--- title: Cofense Intelligence slug: connectors/cofense-intelligence docTags: createdAt: 2026-06-09T16:30:07.069Z --- The Cofense Intelligence connector allows for seamless integration of Cofense's detailed threat intelligence into Swimlane's automated workflows, enhancing threat detection and response activities. Cofense Intelligence provides actionable threat insights, enabling security teams to proactively defend against emerging threats. This connector facilitates the integration of Cofense's rich threat intelligence data into Swimlane Turbine, allowing users to automate the retrieval and analysis of detailed threat reports and IOCs. By leveraging this integration, security operations can enhance incident response, streamline threat hunting, and maintain a proactive security posture with minimal manual intervention. ## Prerequisites To utilize the Cofense Intelligence connector within Swimlane Turbine, ensure you have the following prerequisites: - HTTP Basic Authentication with the following parameters: - URL: The endpoint URL for the Cofense Intelligence API. - API Username: Your Cofense Intelligence account username. - API Token: A unique token used for authenticating API requests. ## Limitations None to date. ## Capabilities This Connector provides the following capabilities: - Fetch Available Feeds - Retrieve New/Updated Threats - Search for Specific Threats - Retrieve Full Malware Threat Details - Retrieve Full Phish Threat Details - Fetch/Download Threat Reports in CEF/STIX/HTML/PDF - Fetch/Download Malware Threat Reports in CEF/STIX/HTML/PDF - Fetch/Download Phish Threat Reports in CEF/STIX/HTML/PDF - Retrieve Threat Screenshots - Search for Indicators of Compromise (IOCs) - Submit New Phish URLs ### Fetch Available Feeds Retrieves the list of feeds our account can access (e.g., “Cofense,” “APWG”). This lets us confirm feed IDs and permissions. ### Retrieve New/Updated Threats Maintain near-real-time ingestion of newly published or updated Cofense Intelligence (malware) and Cofense Credential Phish (phish) threat IDs into Swimlane. ### Search for Specific Threats Allow on-demand lookups of specific threat IDs or indicators (IPs, domains, file hashes) from within Swimlane playbooks. ### Retrieve Full Malware Threat Details When a threat ID is identified (either from /threat/updates or manual search), fetch the complete JSON object containing block sets, domain/IP lists, campaign metadata, etc. ### Retrieve Full Phish Threat Details When a threat ID is identified (either from /threat/updates or manual search), fetch the complete JSON object containing block sets, domain/IP lists, campaign metadata, etc. ### Fetch/Download Threat Reports in CEF/STIX/HTML/PDF Generates standardized reports in CEF/STIX/HTML/PDF formats. ### Fetch/Download Malware Threat Reports in CEF/STIX/HTML/PDF Generates standardized Malware Threat reports in CEF/STIX/HTML/PDF formats. ### Fetch/Download Phish Threat Reports in CEF/STIX/HTML/PDF Generates standardized Phish Threat reports in CEF/STIX/HTML/PDF formats. ### Retrieve Threat Screenshots Obtain Cofense Credential Phish webpage screenshots to embed in incident tickets or dashboards. ### Search for Indicators of Compromise (IOCs) Pull metadata on individual IOCs (hashes, domains, IPs) so we can cross-reference against alerts in Swimlane playbooks. ### Submit New Phish URLs Allow our analysts to submit new suspicious URLs directly from Swimlane into Cofense for analysis. # Configurations ## Cofense Intelligence API Key Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | API Username. | string | Required | | password | API Token for authentication. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Fetch Available Feeds Retrieve a list of accessible feeds for the account, confirming feed IDs and permissions in Cofense Intelligence. ### Endpoint - **URL:** `/feed` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `data` | array | Response data | | `data.id` | number | Response data | | `data.permissions` | object | Response data | | `data.permissions.READ` | boolean | Response data | | `data.permissions.OWNER` | boolean | Response data | | `data.permissions.WRITE` | boolean | Response data | | `data.displayName` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"success":true,"data":[{}]}}` ## Fetch/Download Malware Threat Reports Retrieve or download detailed malware threat reports from Cofense Intelligence using a specific threat ID and format. ### Endpoint - **URL:** `/t3/malware/{{threat_id}}/{{format}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------- | | `path_parameters.threat_id` | number | Required | The Threat ID to return. | | `path_parameters.format` | string | Required | The format to be returned. | ### Input Example `{"path_parameters":{"threat_id":123456789,"format":"html"}}` ## Fetch/Download Phish Threat Reports Retrieve or download detailed phish threat reports from Cofense Intelligence using a specific threat ID and format. ### Endpoint - **URL:** `/t3/phish/{{threat_id}}/{{format}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------- | | `path_parameters.threat_id` | number | Required | The Threat ID to return. | | `path_parameters.format` | string | Required | The format to be returned. | ### Input Example `{"path_parameters":{"threat_id":123456789,"format":"html"}}` ## Fetch/Download Threat Reports Retrieve or download standardized threat reports from Cofense Intelligence in the specified format. ### Endpoint - **URL:** `/t3/{{format}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.format` | string | Required | The format to be returned. | | `parameters.beginTimestamp` | number | Optional | The seconds since epoch from which we should start returning data. If omitted, the current time minus 24 hours is used as the default. | | `parameters.endTimestamp` | number | Optional | The seconds since epoch from which we should end returning data. If omitted, the current time is used as the default. | ### Input Example `{"parameters":{"beginTimestamp":620000000,"endTimestamp":630000000},"path_parameters":{"format":"cef"}}` ## Retrieve Full Threat Malware Details Fetches comprehensive threat details including block sets, domain/IP lists, and campaign metadata for a specified threat ID in Cofense Intelligence. ### Endpoint - **URL:** `/threat/malware/{{threat_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.threat_id` | number | Required | The numeric id of the Cofense Intelligence Report. | ### Input Example `{"path_parameters":{"threat_id":123456789}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `data` | object | Response data | | `data.id` | number | Response data | | `data.relatedSearchTags` | array | Response data | | `data.feeds` | array | Response data | | `data.feeds.id` | number | Response data | | `data.feeds.permissions` | object | Response data | | `data.feeds.permissions.READ` | boolean | Response data | | `data.feeds.permissions.OWNER` | boolean | Response data | | `data.feeds.permissions.WRITE` | boolean | Response data | | `data.feeds.displayName` | string | Response data | | `data.blockSet` | array | Response data | | `data.blockSet.malwareFamily` | object | Response data | | `data.blockSet.malwareFamily.familyName` | string | Response data | | `data.blockSet.malwareFamily.description` | string | Response data | | `data.blockSet.impact` | string | Response data | | `data.blockSet.confidence` | number | Response data | | `data.blockSet.blockType` | string | Response data | | `data.blockSet.role` | string | Response data | | `data.blockSet.roleDescription` | string | Response data | | `data.blockSet.data` | string | Response data | | `data.blockSet.data_1` | string | Response data | | `data.campaignBrandSet` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"id":211729,"relatedSearchTags":[],"feeds":[],"blockSet":[],"campaignBrandSet":[],"extractedStringSet":[],"domainSet":[],"senderEmailSet":[],"executableSet":[],"senderIpSet":[],"senderNameSet":[],"spamUrlSet":[],"subjectSet":[],"campaignLanguageSet":[],"campaignScreenshotSet":[]}}}` ## Retrieve Full Threat Phish Details Fetches comprehensive details for a specified threat ID in Cofense Intelligence, including block sets, domain/IP lists, and campaign metadata. ### Endpoint - **URL:** `/threat/phish/{{threat_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------ | | `path_parameters.threat_id` | number | Required | Parameters for the Retrieve Full Threat Phish Details action | ### Input Example `{"path_parameters":{"threat_id":123456789}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `data` | object | Response data | | `data.id` | number | Response data | | `data.relatedSearchTags` | array | Response data | | `data.feeds` | array | Response data | | `data.feeds.id` | number | Response data | | `data.feeds.permissions` | object | Response data | | `data.feeds.permissions.READ` | boolean | Response data | | `data.feeds.permissions.OWNER` | boolean | Response data | | `data.feeds.permissions.WRITE` | boolean | Response data | | `data.feeds.displayName` | string | Response data | | `data.blockSet` | array | Response data | | `data.blockSet.malwareFamily` | object | Response data | | `data.blockSet.malwareFamily.familyName` | string | Response data | | `data.blockSet.malwareFamily.description` | string | Response data | | `data.blockSet.impact` | string | Response data | | `data.blockSet.confidence` | number | Response data | | `data.blockSet.blockType` | string | Response data | | `data.blockSet.role` | string | Response data | | `data.blockSet.roleDescription` | string | Response data | | `data.blockSet.data` | string | Response data | | `data.blockSet.data_1` | string | Response data | | `data.campaignBrandSet` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"id":211729,"relatedSearchTags":[],"feeds":[],"blockSet":[],"campaignBrandSet":[],"extractedStringSet":[],"domainSet":[],"senderEmailSet":[],"executableSet":[],"senderIpSet":[],"senderNameSet":[],"spamUrlSet":[],"subjectSet":[],"campaignLanguageSet":[],"campaignScreenshotSet":[]}}}` ## Retrieve New/Updated Threats Ingest new or updated threat IDs from Cofense Intelligence for near-real-time updates in Swimlane. ### Endpoint - **URL:** `/threat/updates` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.timestamp` | number | Optional | The epoch in seconds from which data will be returned. If not passed by the caller, it will default to a timestamp of 6 months before the current date. | | `parameters.position` | string | Optional | A unique string used to identify the last record ready by this client. | | `parameters.includeindicators` | boolean | Optional | A boolean value that controls whether to include indicator change\_log entries for each threat. If not passed it will default to false. | ### Input Example `{"parameters":{"timestamp":123456789,"position":"latest","includeindicators":true}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `nextPosition` | string | Output field: nextPosition | | `changelog` | array | Output field: changelog | | `changelog.threatId` | number | Unique identifier | | `changelog.threatType` | string | Type of the resource | | `changelog.occurredOn` | number | Output field: changelog.occurredOn | | `changelog.deleted` | boolean | Output field: changelog.deleted | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"nextPosition":"latest","changelog":[{}]}}` ## Retrieve Threat Screenshots Obtain webpage screenshots of Cofense Credential Phish threats using the threat ID to enhance incident tickets or dashboards. ### Endpoint - **URL:** `/screenshot/{{threat_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.threat_id` | number | Required | The numeric id of the desired Cofense Credential Phish. | ### Input Example `{"path_parameters":{"threat_id":123456789}}` ## Search for Indicators of Compromise Retrieve metadata on IOCs including hashes, domains, and IPs to cross-reference with Swimlane playbook alerts. ### Endpoint - **URL:** `/indicator/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------ | | `parameters.reportType` | string | Optional | Choose whether to search for indicators related to phishing attacks, malware campaigns, or both. | | `parameters.indicatorType` | string | Optional | The type of IOC to search for. | | `parameters.impact` | string | Optional | Choose the impace level of returned IOCs. | | `parameters.sinceLastPublished` | number | Optional | The seconds since epoch from which we should start returning IOC data. | | `parameters.page` | number | Optional | A zero-based integer indicating the page of results to return. | | `parameters.resultsPerPage` | number | Optional | The number of Threat IDs to include in a page. | ### Input Example `{"parameters":{"reportType":"all","indicatorType":"all","impact":"all","sinceLastPublished":30,"page":0,"resultsPerPage":100}}` ## Search for Specific Threats Perform on-demand lookups of threat IDs or indicators such as IPs, domains, and file hashes using Cofense Intelligence within Swimlane playbooks. ### Endpoint - **URL:** `/threat/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.threatType` | string | Optional | Choose whether to search for phishing attacks, malware campaigns, or both. | | `parameters.page` | number | Optional | A one-based integer indicating the page of results to return. | | `parameters.resultsPerPage` | number | Optional | The number of Threat IDs to include in a page. | | `parameters.threatId` | string | Optional | The unique identifier for a threat, the format of this value is a prefix of either a "p\_" for phish (Cofense Credential Phish) or "m\_" for malware (Cofense Intelligence) followed by the threatNativeId value. | | `parameters.threatNativeId` | string | Optional | The numeric native if of a given threat. The threatNativeId and threatType make up a unique key for any individual threat. | | `parameters.beginTimestamp` | number | Optional | The secondds since epoch from which we should start returning data. | | `parameters.endTimestamp` | number | Optional | The seconds since epoch from which we should end returning data. | | `parameters.extractedString` | string | Optional | Search for extracted strings discovered within malware campaigns. | | `parameters.malwareSenderName` | string | Optional | Search for the sender name of malware campaigns. | | `parameters.malwareSubject` | string | Optional | Search the message subject associated with malware campaigns. | | `parameters.dropMail` | string | Optional | Search drop mail addresses associated with threats. | | `parameters.phishingASN` | number | Optional | Search the ASN associated with aphishing threat. | | `parameters.phishingASNCountryCode` | string | Optional | Search the country code associated with phihing threats. | | `parameters.phishingASNOrganization` | string | Optional | Search the ASN organization associated with phishing threats. | | `parameters.brand` | string | Optional | This may be specified multiple times. Search for brands associated with a threat. This search criteria must match the exact brand name used to categorize a threat within Cofense. | | `parameters.kitMD5` | string | Optional | May be specified multiple times. Search for threats associated with the provided kit hash value (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.kitHash` | string | Optional | May be specified multiple times. Search for threats associated with the provided kit hash value (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.malwareArtifactMD5` | string | Optional | May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.malwareArtifactHash` | string | Optional | May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.webComponentMD5` | string | Optional | May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.webComponentHash` | string | Optional | May be specified multiple times. Search for threats associated with the provided malware artifact hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.allMD5` | string | Optional | May be specified multiple times. Search for threats associated with the provided hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.allHash` | string | Optional | May be specified multiple times. Search for threats associated with the provided hash (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512). | | `parameters.hasKit` | boolean | Optional | Search for threats which have an associated kit. | | `parameters.urlSearch` | string | Optional | A specific url to search for, this supports exact and partial matching of urls. | ### Input Example `{"parameters":{"threatType":"all","page":1,"resultsPerPage":10,"threatId":"p_123456","threatNativeId":"native_123456","beginTimestamp":123456789,"endTimestamp":987654321,"extractedString":"example","malwareSenderName":"malware_sender","malwareSubject":"malware_subject","dropMail":"drop_mail","phishingASN":1234,"phishingASNCountryCode":"US","phishingASNOrganization":"phishing_org","brand":"example_brand","kitMD5":"MD5","kitHash":"SHA-1","malwareArtifactMD5":"md5Hex","malwareArtifactHash":"SHA-1","webComponentMD5":"MD5","webComponentHash":"SHA-1","allMD5":"MD5","allHash":"SHA-224","hasKit":true,"urlSearch":"http://example.com","threatUrlSearch":"http://threat.example.com","reportedUrlSearch":"http://reported.example.com","actionUrlSearch":"http://action.example.com","malwareWatchListUrlSearch":"http://watchlist.example.com","threatIp":"10.10.10.10","malwareSenderIp":"10.10.10.10","malwareWatchListIp":"10.10.10.10","ip":"10.10.10.10","threatDomain":"example.com","reportedDomain":"reported.example.com","malwareDomain":"malware.example.com","malwareWatchListDomain":"watchlist.example.com","domain":"example.com","kitFile":"kit_file.txt","malwareFile":"malware_file.txt","webComponentFile":"web_component_file.txt","file":"file.txt","phishingTitle":"Phishing Title","language":"en","malwareFamily":"malware_family","watchlistEmail":"test@doc.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `data` | object | Response data | | `data.page` | object | Response data | | `data.page.page` | object | Response data | | `data.page.page.currentPage` | number | Response data | | `data.page.page.currentElements` | number | Response data | | `data.page.page.totalPages` | number | Response data | | `data.page.page.totalElements` | number | Response data | | `data.page.threats` | array | Response data | | `data.page.threats.id` | number | Response data | | `data.page.threats.permissions` | object | Response data | | `data.page.threats.permissions.OWNER` | boolean | Response data | | `data.page.threats.permissions.WRITE` | boolean | Response data | | `data.page.threats.permissions.READ` | boolean | Response data | | `data.page.threats.displayName` | string | Response data | | `data.page.screenshot` | object | Response data | | `data.page.screenshot.url` | string | Response data | | `data.page.confirmedDate` | number | Response data | | `data.page.ipDetail` | object | Response data | | `data.page.ipDetail.ip` | string | Response data | | `data.page.ipDetail.lookupOn` | number | Response data | | `data.page.ipDetail.latitude` | number | Response data | | `data.page.ipDetail.longitude` | number | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"page":{}}}}` ## Submit New Phish URLs Enables analysts to submit suspicious URLs from Swimlane to Cofense Intelligence for thorough analysis. ### Endpoint - **URL:** `/threat/phish` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `feed` | number | Optional | Parameter for Submit New Phish URLs | | `phishURL` | string | Optional | URL endpoint for the request | ### Input Example `{"json_body":{"feed":2,"phishURL":"http://downloadpdf.lixter.com/secure/cecaccountstatement/"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | boolean | Whether the operation was successful | | `data` | object | Response data | | `data.urlCount` | number | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"success":true,"data":{"urlCount":1}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |