--- title: AttackIQ slug: connectors/attackiq docTags: createdAt: 2026-06-09T16:30:19.557Z --- The AttackIQ connector enables seamless integration with AttackIQ's security validation services, allowing users to automate and orchestrate security testing and operational responses. AttackIQ is a continuous security validation platform that enables businesses to test and measure the effectiveness of their security controls. The AttackIQ Turbine Connector allows users to automate the creation, management, and analysis of security assessments, tests, and scenarios directly within the Swimlane Turbine platform. By integrating with AttackIQ, Swimlane Turbine users can streamline their security validation processes, enhance their cybersecurity posture, and gain actionable insights into the effectiveness of their security infrastructure. ### Limitations None to date. ### Supported Versions This AttackIQ connector uses the latest Version. ## Prerequisites To effectively utilize the AttackIQ connector for Turbine, ensure you have the following prerequisites: - API Key Authentication with the following parameters: - URL: The base endpoint URL for the AttackIQ API. - Private Token: A unique identifier used to authenticate against the AttackIQ API. ## Authentication Methods - API Key Authentication with the following parameters: - URL: The endpoint URL for the AttackIQ API. - Private Token: A unique identifier used to authenticate requests to the AttackIQ API. ## Capabilities This AttackIQ Connector provides the following capabilities: - Add a Test to an Assessment - Add Asset Group to an Assessment - Add Assets to an Assessment - Add Scenarios to a Test - Create an Assessment - Get All Assessments - Get All Scenarios - Get All Tests - Get Assessment Detection Run Status - Get Assessment Prevention and Detection Results - Get Assessment by ID - Get Assessment by Name - Get Scenario by ID - Get Scenario by Name - Get Scenario by Tag *... and so on* ### Add a Test to an Assessment - Add a tests to a specified assessment. ### Add Asset Group to an Assessment - Add assets belonging to 1 or more groups to an assessment. This API adds all assets contained in the specified groups to the assessment. ### Add Assets to an Assessment - Add one or more individual assets with an assessment. This API adds a list of assets regardless of asset groups to an assessment. ### Add Scenarios to a Test - Add 1 or more scenarios to a specified test. ### Create an Assessment - Create an assessment from a given assessment template. ### Get All Assessments - Retrieve all assessments. ### Get All Scenarios - Retrieve all scenarios. ### Get All Tests - Retrieve all tests across all assessments. ### Get Assessment Detection Run Status - Returns a flag indicating whether the integration jobs of an on-demand assessment run have finished. ### Get Assessment Prevention and Detection Results - Retrieve assessment scenario job and integration job results for a specified assessment, either for a specific run or for all runs. ### Get Assessment by ID - Retrieve an assessment for a given assessment ID. ### Get Assessment by Name - Retrieve an assessment with the specified full name. ### Get Scenario by ID - Retrieve a scenario corresponding to a given ID. ### Get Scenario by Name - Retrieve a scenario with the specified full name. ### Get Scenario by Tag - Retrieve a scenario that has the given tag. ### Get Test by ID - Retrieve a test with a given ID. ### Get Test Run Status - Get the status of a test run in an assessment. ### Get Tests by Name - Retrieve a test for a specified test name. ### Run an Assessment - Run all the tests for a given assessment. ### Search for Assessments - Retrieve assessments whose names contain one or more search terms. ### Search For Scenarios - Retrieve scenarios whose names or descriptions contain one or more search terms. ### Set Scenario Parameters - Set the arguments for a specified scenario to run. The scenario\_master\_job\_id is returned when you add a scenario to a test in an assessment. # Configurations ## AttackIQ API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | private\_token | Token for authentication | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add a Test to an Assessment Adds a specified test to an assessment in AttackIQ using the provided 'name' and 'project' details. ### Endpoint - **URL:** `/v1/tests` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------- | | `name` | string | Optional | ID of the assessment to which the test will be added. | | `project` | string | Optional | Project ID to which the test belongs. | ### Input Example `{"json_body":{"name":"API Test","project":"ef900dfe-1bb9-475d-944a-07ffaeb26ad4"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | object | Output field: description | | `project` | string | Output field: project | | `scenarios` | array | Output field: scenarios | | `assets` | array | Output field: assets | | `asset_groups` | array | Output field: asset\_groups | | `cron_expression` | object | Output field: cron\_expression | | `order` | number | Output field: order | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"9d002efa-facf-4121-96e8-c46d178238ef","name":"API Test","description":null,"project":"ef900dfe-1bb9-475d-944a-07ffaeb26ad4","scenarios":[],"assets":[],"asset_groups":[],"cron_expression":null,"order":2}}` ## Add Asset Group to an Assessment Adds specified asset groups to an existing assessment in AttackIQ by utilizing 'assessment\_id' and 'assets\_groups'. ### Endpoint - **URL:** `/v1/assessments/{{assessment_id}}/update_defaults` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.assessment_id` | string | Required | ID of the assessment to which assets will be added. | | `assets_groups` | string | Optional | Parameter for Add Asset Group to an Assessment | ### Input Example `{"json_body":{"assets_groups":"b77596ec-e4bf-418f-ae33-520555a6105a,5d987e7d-91da-43d2-9e99-f346472e5cfc"},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully updated default assets/asset groups for project 92f3bbf1-5c7b-49fa-..."}}` ## Add Assets to an Assessment Adds specified assets to an existing AttackIQ assessment by using the unique assessment\_id and a list of asset identifiers. ### Endpoint - **URL:** `/v1/assessments/{{assessment_id}}/update_defaults` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ---------------------------------------------------------------- | | `path_parameters.assessment_id` | string | Required | ID of the assessment to which assets will be added. | | `assets` | string | Optional | Comma-separated list of asset IDs to be added to the assessment. | ### Input Example `{"json_body":{"assets":"b77596ec-e4bf-418f-ae33-520555a6105a,5d987e7d-91da-43d2-9e99-f346472e5cfc"},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully updated default assets/asset groups for project 92f3bbf1-5c7b-49fa-..."}}` ## Add Scenarios to a Test Adds one or more scenarios to a test in AttackIQ using the specified test ID and scenario details. ### Endpoint - **URL:** `/v1/tests/{{test_id}}/bulk_add_scenarios` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.test_id` | string | Required | ID of the test to which the scenarios will be added. | | `include` | array | Optional | List of scenario IDs to be added to the test. | | `id` | string | Optional | ID of the test to which the scenarios will be added. | ### Input Example `{"json_body":{"include":["03fef867-3227-4d47-a858-90f9ad8cf217"],"id":"9d002efa-facf-4121-96e8-c46d178238ef"},"path_parameters":{"test_id":"9d002efa-facf-4121-96e8-c46d178238ef"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `scenario_master_job_scenarios` | array | Output field: scenario\_master\_job\_scenarios | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"scenario_master_job_scenarios":["fd7f4660-54b2-4fd5-b39d-61bf52be76b3"]}}` ## Create an Assessment Creates a new assessment in AttackIQ with a specified template from the JSON body input. ### Endpoint - **URL:** `/v1/assessments/project_from_template` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------- | | `template` | string | Optional | Assessment template ID. | | `project_name` | string | Optional | User defined assessment name. | ### Input Example `{"json_body":{"template":"d09d29ba-eed8-4212-bff2-4d1ee11ed80c","project_name":"Test Assessment"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `project_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0"}}` ## Get All Assessments Fetches a comprehensive list of all assessments from AttackIQ, providing an overview of security evaluations. ### Endpoint - **URL:** `v1/assessments` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | string | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.start_date` | object | Result of the operation | | `results.end_date` | object | Result of the operation | | `results.project_state` | string | Result of the operation | | `results.default_schedule` | string | Result of the operation | | `results.project_template` | object | Result of the operation | | `results.project_template.id` | string | Unique identifier | | `results.project_template.template_name` | string | Name of the resource | | `results.project_template.template_description` | string | Result of the operation | | `results.project_template.project_name` | string | Name of the resource | | `results.project_template.project_description` | string | Result of the operation | | `results.project_template.icon` | string | Result of the operation | | `results.project_template.project_template_type` | object | Type of the resource | | `results.project_template.project_template_type.id` | string | Unique identifier | | `results.project_template.project_template_type.name` | string | Name of the resource | | `results.project_template.project_template_type.description` | string | Type of the resource | | `results.project_template.default_schedule` | object | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":52,"next":"https://firedrill.attackiq.com/v1/assessments?page=2","previous":null,"results":[{}]}}` ## Get All Scenarios Fetches all available scenarios from AttackIQ, providing a comprehensive list for analysis and selection. ### Endpoint - **URL:** `/v1/scenarios` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `size` | number | Output field: size | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.next` | string | Result of the operation | | `results.id` | string | Unique identifier | | `results.second_id` | object | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.scenario_template` | object | Result of the operation | | `results.model_json` | object | Result of the operation | | `results.extras` | object | Result of the operation | | `results.scenario_type` | string | Type of the resource | | `results.runnable` | boolean | Result of the operation | | `results.supported_platforms` | object | Result of the operation | | `results.supported_platforms.osx` | string | Result of the operation | | `results.supported_platforms.debian` | string | Result of the operation | | `results.supported_platforms.ubuntu` | string | Result of the operation | | `results.supported_platforms.windows` | string | Result of the operation | | `results.company` | string | Result of the operation | | `results.user` | object | Result of the operation | | `results.created` | string | Result of the operation | | `results.modified` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":2810,"size":6,"previous":null,"results":[{}]}}` ## Get All Tests Retrieves a comprehensive list of all tests from all assessments within the AttackIQ platform. ### Endpoint - **URL:** `/v1/tests` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | string | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | object | Result of the operation | | `results.project` | string | Result of the operation | | `results.total_asset_count` | number | Result of the operation | | `results.cron_expression` | object | Result of the operation | | `results.runnable` | boolean | Result of the operation | | `results.scheduled_count` | number | Result of the operation | | `results.created` | string | Result of the operation | | `results.modified` | string | Result of the operation | | `results.using_default_assets` | boolean | Result of the operation | | `results.using_default_schedule` | boolean | Result of the operation | | `results.order` | number | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":90,"next":"https://firedrill.attackiq.com/v1/tests?page=2","previous":null,"results":[{},{}]}}` ## Get Assessment by ID Retrieve details for a specific assessment in AttackIQ using the provided assessment ID. ### Endpoint - **URL:** `/v1/assessments/{{assessment_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.assessment_id` | string | Required | ID of the assessment to which assets will be added. | ### Input Example `{"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ----------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `start_date` | object | Date value | | `end_date` | object | Date value | | `project_state` | string | Output field: project\_state | | `default_schedule` | string | Output field: default\_schedule | | `project_template` | object | Output field: project\_template | | `project_template.id` | string | Unique identifier | | `project_template.template_name` | string | Name of the resource | | `project_template.template_description` | string | Output field: project\_template.template\_description | | `project_template.project_name` | string | Name of the resource | | `project_template.project_description` | string | Output field: project\_template.project\_description | | `project_template.icon` | string | Output field: project\_template.icon | | `project_template.project_template_type` | object | Type of the resource | | `project_template.project_template_type.id` | string | Unique identifier | | `project_template.project_template_type.name` | string | Name of the resource | | `project_template.project_template_type.description` | string | Type of the resource | | `project_template.default_schedule` | object | Output field: project\_template.default\_schedule | | `project_template.report_types` | array | Type of the resource | | `project_template.report_types.id` | string | Unique identifier | | `project_template.report_types.name` | string | Name of the resource | | `project_template.widgets` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...` ## Get Assessment by Name Retrieve a specific assessment by name from AttackIQ, using the 'name' parameter for precise identification. ### Endpoint - **URL:** `/v1/assessments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------- | | `parameters.name` | string | Required | Name of the assessment to retrieve in URLencoded format. | ### Input Example `{"parameters":{"name":"Windows Credential Theft"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ----------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `start_date` | object | Date value | | `end_date` | object | Date value | | `project_state` | string | Output field: project\_state | | `default_schedule` | string | Output field: default\_schedule | | `project_template` | object | Output field: project\_template | | `project_template.id` | string | Unique identifier | | `project_template.template_name` | string | Name of the resource | | `project_template.template_description` | string | Output field: project\_template.template\_description | | `project_template.project_name` | string | Name of the resource | | `project_template.project_description` | string | Output field: project\_template.project\_description | | `project_template.icon` | string | Output field: project\_template.icon | | `project_template.project_template_type` | object | Type of the resource | | `project_template.project_template_type.id` | string | Unique identifier | | `project_template.project_template_type.name` | string | Name of the resource | | `project_template.project_template_type.description` | string | Type of the resource | | `project_template.default_schedule` | object | Output field: project\_template.default\_schedule | | `project_template.report_types` | array | Type of the resource | | `project_template.report_types.id` | string | Unique identifier | | `project_template.report_types.name` | string | Name of the resource | | `project_template.widgets` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...` ## Get Assessment Detection Run Status Retrieves the completion status of an on-demand assessment run in AttackIQ using a specified project\_id. ### Endpoint - **URL:** `/v1/connector_phase_results/pending` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------ | | `parameters.project_id` | string | Required | ID of the assessment to check. | ### Input Example `{"parameters":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `expiration` | object | Output field: expiration | | `pending` | boolean | Output field: pending | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"expiration":null,"pending":false}}` ## Get Assessment Prevention and Detection Results Retrieve detailed results for a specific AttackIQ assessment, including scenario and integration job outcomes, using project ID filters. ### Endpoint - **URL:** `/v1/results` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------- | | `parameters.project_id` | string | Required | ID of the assessment to retrieve results for. | | `parameters.run_id` | string | Optional | Run ID of the assessment. If this field is omitted, you get results from all the assessment runs. | | `parameters.assessment_results` | boolean | Required | Flag should be set to true at all times. | | `parameters.annotate_tag_set` | string | Optional | ID for the tag set whose tags you wish to see annotated on each result. | | `parameters.output` | string | Optional | Specify csv for CSV format instead of JSON. | ### Input Example `{"parameters":{"project_id":"92f3bbf1-5c7b-49fa-a390-163ce880abb0","run_id":"009ee184-964c-4555-bce3-4625dc090416","assessment_results":true,"annotate_tag_set":"055cba1f-07fc-4be9-a238-d533f412108d","output":"csv"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | string | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.modified` | string | Result of the operation | | `results.project` | string | Result of the operation | | `results.master_job` | string | Result of the operation | | `results.scenario` | string | Result of the operation | | `results.scenario_type` | string | Type of the resource | | `results.asset` | object | Result of the operation | | `results.asset.ipv4_address` | string | Result of the operation | | `results.asset.hostname` | string | Name of the resource | | `results.asset.id` | string | Unique identifier | | `results.asset_group` | object | Result of the operation | | `results.job_state` | string | Result of the operation | | `results.outcome` | string | Result of the operation | | `results.result_id` | string | Unique identifier | | `results.vendor_product_result_summaries` | array | Result of the operation | | `results.vendor_product_result_summaries.id` | string | Unique identifier | | `results.vendor_product_result_summaries.outcome` | number | Result of the operation | | `results.vendor_product_result_summaries.vendor_product` | object | Result of the operation | | `results.vendor_product_result_summaries.vendor_product.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":120,"next":"https://firedrill.attackiq.com/v1/results?page=2&assessment_results=true&project...","previous":null,"results":[{}]}}` ## Get Scenario by ID Retrieves a specific AttackIQ scenario using the provided scenario ID. ### Endpoint - **URL:** `/v1/scenarios/{{scenario_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.scenario_id` | string | Required | The ID of the scenario to retrieve. | ### Input Example `{"path_parameters":{"scenario_id":"7719b7bc-b37b-43d2-8455-0afc218638ab"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.second_id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.scenario_template` | object | Result of the operation | | `results.scenario_template.id` | string | Unique identifier | | `results.scenario_template.tracker_id` | string | Unique identifier | | `results.scenario_template.name` | string | Name of the resource | | `results.scenario_template.description` | string | Result of the operation | | `results.scenario_template.version` | string | Result of the operation | | `results.scenario_template.zip_file` | string | Result of the operation | | `results.scenario_template.zip_file_sha1` | string | Result of the operation | | `results.scenario_template.descriptor_json` | object | Result of the operation | | `results.scenario_template.descriptor_json.phases` | array | Result of the operation | | `results.scenario_template.descriptor_json.phases.trackerId` | string | Unique identifier | | `results.scenario_template.descriptor_json.phases.description` | string | Result of the operation | | `results.scenario_template.descriptor_json.phases.subject` | string | Result of the operation | | `results.scenario_template.descriptor_json.sourceUrl` | string | URL endpoint for the request | | `results.scenario_template.descriptor_json.description` | string | Result of the operation | ### Output Example `{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}` ## Get Scenario by Name Retrieve a specific AttackIQ scenario by providing the full name as a parameter. ### Endpoint - **URL:** `/v1/scenarios` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------- | | `parameters.name` | string | Required | Name of the scenario to retrieve in URL encoded format. | ### Input Example `{"parameters":{"name":"Dump Credentials"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.second_id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.scenario_template` | object | Result of the operation | | `results.scenario_template.id` | string | Unique identifier | | `results.scenario_template.tracker_id` | string | Unique identifier | | `results.scenario_template.name` | string | Name of the resource | | `results.scenario_template.description` | string | Result of the operation | | `results.scenario_template.version` | string | Result of the operation | | `results.scenario_template.zip_file` | string | Result of the operation | | `results.scenario_template.zip_file_sha1` | string | Result of the operation | | `results.scenario_template.descriptor_json` | object | Result of the operation | | `results.scenario_template.descriptor_json.phases` | array | Result of the operation | | `results.scenario_template.descriptor_json.phases.trackerId` | string | Unique identifier | | `results.scenario_template.descriptor_json.phases.description` | string | Result of the operation | | `results.scenario_template.descriptor_json.phases.subject` | string | Result of the operation | | `results.scenario_template.descriptor_json.sourceUrl` | string | URL endpoint for the request | | `results.scenario_template.descriptor_json.description` | string | Result of the operation | ### Output Example `{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}` ## Get Scenario by Tag Retrieve scenarios tagged with a specific identifier in AttackIQ, requiring the 'tag' parameter. ### Endpoint - **URL:** `/v1/scenarios` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------- | | `parameters.tag` | string | Required | ID of the tag attached to a list 1 or more scenarios. | ### Input Example `{"parameters":{"tag":"866d09c3-556f-4165-9ef9-e2c4807e7868"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.second_id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.scenario_template` | object | Result of the operation | | `results.scenario_template.id` | string | Unique identifier | | `results.scenario_template.tracker_id` | string | Unique identifier | | `results.scenario_template.name` | string | Name of the resource | | `results.scenario_template.description` | string | Result of the operation | | `results.scenario_template.version` | string | Result of the operation | | `results.scenario_template.zip_file` | string | Result of the operation | | `results.scenario_template.zip_file_sha1` | string | Result of the operation | | `results.scenario_template.descriptor_json` | object | Result of the operation | | `results.scenario_template.descriptor_json.phases` | array | Result of the operation | | `results.scenario_template.descriptor_json.phases.trackerId` | string | Unique identifier | | `results.scenario_template.descriptor_json.phases.description` | string | Result of the operation | | `results.scenario_template.descriptor_json.phases.subject` | string | Result of the operation | | `results.scenario_template.descriptor_json.sourceUrl` | string | URL endpoint for the request | | `results.scenario_template.descriptor_json.description` | string | Result of the operation | ### Output Example `{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}` ## Get Test by ID Retrieve details for a specific test in AttackIQ using the provided test ID. ### Endpoint - **URL:** `/v1/tests/{{test_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------- | | `path_parameters.test_id` | string | Required | The ID of the test to retrieve. | ### Input Example `{"path_parameters":{"test_id":"ac84a28a-2fcf-4313-aacf-6962e448af28"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | object | Result of the operation | | `results.project` | string | Result of the operation | | `results.total_asset_count` | number | Result of the operation | | `results.cron_expression` | string | Result of the operation | | `results.runnable` | boolean | Result of the operation | | `results.scheduled_count` | number | Result of the operation | | `results.created` | string | Result of the operation | | `results.modified` | string | Result of the operation | | `results.using_default_assets` | boolean | Result of the operation | | `results.using_default_schedule` | boolean | Result of the operation | | `results.order` | number | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":1,"next":null,"previous":null,"results":[{}]}}` ## Get Test Run Status Retrieve the current status of a specific test run within an assessment in AttackIQ using the test\_id. ### Endpoint - **URL:** `/v1/tests/{{test_id}}/get_status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------------------- | | `path_parameters.test_id` | string | Required | The ID of the test for which to retrieve the run status. | ### Input Example `{"path_parameters":{"test_id":"9d002efa-facf-4121-96e8-c46d178238ef"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `detected` | number | Output field: detected | | `failed` | number | Output field: failed | | `finished` | boolean | Output field: finished | | `passed` | number | Output field: passed | | `errored` | number | Error message if any | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"detected":0,"failed":0,"finished":true,"passed":1,"errored":0,"total":1}}` ## Get Tests by Name Retrieves detailed information for a specified test by name from AttackIQ. ### Endpoint - **URL:** `/v1/tests` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.name` | string | Required | Name of the test to retrieve in UR encoded format. | ### Input Example `{"parameters":{"name":"Browser"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `previous` | object | Output field: previous | | `next` | string | Output field: next | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | object | Result of the operation | | `results.project` | string | Result of the operation | | `results.total_asset_count` | number | Result of the operation | | `results.cron_expression` | string | Result of the operation | | `results.runnable` | boolean | Result of the operation | | `results.scheduled_count` | number | Result of the operation | | `results.created` | string | Result of the operation | | `results.modified` | string | Result of the operation | | `results.using_default_assets` | boolean | Result of the operation | | `results.using_default_schedule` | boolean | Result of the operation | | `results.order` | number | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":67,"previous":null,"next":"https://firedrill.attackiq.com/v1/tests?name=Browser&page=2&show_last_result=tru...","results":[{}]}}` ## Run an Assessment Initiates all tests within a specified assessment in AttackIQ using the provided assessment ID. ### Endpoint - **URL:** `/v1/assessments/{{assessment_id}}/run_all` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.assessment_id` | string | Required | ID of the assessment to which assets will be added. | ### Input Example `{"json_body":{},"path_parameters":{"assessment_id":"3a139a8-f87b-424d-80a5-6a0087ff92ea"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | | `run_id` | string | Unique identifier | | `started_at` | string | Output field: started\_at | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"message":"Successfully started running all tests in project: Test Assessment","run_id":"009ee184-964c-4555-bce3-4625dc090416","started_at":"2019-08-23T22:48:35.771844"}}` ## Search for Assessments Retrieve AttackIQ assessments that match specific search terms provided by the user. ### Endpoint - **URL:** `/v1/assessments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.search` | string | Required | Parts of assessment names in UR encoded format. | ### Input Example `{"parameters":{"search":"Windows Credentials"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------- | -------- | ----------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `start_date` | object | Date value | | `end_date` | object | Date value | | `project_state` | string | Output field: project\_state | | `default_schedule` | string | Output field: default\_schedule | | `project_template` | object | Output field: project\_template | | `project_template.id` | string | Unique identifier | | `project_template.template_name` | string | Name of the resource | | `project_template.template_description` | string | Output field: project\_template.template\_description | | `project_template.project_name` | string | Name of the resource | | `project_template.project_description` | string | Output field: project\_template.project\_description | | `project_template.icon` | string | Output field: project\_template.icon | | `project_template.project_template_type` | object | Type of the resource | | `project_template.project_template_type.id` | string | Unique identifier | | `project_template.project_template_type.name` | string | Name of the resource | | `project_template.project_template_type.description` | string | Type of the resource | | `project_template.default_schedule` | object | Output field: project\_template.default\_schedule | | `project_template.report_types` | array | Type of the resource | | `project_template.report_types.id` | string | Unique identifier | | `project_template.report_types.name` | string | Name of the resource | | `project_template.widgets` | array | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"13a139a8-f87b-424d-80a5-6a0087ff92ea","name":"Windows Credential Theft","description":"Common techniques to obtain passwords from Windows and browsers","start_date":null,"end_date":null,"project_state":"Active","default_schedule":"5;20;*;*;*","project_template":{"id":"c297b3fa-1c56-4e57-88bd-08ec19ec09bd","template_name":"Windows Credential Theft","template_description":"Common techniques to obtain passwords from Windows a...` ## Search For Scenarios Retrieve AttackIQ scenarios by searching with specific terms in their names or descriptions. ### Endpoint - **URL:** `/v1/scenarios` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------- | | `parameters.search` | string | Required | Search term to filter scenarios by name or description. | ### Input Example `{"parameters":{"search":"macos"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.second_id` | string | Unique identifier | | `results.name` | string | Name of the resource | | `results.description` | string | Result of the operation | | `results.scenario_template` | object | Result of the operation | | `results.scenario_template.id` | string | Unique identifier | | `results.scenario_template.tracker_id` | string | Unique identifier | | `results.scenario_template.name` | string | Name of the resource | | `results.scenario_template.description` | string | Result of the operation | | `results.scenario_template.version` | string | Result of the operation | | `results.scenario_template.zip_file` | string | Result of the operation | | `results.scenario_template.zip_file_sha1` | string | Result of the operation | | `results.scenario_template.descriptor_json` | object | Result of the operation | | `results.scenario_template.descriptor_json.phases` | array | Result of the operation | | `results.scenario_template.descriptor_json.phases.trackerId` | string | Unique identifier | | `results.scenario_template.descriptor_json.phases.description` | string | Result of the operation | | `results.scenario_template.descriptor_json.phases.subject` | string | Result of the operation | | `results.scenario_template.descriptor_json.sourceUrl` | string | URL endpoint for the request | | `results.scenario_template.descriptor_json.description` | string | Result of the operation | ### Output Example `{"count":123,"next":{},"previous":{},"results":[{"id":"12345678-1234-1234-1234-123456789abc","second_id":"string","name":"Example Name","description":"string","scenario_template":{},"model_json":{},"extras":{},"scenario_type":"string","runnable":true,"supported_platforms":{},"company":"string","user":{},"user_id":{},"created":"2024-01-01T00:00:00Z","modified":"string"}]}` ## Set Scenario Parameters Configures parameters for a given scenario in AttackIQ using the scenario\_master\_job\_id and model\_json. ### Endpoint - **URL:** `/v1/test_scenarios/{{scenario_master_job_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ------------------------------------------------------------- | | `path_parameters.scenario_master_job_id` | string | Required | ID of the job that will run the scenario requiring arguments. | | `id` | string | Optional | The ID of the scenario master job to update. | | `model_json` | object | Optional | JSON formatted argument string. | | `model_json.download_url` | string | Optional | URL to download the model JSON. | ### Input Example `{"json_body":{"id":"13e02210-f78e-414f-a04c-8ddc992e7561","model_json":{"download_url":"https://google.com"}},"path_parameters":{"scenario_master_job_id":"13e02210-f78e-414f-a04c-8ddc992e7561"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `scenario_master_job` | string | Output field: scenario\_master\_job | | `scenario` | string | Output field: scenario | | `model_json` | object | Output field: model\_json | | `model_json.download_url` | string | URL endpoint for the request | | `order` | number | Output field: order | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"fd7f4660-54b2-4fd5-b39d-61bf52be76b3","scenario_master_job":"9d002efa-facf-4121-96e8-c46d178238ef","scenario":"03fef867-3227-4d47-a858-90f9ad8cf217","model_json":{"download_url":"https://google.com"},"order":1}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |