AttackIQ
The AttackIQ connector enables seamless integration with AttackIQ's security validation services, allowing users to automate and orchestrate security testing and operational responses.
AttackIQ is a continuous security validation platform that enables businesses to test and measure the effectiveness of their security controls. The AttackIQ Turbine Connector allows users to automate the creation, management, and analysis of security assessments, tests, and scenarios directly within the Swimlane Turbine platform. By integrating with AttackIQ, Swimlane Turbine users can streamline their security validation processes, enhance their cybersecurity posture, and gain actionable insights into the effectiveness of their security infrastructure.
Limitations
None to date.
Supported Versions
This AttackIQ connector uses the latest Version.
Prerequisites
To effectively utilize the AttackIQ connector for Turbine, ensure you have the following prerequisites:
- API Key Authentication with the following parameters:
- URL: The base endpoint URL for the AttackIQ API.
- Private Token: A unique identifier used to authenticate against the AttackIQ API.
Authentication Methods
- API Key Authentication with the following parameters:
- URL: The endpoint URL for the AttackIQ API.
- Private Token: A unique identifier used to authenticate requests to the AttackIQ API.
Capabilities
This AttackIQ Connector provides the following capabilities:
- Add a Test to an Assessment
- Add Asset Group to an Assessment
- Add Assets to an Assessment
- Add Scenarios to a Test
- Create an Assessment
- Get All Assessments
- Get All Scenarios
- Get All Tests
- Get Assessment Detection Run Status
- Get Assessment Prevention and Detection Results
- Get Assessment by ID
- Get Assessment by Name
- Get Scenario by ID
- Get Scenario by Name
- Get Scenario by Tag ... and so on
Add a Test to an Assessment
- Add a tests to a specified assessment.
Add Asset Group to an Assessment
- Add assets belonging to 1 or more groups to an assessment. This API adds all assets contained in the specified groups to the assessment.
Add Assets to an Assessment
- Add one or more individual assets with an assessment. This API adds a list of assets regardless of asset groups to an assessment.
Add Scenarios to a Test
- Add 1 or more scenarios to a specified test.
Create an Assessment
- Create an assessment from a given assessment template.
Get All Assessments
- Retrieve all assessments.
Get All Scenarios
- Retrieve all scenarios.
Get All Tests
- Retrieve all tests across all assessments.
Get Assessment Detection Run Status
- Returns a flag indicating whether the integration jobs of an on-demand assessment run have finished.
Get Assessment Prevention and Detection Results
- Retrieve assessment scenario job and integration job results for a specified assessment, either for a specific run or for all runs.
Get Assessment by ID
- Retrieve an assessment for a given assessment ID.
Get Assessment by Name
- Retrieve an assessment with the specified full name.
Get Scenario by ID
- Retrieve a scenario corresponding to a given ID.
Get Scenario by Name
- Retrieve a scenario with the specified full name.
Get Scenario by Tag
- Retrieve a scenario that has the given tag.
Get Test by ID
- Retrieve a test with a given ID.
Get Test Run Status
- Get the status of a test run in an assessment.
Get Tests by Name
- Retrieve a test for a specified test name.
Run an Assessment
- Run all the tests for a given assessment.
Search for Assessments
- Retrieve assessments whose names contain one or more search terms.
Search For Scenarios
- Retrieve scenarios whose names or descriptions contain one or more search terms.
Set Scenario Parameters
- Set the arguments for a specified scenario to run. The scenario_master_job_id is returned when you add a scenario to a test in an assessment.
Configurations
AttackIQ API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
private_token | Token for authentication | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add a Test to an Assessment
Adds a specified test to an assessment in AttackIQ using the provided 'name' and 'project' details.
Endpoint
- URL: /v1/tests
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | ID of the assessment to which the test will be added. |
project | string | Optional | Project ID to which the test belongs. |
Input Example
{"json_body":{"name":"API Test","project":"ef900dfe-1bb9-475d-944a-07ffaeb26ad4"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
description | object | Output field: description |
project | string | Output field: project |
scenarios | array | Output field: scenarios |
assets | array | Output field: assets |
asset_groups | array | Output field: asset_groups |
cron_expression | object | Output field: cron_expression |
order | number | Output field: order |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"9d002efa-facf-4121-96e8-c46d178238ef","name":"API Test","description":null,"project":"ef900dfe-1bb9-475d-944a-07ffaeb26ad4","scenarios":[],"assets":[],"asset_groups":[],"cron_expression":null,"order":2}}
Add Asset Group to an Assessment
Adds specified asset groups to an existing assessment in AttackIQ by utilizing 'assessment_id' and 'assets_groups'.
Endpoint
- URL: /v1/assessments/{{assessment_id}}/update_defaults
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.assessment_id | string | Required | ID of the assessment to which assets will be added. |
assets_groups | string | Optional | Parameter for Add Asset Group to an Assessment |
Input Example
{"json_body":{"assets_groups":"b77596ec-e4bf-418f-ae33-520555a6105a,5d987e7d-91da-43d2-9e99-f346472e5cfc"},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
message | string | Response message |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully updated default assets/asset groups for project 92f3bbf1-5c7b-49fa-..."}}
Add Assets to an Assessment
Adds specified assets to an existing AttackIQ assessment by using the unique assessment_id and a list of asset identifiers.
Endpoint
- URL: /v1/assessments/{{assessment_id}}/update_defaults
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.assessment_id | string | Required | ID of the assessment to which assets will be added. |
assets | string | Optional | Comma-separated list of asset IDs to be added to the assessment. |
Input Example
{"json_body":{"assets":"b77596ec-e4bf-418f-ae33-520555a6105a,5d987e7d-91da-43d2-9e99-f346472e5cfc"},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
message | string | Response message |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully updated default assets/asset groups for project 92f3bbf1-5c7b-49fa-..."}}
Add Scenarios to a Test
Adds one or more scenarios to a test in AttackIQ using the specified test ID and scenario details.
Endpoint
- URL: /v1/tests/{{test_id}}/bulk_add_scenarios
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.test_id | string | Required | ID of the test to which the scenarios will be added. |
include | array | Optional | List of scenario IDs to be added to the test. |
id | string | Optional | ID of the test to which the scenarios will be added. |
Input Example
{"json_body":{"include":["03fef867-3227-4d47-a858-90f9ad8cf217"],"id":"9d002efa-facf-4121-96e8-c46d178238ef"},"path_parameters":{"test_id":"9d002efa-facf-4121-96e8-c46d178238ef"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
scenario_master_job_scenarios | array | Output field: scenario_master_job_scenarios |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"scenario_master_job_scenarios":["fd7f4660-54b2-4fd5-b39d-61bf52be76b3"]}}
Create an Assessment
Creates a new assessment in AttackIQ with a specified template from the JSON body input.
Endpoint
- URL: /v1/assessments/project_from_template
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
template | string | Optional | Assessment template ID. |
project_name | string | Optional | User defined assessment name. |
Input Example
{"json_body":{"template":"d09d29ba-eed8-4212-bff2-4d1ee11ed80c","project_name":"Test Assessment"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
project_id | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0"}}
Get All Assessments
Fetches a comprehensive list of all assessments from AttackIQ, providing an overview of security evaluations.
Endpoint
- URL: v1/assessments
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | string | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.start_date | object | Result of the operation |
results.end_date | object | Result of the operation |
results.project_state | string | Result of the operation |
results.default_schedule | string | Result of the operation |
results.project_template | object | Result of the operation |
results.project_template.id | string | Unique identifier |
results.project_template.template_name | string | Name of the resource |
results.project_template.template_description | string | Result of the operation |
results.project_template.project_name | string | Name of the resource |
results.project_template.project_description | string | Result of the operation |
results.project_template.icon | string | Result of the operation |
results.project_template.project_template_type | object | Type of the resource |
results.project_template.project_template_type.id | string | Unique identifier |
results.project_template.project_template_type.name | string | Name of the resource |
results.project_template.project_template_type.description | string | Type of the resource |
results.project_template.default_schedule | object | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":52,"next":"https://firedrill.attackiq.com/v1/assessments?page=2","previous":null,"results":[{}]}}
Get All Scenarios
Fetches all available scenarios from AttackIQ, providing a comprehensive list for analysis and selection.
Endpoint
- URL: /v1/scenarios
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
size | number | Output field: size |
previous | object | Output field: previous |
results | array | Result of the operation |
results.next | string | Result of the operation |
results.id | string | Unique identifier |
results.second_id | object | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.scenario_template | object | Result of the operation |
results.model_json | object | Result of the operation |
results.extras | object | Result of the operation |
results.scenario_type | string | Type of the resource |
results.runnable | boolean | Result of the operation |
results.supported_platforms | object | Result of the operation |
results.supported_platforms.osx | string | Result of the operation |
results.supported_platforms.debian | string | Result of the operation |
results.supported_platforms.ubuntu | string | Result of the operation |
results.supported_platforms.windows | string | Result of the operation |
results.company | string | Result of the operation |
results.user | object | Result of the operation |
results.created | string | Result of the operation |
results.modified | string | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":2810,"size":6,"previous":null,"results":[{}]}}
Get All Tests
Retrieves a comprehensive list of all tests from all assessments within the AttackIQ platform.
Endpoint
- URL: /v1/tests
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | string | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | object | Result of the operation |
results.project | string | Result of the operation |
results.total_asset_count | number | Result of the operation |
results.cron_expression | object | Result of the operation |
results.runnable | boolean | Result of the operation |
results.scheduled_count | number | Result of the operation |
results.created | string | Result of the operation |
results.modified | string | Result of the operation |
results.using_default_assets | boolean | Result of the operation |
results.using_default_schedule | boolean | Result of the operation |
results.order | number | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":90,"next":"https://firedrill.attackiq.com/v1/tests?page=2","previous":null,"results":[{},{}]}}
Get Assessment by ID
Retrieve details for a specific assessment in AttackIQ using the provided assessment ID.
Endpoint
- URL: /v1/assessments/{{assessment_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.assessment_id | string | Required | ID of the assessment to which assets will be added. |
Input Example
{"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
description | string | Output field: description |
start_date | object | Date value |
end_date | object | Date value |
project_state | string | Output field: project_state |
default_schedule | string | Output field: default_schedule |
project_template | object | Output field: project_template |
project_template.id | string | Unique identifier |
project_template.template_name | string | Name of the resource |
project_template.template_description | string | Output field: project_template.template_description |
project_template.project_name | string | Name of the resource |
project_template.project_description | string | Output field: project_template.project_description |
project_template.icon | string | Output field: project_template.icon |
project_template.project_template_type | object | Type of the resource |
project_template.project_template_type.id | string | Unique identifier |
project_template.project_template_type.name | string | Name of the resource |
project_template.project_template_type.description | string | Type of the resource |
project_template.default_schedule | object | Output field: project_template.default_schedule |
project_template.report_types | array | Type of the resource |
project_template.report_types.id | string | Unique identifier |
project_template.report_types.name | string | Name of the resource |
project_template.widgets | array | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...
Get Assessment by Name
Retrieve a specific assessment by name from AttackIQ, using the 'name' parameter for precise identification.
Endpoint
- URL: /v1/assessments
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Required | Name of the assessment to retrieve in URLencoded format. |
Input Example
{"parameters":{"name":"Windows Credential Theft"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
description | string | Output field: description |
start_date | object | Date value |
end_date | object | Date value |
project_state | string | Output field: project_state |
default_schedule | string | Output field: default_schedule |
project_template | object | Output field: project_template |
project_template.id | string | Unique identifier |
project_template.template_name | string | Name of the resource |
project_template.template_description | string | Output field: project_template.template_description |
project_template.project_name | string | Name of the resource |
project_template.project_description | string | Output field: project_template.project_description |
project_template.icon | string | Output field: project_template.icon |
project_template.project_template_type | object | Type of the resource |
project_template.project_template_type.id | string | Unique identifier |
project_template.project_template_type.name | string | Name of the resource |
project_template.project_template_type.description | string | Type of the resource |
project_template.default_schedule | object | Output field: project_template.default_schedule |
project_template.report_types | array | Type of the resource |
project_template.report_types.id | string | Unique identifier |
project_template.report_types.name | string | Name of the resource |
project_template.widgets | array | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...
Get Assessment Detection Run Status
Retrieves the completion status of an on-demand assessment run in AttackIQ using a specified project_id.
Endpoint
- URL: /v1/connector_phase_results/pending
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.project_id | string | Required | ID of the assessment to check. |
Input Example
{"parameters":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
expiration | object | Output field: expiration |
pending | boolean | Output field: pending |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"expiration":null,"pending":false}}
Get Assessment Prevention and Detection Results
Retrieve detailed results for a specific AttackIQ assessment, including scenario and integration job outcomes, using project ID filters.
Endpoint
- URL: /v1/results
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.project_id | string | Required | ID of the assessment to retrieve results for. |
parameters.run_id | string | Optional | Run ID of the assessment. If this field is omitted, you get results from all the assessment runs. |
parameters.assessment_results | boolean | Required | Flag should be set to true at all times. |
parameters.annotate_tag_set | string | Optional | ID for the tag set whose tags you wish to see annotated on each result. |
parameters.output | string | Optional | Specify csv for CSV format instead of JSON. |
Input Example
{"parameters":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0","run_id":"009ee184-964c-4555-bce3-4625dc090416","assessment_results":true,"annotate_tag_set":"055cba1f-07fc-4be9-a238-d533f412108d","output":"csv"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | string | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.modified | string | Result of the operation |
results.project | string | Result of the operation |
results.master_job | string | Result of the operation |
results.scenario | string | Result of the operation |
results.scenario_type | string | Type of the resource |
results.asset | object | Result of the operation |
results.asset.ipv4_address | string | Result of the operation |
results.asset.hostname | string | Name of the resource |
results.asset.id | string | Unique identifier |
results.asset_group | object | Result of the operation |
results.job_state | string | Result of the operation |
results.outcome | string | Result of the operation |
results.result_id | string | Unique identifier |
results.vendor_product_result_summaries | array | Result of the operation |
results.vendor_product_result_summaries.id | string | Unique identifier |
results.vendor_product_result_summaries.outcome | number | Result of the operation |
results.vendor_product_result_summaries.vendor_product | object | Result of the operation |
results.vendor_product_result_summaries.vendor_product.id | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":120,"next":"https://firedrill.attackiq.com/v1/results?page=2&assessment_results=true&project...","previous":null,"results":[{}]}}
Get Scenario by ID
Retrieves a specific AttackIQ scenario using the provided scenario ID.
Endpoint
- URL: /v1/scenarios/{{scenario_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.scenario_id | string | Required | The ID of the scenario to retrieve. |
Input Example
{"path_parameters":{"scenario_id":"7719b7bc-b37b-43d2-8455-0afc218638ab"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | object | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.second_id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.scenario_template | object | Result of the operation |
results.scenario_template.id | string | Unique identifier |
results.scenario_template.tracker_id | string | Unique identifier |
results.scenario_template.name | string | Name of the resource |
results.scenario_template.description | string | Result of the operation |
results.scenario_template.version | string | Result of the operation |
results.scenario_template.zip_file | string | Result of the operation |
results.scenario_template.zip_file_sha1 | string | Result of the operation |
results.scenario_template.descriptor_json | object | Result of the operation |
results.scenario_template.descriptor_json.phases | array | Result of the operation |
results.scenario_template.descriptor_json.phases.trackerId | string | Unique identifier |
results.scenario_template.descriptor_json.phases.description | string | Result of the operation |
results.scenario_template.descriptor_json.phases.subject | string | Result of the operation |
results.scenario_template.descriptor_json.sourceUrl | string | URL endpoint for the request |
results.scenario_template.descriptor_json.description | string | Result of the operation |
Output Example
{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}
Get Scenario by Name
Retrieve a specific AttackIQ scenario by providing the full name as a parameter.
Endpoint
- URL: /v1/scenarios
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Required | Name of the scenario to retrieve in URL encoded format. |
Input Example
{"parameters":{"name":"Dump Credentials"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | object | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.second_id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.scenario_template | object | Result of the operation |
results.scenario_template.id | string | Unique identifier |
results.scenario_template.tracker_id | string | Unique identifier |
results.scenario_template.name | string | Name of the resource |
results.scenario_template.description | string | Result of the operation |
results.scenario_template.version | string | Result of the operation |
results.scenario_template.zip_file | string | Result of the operation |
results.scenario_template.zip_file_sha1 | string | Result of the operation |
results.scenario_template.descriptor_json | object | Result of the operation |
results.scenario_template.descriptor_json.phases | array | Result of the operation |
results.scenario_template.descriptor_json.phases.trackerId | string | Unique identifier |
results.scenario_template.descriptor_json.phases.description | string | Result of the operation |
results.scenario_template.descriptor_json.phases.subject | string | Result of the operation |
results.scenario_template.descriptor_json.sourceUrl | string | URL endpoint for the request |
results.scenario_template.descriptor_json.description | string | Result of the operation |
Output Example
{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}
Get Scenario by Tag
Retrieve scenarios tagged with a specific identifier in AttackIQ, requiring the 'tag' parameter.
Endpoint
- URL: /v1/scenarios
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.tag | string | Required | ID of the tag attached to a list 1 or more scenarios. |
Input Example
{"parameters":{"tag":"866d09c3-556f-4165-9ef9-e2c4807e7868"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | object | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.second_id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.scenario_template | object | Result of the operation |
results.scenario_template.id | string | Unique identifier |
results.scenario_template.tracker_id | string | Unique identifier |
results.scenario_template.name | string | Name of the resource |
results.scenario_template.description | string | Result of the operation |
results.scenario_template.version | string | Result of the operation |
results.scenario_template.zip_file | string | Result of the operation |
results.scenario_template.zip_file_sha1 | string | Result of the operation |
results.scenario_template.descriptor_json | object | Result of the operation |
results.scenario_template.descriptor_json.phases | array | Result of the operation |
results.scenario_template.descriptor_json.phases.trackerId | string | Unique identifier |
results.scenario_template.descriptor_json.phases.description | string | Result of the operation |
results.scenario_template.descriptor_json.phases.subject | string | Result of the operation |
results.scenario_template.descriptor_json.sourceUrl | string | URL endpoint for the request |
results.scenario_template.descriptor_json.description | string | Result of the operation |
Output Example
{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}
Get Test by ID
Retrieve details for a specific test in AttackIQ using the provided test ID.
Endpoint
- URL: /v1/tests/{{test_id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.test_id | string | Required | The ID of the test to retrieve. |
Input Example
{"path_parameters":{"test_id":"ac84a28a-2fcf-4313-aacf-6962e448af28"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | object | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | object | Result of the operation |
results.project | string | Result of the operation |
results.total_asset_count | number | Result of the operation |
results.cron_expression | string | Result of the operation |
results.runnable | boolean | Result of the operation |
results.scheduled_count | number | Result of the operation |
results.created | string | Result of the operation |
results.modified | string | Result of the operation |
results.using_default_assets | boolean | Result of the operation |
results.using_default_schedule | boolean | Result of the operation |
results.order | number | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":1,"next":null,"previous":null,"results":[{}]}}
Get Test Run Status
Retrieve the current status of a specific test run within an assessment in AttackIQ using the test_id.
Endpoint
- URL: /v1/tests/{{test_id}}/get_status
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.test_id | string | Required | The ID of the test for which to retrieve the run status. |
Input Example
{"path_parameters":{"test_id":"9d002efa-facf-4121-96e8-c46d178238ef"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
detected | number | Output field: detected |
failed | number | Output field: failed |
finished | boolean | Output field: finished |
passed | number | Output field: passed |
errored | number | Error message if any |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"detected":0,"failed":0,"finished":true,"passed":1,"errored":0,"total":1}}
Get Tests by Name
Retrieves detailed information for a specified test by name from AttackIQ.
Endpoint
- URL: /v1/tests
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Required | Name of the test to retrieve in UR encoded format. |
Input Example
{"parameters":{"name":"Browser"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
previous | object | Output field: previous |
next | string | Output field: next |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | object | Result of the operation |
results.project | string | Result of the operation |
results.total_asset_count | number | Result of the operation |
results.cron_expression | string | Result of the operation |
results.runnable | boolean | Result of the operation |
results.scheduled_count | number | Result of the operation |
results.created | string | Result of the operation |
results.modified | string | Result of the operation |
results.using_default_assets | boolean | Result of the operation |
results.using_default_schedule | boolean | Result of the operation |
results.order | number | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":67,"previous":null,"next":"https://firedrill.attackiq.com/v1/tests?name=Browser&page=2&show_last_result=tru...","results":[{}]}}
Run an Assessment
Initiates all tests within a specified assessment in AttackIQ using the provided assessment ID.
Endpoint
- URL: /v1/assessments/{{assessment_id}}/run_all
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.assessment_id | string | Required | ID of the assessment to which assets will be added. |
Input Example
{"json_body":{},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
message | string | Response message |
run_id | string | Unique identifier |
started_at | string | Output field: started_at |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully started running all tests in project: Test Assessment","run_id":"009ee184-964c-4555-bce3-4625dc090416","started_at":"2019-08-23T22:48:35.771844"}}
Search for Assessments
Retrieve AttackIQ assessments that match specific search terms provided by the user.
Endpoint
- URL: /v1/assessments
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.search | string | Required | Parts of assessment names in UR encoded format. |
Input Example
{"parameters":{"search":"Windows Credentials"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
name | string | Name of the resource |
description | string | Output field: description |
start_date | object | Date value |
end_date | object | Date value |
project_state | string | Output field: project_state |
default_schedule | string | Output field: default_schedule |
project_template | object | Output field: project_template |
project_template.id | string | Unique identifier |
project_template.template_name | string | Name of the resource |
project_template.template_description | string | Output field: project_template.template_description |
project_template.project_name | string | Name of the resource |
project_template.project_description | string | Output field: project_template.project_description |
project_template.icon | string | Output field: project_template.icon |
project_template.project_template_type | object | Type of the resource |
project_template.project_template_type.id | string | Unique identifier |
project_template.project_template_type.name | string | Name of the resource |
project_template.project_template_type.description | string | Type of the resource |
project_template.default_schedule | object | Output field: project_template.default_schedule |
project_template.report_types | array | Type of the resource |
project_template.report_types.id | string | Unique identifier |
project_template.report_types.name | string | Name of the resource |
project_template.widgets | array | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...
Search For Scenarios
Retrieve AttackIQ scenarios by searching with specific terms in their names or descriptions.
Endpoint
- URL: /v1/scenarios
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.search | string | Required | Search term to filter scenarios by name or description. |
Input Example
{"parameters":{"search":"macos"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
next | object | Output field: next |
previous | object | Output field: previous |
results | array | Result of the operation |
results.id | string | Unique identifier |
results.second_id | string | Unique identifier |
results.name | string | Name of the resource |
results.description | string | Result of the operation |
results.scenario_template | object | Result of the operation |
results.scenario_template.id | string | Unique identifier |
results.scenario_template.tracker_id | string | Unique identifier |
results.scenario_template.name | string | Name of the resource |
results.scenario_template.description | string | Result of the operation |
results.scenario_template.version | string | Result of the operation |
results.scenario_template.zip_file | string | Result of the operation |
results.scenario_template.zip_file_sha1 | string | Result of the operation |
results.scenario_template.descriptor_json | object | Result of the operation |
results.scenario_template.descriptor_json.phases | array | Result of the operation |
results.scenario_template.descriptor_json.phases.trackerId | string | Unique identifier |
results.scenario_template.descriptor_json.phases.description | string | Result of the operation |
results.scenario_template.descriptor_json.phases.subject | string | Result of the operation |
results.scenario_template.descriptor_json.sourceUrl | string | URL endpoint for the request |
results.scenario_template.descriptor_json.description | string | Result of the operation |
Output Example
{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}
Set Scenario Parameters
Configures parameters for a given scenario in AttackIQ using the scenario_master_job_id and model_json.
Endpoint
- URL: /v1/test_scenarios/{{scenario_master_job_id}}
- Method: PATCH
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.scenario_master_job_id | string | Required | ID of the job that will run the scenario requiring arguments. |
id | string | Optional | The ID of the scenario master job to update. |
model_json | object | Optional | JSON formatted argument string. |
model_json.download_url | string | Optional | URL to download the model JSON. |
Input Example
{"json_body":{"id":"13e02210-f78e-414f-a04c-8ddc992e7561","model_json":{"download_url":"https://google.com"}},"path_parameters":{"scenario_master_job_id":"13e02210-f78e-414f-a04c-8ddc992e7561"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
scenario_master_job | string | Output field: scenario_master_job |
scenario | string | Output field: scenario |
model_json | object | Output field: model_json |
model_json.download_url | string | URL endpoint for the request |
order | number | Output field: order |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"fd7f4660-54b2-4fd5-b39d-61bf52be76b3","scenario_master_job":"9d002efa-facf-4121-96e8-c46d178238ef","scenario":"03fef867-3227-4d47-a858-90f9ad8cf217","model_json":{"download_url":"https://google.com"},"order":1}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |