Cofense Intelligence

The Cofense Intelligence connector allows for seamless integration of Cofense's detailed threat intelligence into Swimlane's automated workflows, enhancing threat detection and response activities.

Cofense Intelligence provides actionable threat insights, enabling security teams to proactively defend against emerging threats. This connector facilitates the integration of Cofense's rich threat intelligence data into Swimlane Turbine, allowing users to automate the retrieval and analysis of detailed threat reports and IOCs. By leveraging this integration, security operations can enhance incident response, streamline threat hunting, and maintain a proactive security posture with minimal manual intervention.

Prerequisites

To utilize the Cofense Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites:

HTTP Basic Authentication with the following parameters:

URL: The endpoint URL for the Cofense Intelligence API.

API Username: Your Cofense Intelligence account username.

API Token: A unique token used for authenticating API requests.

Limitations

None to date.

Capabilities

This Connector provides the following capabilities:

Fetch Available Feeds

Retrieve New/Updated Threats

Search for Specific Threats

Retrieve Full Malware Threat Details

Retrieve Full Phish Threat Details

Fetch/Download Threat Reports in CEF/STIX/HTML/PDF

Fetch/Download Malware Threat Reports in CEF/STIX/HTML/PDF

Fetch/Download Phish Threat Reports in CEF/STIX/HTML/PDF

Retrieve Threat Screenshots

Search for Indicators of Compromise (IOCs)

Submit New Phish URLs

Fetch Available Feeds

Retrieves the list of feeds our account can access (e.g., “Cofense,” “APWG”). This lets us confirm feed IDs and permissions.

Retrieve New/Updated Threats

Maintain near-real-time ingestion of newly published or updated Cofense Intelligence (malware) and Cofense Credential Phish (phish) threat IDs into Swimlane.

Search for Specific Threats

Allow on-demand lookups of specific threat IDs or indicators (IPs, domains, file hashes) from within Swimlane playbooks.

Retrieve Full Malware Threat Details

When a threat ID is identified (either from /threat/updates or manual search), fetch the complete JSON object containing block sets, domain/IP lists, campaign metadata, etc.

Retrieve Full Phish Threat Details

When a threat ID is identified (either from /threat/updates or manual search), fetch the complete JSON object containing block sets, domain/IP lists, campaign metadata, etc.

Fetch/Download Threat Reports in CEF/STIX/HTML/PDF

Generates standardized reports in CEF/STIX/HTML/PDF formats.

Fetch/Download Malware Threat Reports in CEF/STIX/HTML/PDF

Generates standardized Malware Threat reports in CEF/STIX/HTML/PDF formats.

Fetch/Download Phish Threat Reports in CEF/STIX/HTML/PDF

Generates standardized Phish Threat reports in CEF/STIX/HTML/PDF formats.

Retrieve Threat Screenshots

Obtain Cofense Credential Phish webpage screenshots to embed in incident tickets or dashboards.

Search for Indicators of Compromise (IOCs)

Pull metadata on individual IOCs (hashes, domains, IPs) so we can cross-reference against alerts in Swimlane playbooks.

Submit New Phish URLs

Allow our analysts to submit new suspicious URLs directly from Swimlane into Cofense for analysis.

Configurations

Cofense Intelligence API Key Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	API Username.	string	Required
password	API Token for authentication.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Fetch Available Feeds

Retrieve a list of accessible feeds for the account, confirming feed IDs and permissions in Cofense Intelligence.

Endpoint

URL: /feed

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful
data	array	Response data
data.id	number	Response data
data.permissions	object	Response data
data.permissions.READ	boolean	Response data
data.permissions.OWNER	boolean	Response data
data.permissions.WRITE	boolean	Response data
data.displayName	string	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"success":true,"data":[{}]}}

Fetch/Download Malware Threat Reports

Retrieve or download detailed malware threat reports from Cofense Intelligence using a specific threat ID and format.

Endpoint

URL: /t3/malware/{{threat_id}}/{{format}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threat_id	number	Required	The Threat ID to return.
path_parameters.format	string	Required	The format to be returned.

Input Example

{"path_parameters":{"threat_id":123456789,"format":"html"}}

Fetch/Download Phish Threat Reports

Retrieve or download detailed phish threat reports from Cofense Intelligence using a specific threat ID and format.

Endpoint

URL: /t3/phish/{{threat_id}}/{{format}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threat_id	number	Required	The Threat ID to return.
path_parameters.format	string	Required	The format to be returned.

Input Example

{"path_parameters":{"threat_id":123456789,"format":"html"}}

Fetch/Download Threat Reports

Retrieve or download standardized threat reports from Cofense Intelligence in the specified format.

Endpoint

URL: /t3/{{format}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.format	string	Required	The format to be returned.
parameters.beginTimestamp	number	Optional	The seconds since epoch from which we should start returning data. If omitted, the current time minus 24 hours is used as the default.
parameters.endTimestamp	number	Optional	The seconds since epoch from which we should end returning data. If omitted, the current time is used as the default.

Input Example

{"parameters":{"beginTimestamp":620000000,"endTimestamp":630000000},"path_parameters":{"format":"cef"}}

Retrieve Full Threat Malware Details

Fetches comprehensive threat details including block sets, domain/IP lists, and campaign metadata for a specified threat ID in Cofense Intelligence.

Endpoint

URL: /threat/malware/{{threat_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threat_id	number	Required	The numeric id of the Cofense Intelligence Report.

Input Example

{"path_parameters":{"threat_id":123456789}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful
data	object	Response data
data.id	number	Response data
data.relatedSearchTags	array	Response data
data.feeds	array	Response data
data.feeds.id	number	Response data
data.feeds.permissions	object	Response data
data.feeds.permissions.READ	boolean	Response data
data.feeds.permissions.OWNER	boolean	Response data
data.feeds.permissions.WRITE	boolean	Response data
data.feeds.displayName	string	Response data
data.blockSet	array	Response data
data.blockSet.malwareFamily	object	Response data
data.blockSet.malwareFamily.familyName	string	Response data
data.blockSet.malwareFamily.description	string	Response data
data.blockSet.impact	string	Response data
data.blockSet.confidence	number	Response data
data.blockSet.blockType	string	Response data
data.blockSet.role	string	Response data
data.blockSet.roleDescription	string	Response data
data.blockSet.data	string	Response data
data.blockSet.data_1	string	Response data
data.campaignBrandSet	array	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"id":211729,"relatedSearchTags":[],"feeds":[],"blockSet":[],"campaignBrandSet":[],"extractedStringSet":[],"domainSet":[],"senderEmailSet":[],"executableSet":[],"senderIpSet":[],"senderNameSet":[],"spamUrlSet":[],"subjectSet":[],"campaignLanguageSet":[],"campaignScreenshotSet":[]}}}

Retrieve Full Threat Phish Details

Fetches comprehensive details for a specified threat ID in Cofense Intelligence, including block sets, domain/IP lists, and campaign metadata.

Endpoint

URL: /threat/phish/{{threat_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threat_id	number	Required	Parameters for the Retrieve Full Threat Phish Details action

Input Example

{"path_parameters":{"threat_id":123456789}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful
data	object	Response data
data.id	number	Response data
data.relatedSearchTags	array	Response data
data.feeds	array	Response data
data.feeds.id	number	Response data
data.feeds.permissions	object	Response data
data.feeds.permissions.READ	boolean	Response data
data.feeds.permissions.OWNER	boolean	Response data
data.feeds.permissions.WRITE	boolean	Response data
data.feeds.displayName	string	Response data
data.blockSet	array	Response data
data.blockSet.malwareFamily	object	Response data
data.blockSet.malwareFamily.familyName	string	Response data
data.blockSet.malwareFamily.description	string	Response data
data.blockSet.impact	string	Response data
data.blockSet.confidence	number	Response data
data.blockSet.blockType	string	Response data
data.blockSet.role	string	Response data
data.blockSet.roleDescription	string	Response data
data.blockSet.data	string	Response data
data.blockSet.data_1	string	Response data
data.campaignBrandSet	array	Response data

Output Example

Retrieve New/Updated Threats

Ingest new or updated threat IDs from Cofense Intelligence for near-real-time updates in Swimlane.

Endpoint

URL: /threat/updates

Method: POST

Input

Argument Name	Type	Required	Description
parameters.timestamp	number	Optional	The epoch in seconds from which data will be returned. If not passed by the caller, it will default to a timestamp of 6 months before the current date.
parameters.position	string	Optional	A unique string used to identify the last record ready by this client.
parameters.includeindicators	boolean	Optional	A boolean value that controls whether to include indicator change_log entries for each threat. If not passed it will default to false.

Input Example

{"parameters":{"timestamp":123456789,"position":"latest","includeindicators":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
nextPosition	string	Output field: nextPosition
changelog	array	Output field: changelog
changelog.threatId	number	Unique identifier
changelog.threatType	string	Type of the resource
changelog.occurredOn	number	Output field: changelog.occurredOn
changelog.deleted	boolean	Output field: changelog.deleted

Output Example

{"status_code":200,"reason":"OK","json_body":{"nextPosition":"latest","changelog":[{}]}}

Retrieve Threat Screenshots

Obtain webpage screenshots of Cofense Credential Phish threats using the threat ID to enhance incident tickets or dashboards.

Endpoint

URL: /screenshot/{{threat_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.threat_id	number	Required	The numeric id of the desired Cofense Credential Phish.

Input Example

{"path_parameters":{"threat_id":123456789}}

Search for Indicators of Compromise

Retrieve metadata on IOCs including hashes, domains, and IPs to cross-reference with Swimlane playbook alerts.

Endpoint

URL: /indicator/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.reportType	string	Optional	Choose whether to search for indicators related to phishing attacks, malware campaigns, or both.
parameters.indicatorType	string	Optional	The type of IOC to search for.
parameters.impact	string	Optional	Choose the impace level of returned IOCs.
parameters.sinceLastPublished	number	Optional	The seconds since epoch from which we should start returning IOC data.
parameters.page	number	Optional	A zero-based integer indicating the page of results to return.
parameters.resultsPerPage	number	Optional	The number of Threat IDs to include in a page.

Input Example

{"parameters":{"reportType":"all","indicatorType":"all","impact":"all","sinceLastPublished":30,"page":0,"resultsPerPage":100}}

Search for Specific Threats

Perform on-demand lookups of threat IDs or indicators such as IPs, domains, and file hashes using Cofense Intelligence within Swimlane playbooks.

Endpoint

URL: /threat/search

Method: POST

Input

Argument Name	Type	Required	Description
parameters.threatType	string	Optional	Choose whether to search for phishing attacks, malware campaigns, or both.
parameters.page	number	Optional	A one-based integer indicating the page of results to return.
parameters.resultsPerPage	number	Optional	The number of Threat IDs to include in a page.
parameters.threatId	string	Optional	The unique identifier for a threat, the format of this value is a prefix of either a "p_" for phish (Cofense Credential Phish) or "m_" for malware (Cofense Intelligence) followed by the threatNativeId value.
parameters.threatNativeId	string	Optional	The numeric native if of a given threat. The threatNativeId and threatType make up a unique key for any individual threat.
parameters.beginTimestamp	number	Optional	The secondds since epoch from which we should start returning data.
parameters.endTimestamp	number	Optional	The seconds since epoch from which we should end returning data.
parameters.extractedString	string	Optional	Search for extracted strings discovered within malware campaigns.
parameters.malwareSenderName	string	Optional	Search for the sender name of malware campaigns.
parameters.malwareSubject	string	Optional	Search the message subject associated with malware campaigns.
parameters.dropMail	string	Optional	Search drop mail addresses associated with threats.
parameters.phishingASN	number	Optional	Search the ASN associated with aphishing threat.
parameters.phishingASNCountryCode	string	Optional	Search the country code associated with phihing threats.
parameters.phishingASNOrganization	string	Optional	Search the ASN organization associated with phishing threats.
parameters.brand	string	Optional	This may be specified multiple times. Search for brands associated with a threat. This search criteria must match the exact brand name used to categorize a threat within Cofense.
parameters.kitMD5	string	Optional	May be specified multiple times. Search for threats associated with the provided kit hash value (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.kitHash	string	Optional	May be specified multiple times. Search for threats associated with the provided kit hash value (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.malwareArtifactMD5	string	Optional	May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.malwareArtifactHash	string	Optional	May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.webComponentMD5	string	Optional	May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.webComponentHash	string	Optional	May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.allMD5	string	Optional	May be specified multiple times. Search for threats associated with the provided hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.allHash	string	Optional	May be specified multiple times. Search for threats associated with the provided hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512).
parameters.hasKit	boolean	Optional	Search for threats which have an associated kit.
parameters.urlSearch	string	Optional	A specific url to search for, this supports exact and partial matching of urls.

Input Example

{"parameters":{"threatType":"all","page":1,"resultsPerPage":10,"threatId":"p_123456","threatNativeId":"native_123456","beginTimestamp":123456789,"endTimestamp":987654321,"extractedString":"example","malwareSenderName":"malware_sender","malwareSubject":"malware_subject","dropMail":"drop_mail","phishingASN":1234,"phishingASNCountryCode":"US","phishingASNOrganization":"phishing_org","brand":"example_brand","kitMD5":"MD5","kitHash":"SHA-1","malwareArtifactMD5":"md5Hex","malwareArtifactHash":"SHA-1","webComponentMD5":"MD5","webComponentHash":"SHA-1","allMD5":"MD5","allHash":"SHA-224","hasKit":true,"urlSearch":"http://example.com","threatUrlSearch":"http://threat.example.com","reportedUrlSearch":"http://reported.example.com","actionUrlSearch":"http://action.example.com","malwareWatchListUrlSearch":"http://watchlist.example.com","threatIp":"10.10.10.10","malwareSenderIp":"10.10.10.10","malwareWatchListIp":"10.10.10.10","ip":"10.10.10.10","threatDomain":"example.com","reportedDomain":"reported.example.com","malwareDomain":"malware.example.com","malwareWatchListDomain":"watchlist.example.com","domain":"example.com","kitFile":"kit_file.txt","malwareFile":"malware_file.txt","webComponentFile":"web_component_file.txt","file":"file.txt","phishingTitle":"Phishing Title","language":"en","malwareFamily":"malware_family","watchlistEmail":"[email protected]"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful
data	object	Response data
data.page	object	Response data
data.page.page	object	Response data
data.page.page.currentPage	number	Response data
data.page.page.currentElements	number	Response data
data.page.page.totalPages	number	Response data
data.page.page.totalElements	number	Response data
data.page.threats	array	Response data
data.page.threats.id	number	Response data
data.page.threats.permissions	object	Response data
data.page.threats.permissions.OWNER	boolean	Response data
data.page.threats.permissions.WRITE	boolean	Response data
data.page.threats.permissions.READ	boolean	Response data
data.page.threats.displayName	string	Response data
data.page.screenshot	object	Response data
data.page.screenshot.url	string	Response data
data.page.confirmedDate	number	Response data
data.page.ipDetail	object	Response data
data.page.ipDetail.ip	string	Response data
data.page.ipDetail.lookupOn	number	Response data
data.page.ipDetail.latitude	number	Response data
data.page.ipDetail.longitude	number	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"page":{}}}}

Submit New Phish URLs

Enables analysts to submit suspicious URLs from Swimlane to Cofense Intelligence for thorough analysis.

Endpoint

URL: /threat/phish

Method: POST

Input

Argument Name	Type	Required	Description
feed	number	Optional	Parameter for Submit New Phish URLs
phishURL	string	Optional	URL endpoint for the request

Input Example

{"json_body":{"feed":2,"phishURL":"http://downloadpdf.lixter.com/secure/cecaccountstatement/"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
success	boolean	Whether the operation was successful
data	object	Response data
data.urlCount	number	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"urlCount":1}}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT