-15T11:50:13.781871Z","status":"OK","arcanna_event":{"example_field":"example_value"}}}`

## Get Event Status

Retrieve the status of an event in Arcanna AI using job\_id and event\_id as path parameters.

### Endpoint

- **URL:** `api/v1/events/{{job_id}}/{{event_id}}`
- **Method:** `GET`

### Input

| **Argument Name**          | **Type** | **Required** | **Description**                            |
| -------------------------- | -------- | ------------ | ------------------------------------------ |
| `path_parameters.job_id`   | number   | Required     | Parameters for the Get Event Status action |
| `path_parameters.event_id` | string   | Required     | Parameters for the Get Event Status action |

### Input Example

`{"path_parameters":{"job_id":1201,"event_id":"12011938471583"}}`

### Output

| **Parameter**      | **Type** | **Description**                  |
| ------------------ | -------- | -------------------------------- |
| `status_code`      | number   | HTTP status code of the response |
| `reason`           | string   | Response reason phrase           |
| `event_id`         | string   | Unique identifier                |
| `ingest_timestamp` | string   | Output field: ingest\_timestamp  |
| `status`           | string   | Status value                     |
| `confidence_level` | number   | Unique identifier                |
| `result`           | string   | Result of the operation          |
| `is_duplicated`    | boolean  | Output field: is\_duplicated     |
| `error_message`    | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"string","ingest_timestamp":"string","status":"string","confidence_level":0,"result":"string","is_duplicated":true,"error_message":"string"}}`

## Get Jobs List

Retrieve a list of jobs from Arcanna AI for monitoring and management purposes.

### Endpoint

- **URL:** `api/v1/jobs`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"job_id":0,"data_type":"string","title":"string","status":"string","labels":[],"features":[]}]}`

## Send Bulk Events

Send a bulk of events to Arcanna AI as a JSON string with XSOAR fields. Requires job\_id as a path parameter and events in the JSON body.

### Endpoint

- **URL:** `api/v1/bulk/{{job_id}}`
- **Method:** `POST`

### Input

| **Argument Name**            | **Type** | **Required** | **Description**                            |
| ---------------------------- | -------- | ------------ | ------------------------------------------ |
| `path_parameters.job_id`     | number   | Required     | Parameters for the Send Bulk Events action |
| `counts`                     | number   | Optional     | Parameter for Send Bulk Events             |
| `events`                     | array    | Optional     | Parameter for Send Bulk Events             |
| `events.job_id`              | number   | Optional     | Unique identifier                          |
| `events.severity`            | number   | Optional     | Parameter for Send Bulk Events             |
| `events.name`                | string   | Optional     | Name of the resource                       |
| `events.destination`         | object   | Optional     | Parameter for Send Bulk Events             |
| `events.destination.address` | string   | Optional     | Parameter for Send Bulk Events             |
| `events.destination.port`    | number   | Optional     | Parameter for Send Bulk Events             |
| `events.destination.bytes`   | number   | Optional     | Parameter for Send Bulk Events             |
| `events.destination.ip`      | string   | Optional     | Parameter for Send Bulk Events             |
| `events.destination.packets` | number   | Optional     | Parameter for Send Bulk Events             |
| `events.rule`                | object   | Optional     | Parameter for Send Bulk Events             |
| `events.rule.name`           | string   | Optional     | Name of the resource                       |
| `events.rule.id`             | string   | Optional     | Unique identifier                          |
| `events.rule.category`       | string   | Optional     | Parameter for Send Bulk Events             |
| `events.source`              | object   | Optional     | Parameter for Send Bulk Events             |
| `events.source.address`      | string   | Optional     | Parameter for Send Bulk Events             |
| `events.source.port`         | number   | Optional     | Parameter for Send Bulk Events             |
| `events.source.bytes`        | number   | Optional     | Parameter for Send Bulk Events             |
| `events.source.ip`           | string   | Optional     | Parameter for Send Bulk Events             |
| `events.source.packets`      | number   | Optional     | Parameter for Send Bulk Events             |
| `events.event`               | object   | Optional     | Parameter for Send Bulk Events             |
| `events.event.severity`      | number   | Optional     | Parameter for Send Bulk Events             |
| `events.event.ingested`      | string   | Optional     | Parameter for Send Bulk Events             |

### Input Example

`{"json_body":{"counts":10,"events":[{"job_id":1202,"severity":3,"name":"test_alert","destination":{"address":"10.128.0.6","port":53720,"bytes":836035,"ip":"10.128.0.6","packets":6459},"rule":{"name":"SURICATA HTTP unable to match response to request","id":"2221010","category":"Generic Protocol Command Decode"},"source":{"address":"8.8.8.8","port":9200,"bytes":4833843,"ip":"8.8.8.8","packets":9677},"event":{"severity":3,"ingested":"2021-06-15T07:56:50.654225827Z","created":"2021-06-15T07:56:49.649Z","kind":"alert","module":"suricata","start":"2021-06-14T14:02:06.280Z","category":["network","intrusion_detection"],"type":["allowed"],"dataset":"suricata.eve"},"fileset":{"name":"eve"},"message":"Generic Protocol Command Decode","url":{"path":"libhtp::request_uri_not_seen","original":"libhtp::request_uri_not_seen"},"@timestamp":"2021-06-15T07:56:49.647Z","suricata":{"eve":{"in_iface":"ens4","metadata":{"flowints":{"http.anomaly.count":2419}},"event_type":"alert","alert":{"signature_id":2221010,"rev":1,"gid":1,"signature":"SURICATA HTTP unable to match response to request","category":"Generic Protocol Command Decode"},"flow_id":576330410117303,"tx_id":3224,"flow":{}}},"closingReason":"Resolved","closing_notes":"some analyst note"}]},"path_parameters":{"job_id":1219}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `status`        | string   | Status value                     |
| `error_message` | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"string","error_message":"string"}}`

## Send Event

Send a raw event to Arcanna AI using job\_id, raw\_body, and title as inputs.

### Endpoint

- **URL:** `api/v1/events/`
- **Method:** `POST`

### Input

| **Argument Name**              | **Type** | **Required** | **Description**   |
| ------------------------------ | -------- | ------------ | ----------------- |
| `job_id`                       | number   | Optional     | Unique identifier |
| `raw_body`                     | object   | Optional     | Request body data |
| `raw_body.destination`         | object   | Optional     | Request body data |
| `raw_body.destination.address` | string   | Optional     | Request body data |
| `raw_body.destination.port`    | number   | Optional     | Request body data |
| `raw_body.destination.bytes`   | number   | Optional     | Request body data |
| `raw_body.destination.ip`      | string   | Optional     | Request body data |
| `raw_body.destination.packets` | number   | Optional     | Request body data |
| `raw_body.rule`                | object   | Optional     | Request body data |
| `raw_body.rule.name`           | string   | Optional     | Request body data |
| `raw_body.rule.id`             | string   | Optional     | Request body data |
| `raw_body.rule.category`       | string   | Optional     | Request body data |
| `raw_body.source`              | object   | Optional     | Request body data |
| `raw_body.source.address`      | string   | Optional     | Request body data |
| `raw_body.source.port`         | number   | Optional     | Request body data |
| `raw_body.source.bytes`        | number   | Optional     | Request body data |
| `raw_body.source.ip`           | string   | Optional     | Request body data |
| `raw_body.source.packets`      | number   | Optional     | Request body data |
| `raw_body.event`               | object   | Optional     | Request body data |
| `raw_body.event.severity`      | number   | Optional     | Request body data |
| `raw_body.event.ingested`      | string   | Optional     | Request body data |
| `raw_body.event.created`       | string   | Optional     | Request body data |
| `raw_body.event.kind`          | string   | Optional     | Request body data |
| `raw_body.event.module`        | string   | Optional     | Request body data |
| `raw_body.event.start`         | string   | Optional     | Request body data |

### Input Example

`{"json_body":{"job_id":1219,"raw_body":{"destination":{"address":"10.128.0.6","port":53720,"bytes":836035,"ip":"10.128.0.6","packets":6459},"rule":{"name":"SURICATA HTTP unable to match response to request","id":"2221010","category":"Generic Protocol Command Decode"},"source":{"address":"8.8.8.8","port":9200,"bytes":4833843,"ip":"8.8.8.8","packets":9677},"event":{"severity":3,"ingested":"2021-06-15T07:56:50.654225827Z","created":"2021-06-15T07:56:49.649Z","kind":"alert","module":"suricata","start":"2021-06-14T14:02:06.280Z","category":["network","intrusion_detection"],"type":["allowed"],"dataset":"suricata.eve"},"fileset":{"name":"eve"},"message":"Generic Protocol Command Decode","url":{"path":"/libhtp::request_uri_not_seen","original":"/libhtp::request_uri_not_seen"},"@timestamp":"2021-06-15T07:56:49.647Z","suricata":{"eve":{"in_iface":"ens4","metadata":{"flowints":{"http.anomaly.count":2419}},"event_type":"alert","alert":{"signature_id":2221010,"rev":1,"gid":1,"signature":"SURICATA HTTP unable to match response to request","category":"Generic Protocol Command Decode"},"flow_id":576330410117303,"tx_id":3224,"flow":{}}}},"title":"sample_event","severity":3}}`

### Output

| **Parameter**      | **Type** | **Description**                  |
| ------------------ | -------- | -------------------------------- |
| `status_code`      | number   | HTTP status code of the response |
| `reason`           | string   | Response reason phrase           |
| `event_id`         | string   | Unique identifier                |
| `job_id`           | number   | Unique identifier                |
| `ingest_timestamp` | string   | Output field: ingest\_timestamp  |
| `status`           | string   | Status value                     |
| `error_message`    | string   | Response message                 |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"event_id":"string","job_id":0,"ingest_timestamp":"string","status":"string","error_message":"string"}}`

## Send Event Feedback

Send feedback for a previously inferred event in Arcanna AI to improve future event analysis. Requires job\_id and event\_id as path parameters.

### Endpoint

- **URL:** `api/v1/events/{{job_id}}/{{event_id}}/feedback`
- **Method:** `PUT`

### Input

| **Argument Name**          | **Type** | **Required** | **Description**                               |
| -------------------------- | -------- | ------------ | --------------------------------------------- |
| `path_parameters.job_id`   | string   | Required     | Parameters for the Send Event Feedback action |
| `path_parameters.event_id` | string   | Required     | Parameters for the Send Event Feedback action |
| `cortex_user`              | string   | Optional     | Parameter for Send Event Feedback             |
| `feedback`                 | string   | Optional     | Parameter for Send Event Feedback             |
| `closing_notes`            | string   | Optional     | Parameter for Send Event Feedback             |
| `indicators`               | array    | Optional     | Parameter for Send Event Feedback             |
| `indicators.type`          | string   | Optional     | Type of the resource                          |
| `indicators.value`         | string   | Optional     | Value for the parameter                       |
| `indicators.source`        | string   | Optional     | Parameter for Send Event Feedback             |

### Input Example

`{"json_body":{"cortex_user":"string","feedback":"string","closing_notes":"string","indicators":[{"type":"string","value":"string","source":"string"}]},"path_parameters":{"job_id":"string","event_id":"string"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `status`      | string   | Status value                     |

### Output Example

`{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":"string"}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |