Cofense Triage

Cofense Triage is an email security platform that helps organizations detect and respond to phishing threats.

Cofense Triage is a leading phishing threat analysis and response platform that helps organizations manage and respond to phishing threats effectively. By integrating with Swimlane Turbine, users can automate the categorization of phishing reports, create and manage threat indicators, and streamline incident response processes. This integration enhances security operations by providing real-time insights and automating repetitive tasks, allowing security teams to focus on more strategic initiatives.

Prerequisites

Before you can use the Cofense Triage connector for Turbine, you'll need access to the Cofense Triage API. This requires the following:

OAuth 2.0 Client Credentials authentication using the following parameters:

URL: The endpoint URL for accessing the Cofense Triage API.

Client ID: The unique identifier for your application to authenticate with the API.

Client Secret: A secret key used in conjunction with the Client ID to authenticate your application.

Capabilities

This connector provides the following capabilities:

Categorize a Report

Create a Threat Indicator

Create Category

Create Response

Delete To-Many Relationship

Delete To-One Relationship

Get a Category

Get a Cluster

Get a Header

Get a Hostname

Get a Report

Get a Reporter

Get a Response

Get a Rule

Get a Threat Indicator ... and so on

Installation

You will need to generate a Cofense Triage API token to use this connector.

To generate the API token:

Open Administration > Account Management > Operators.

In the API Token Actions column of the superuser who will access the API, click (+) to generate the token for that superuser. Cofense Triage generates the token and displays the token in the API Token column.

You will use the token and associated email address in the asset of this connection.

Filtering Lists

As explained in the API documentation, the general form of the URL is: https://hostname/api/public/v2/example_resources?filter[ATTRIBUTE_OP]=VALUE

Given that a query string can be of arbitrary size, Swimlane accepts a query string with the format: filter[attribute_name_1_OP]=value_1,value_2...value_n&filter[attribute_name_2_OP]=value_1,value_2...value_n&filter[attribute_name_n_OP]=value_1,value_2...value_n

This string, if given, will be appended to the request query.

Limit Results

Some tasks receive an optional limit parameter. When given, buckets of 50 records are going to be returned up to the limit defined.

Filter OPs

Comparison Operators

This is the default comparison operator if no operator is specified. Returns results when an attribute is equal to the supplied value.

not_eq

Returns results when an attribute is not equal to the supplied value.

Returns results when an attribute is less than the supplied value.

lteq

Returns results when an attribute is less than or equal to the supplied value.

Returns results when an attribute is greater than the supplied value.

gteq

Returns results when an attribute is greater than or equal to the supplied value.

Examples

filter[report_count]=5 filter[report_count_eq]=5 filter[report_count_not_eq]=5 filter[report_count_not_lt]=100 filter[report_count_not_lteq]=101 filter[report_count_not_gt]=0 filter[report_count_not_gteq]=1 filter[id]=1,2,3,4 filter[id_gteq]=5

String Comparison Operators

The Cofense Triage API also permits string comparison operators in addition to the standard operators above.

start

Returns results when an attribute starts with the supplied value.

not_start

Returns results when an attribute does not start with the supplied value.

Returns results when an attribute ends with the supplied value.

not_end

Returns results when an attribute does not end with the supplied value.

cont

Returns results when an attribute contains the supplied value.

not_cont

Returns results when an attribute does not contain the supplied value.

Examples

filter[subject_start]=congratulations filter[subject_not_start]=voice filter[subject_end]=urgent payment filter[subject_not_end]=payment filter[subject_cont]=gift,present filter[subject_not_cont]=notification

Array Comparison Operators

Some resources have an array attribute that contains a list of values. Array attributes follow a common usage pattern, but the filters supported will vary. Reference the resource description for available filters.

any_OP

Returns resources where any value in the array matches the standard or string comparison operator ( OP ).

Examples

filter[filenames_any]=.png filter[filenames_any_start]=taco filter[filenames_any_end]=png filter[filenames_any_cont]=menu

Some resources have a tag_list attribute that contains a list of Triage tags that were applied to that resource. For example, the report resourceʼs categorization_tag_list attribute contains any tags assigned to a report when the report was processed.

Tag List attributes do not support the standard or string comparison operators. Attributes of this type support the following comparison operators:

Returns results when a resource is tagged with any of the specified tags.

Returns results when a resource is tagged with all of the specified tags.

none

Returns results when a resource is not tagged with any of the specified tags.

Examples

filter[categorization_tag_list_any]=tag1 filter[categorization_tag_list_any]=tag1,tag2 filter[categorization_tag_list_all]=tag1,tag3 filter[categorization_tag_list_none]=tag4

Spare Fieldsets

All API resources can be instructed to only return specific attributes in the endpoint's response by using the fields query parameter. Limiting the amount of returned data in this way can improve the performance of the query.

The general fields syntax is as follows: fields[TYPE]=ATTRIBUTE

TYPE is the name of the resource type.

ATTRIBUTE is the name of the attribute to return.

To return multiple attributes, specify ATTRIBUTE as a comma-separated list. For example: fields[reports]=name,address.

Examples

fields[reports]=subject fields[reports]=subject,match_priority


For more information, access the Cofense Triage API documentation with your Cofense Triage customer account [here](https://community.cofense.com).

This connector was last tested against product version: API version 2

Additional Documentation

Cofense Triage Connector Documentation

Cofense Triage API Documentation

Cofense Triage Authentication Guide

Configurations

Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	Server Host Address.	string	Required
client_id	Client ID used for authentication.	string	Required
client_secret	Client Secret used for authentication.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Categorize a Report

Categorize a report in Cofense Triage using the specified report ID, enabling email responses and tagging.

Endpoint

URL: /api/public/v2/reports/{{id}}/categorize

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	The category ID.
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.category_id	string	Required	A category_id property set to the unique identifier of the category.
data_body.data.outbound_template_id	string	Optional	An outbound_template_id property set to the unique identifier of the outbound template.
data_body.data.categorization_tags	array	Optional	A categorization_tags property set to an array of strings containing the tags to apply to the categorized report.
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"id":1},"data_body":{"data":{"category_id":"1","outbound_template_id":"2","categorization_tags":["one","two","three"]}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}

Create a Threat Indicator

Generate a new threat indicator in Cofense Triage using specified data body and headers.

Endpoint

URL: /api/public/v2/threat_indicators

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Optional	An id property set to the unique identifier for the object.
data_body.data.type	string	Required	A type property set to threat_indicators.
data_body.data.attributes	object	Required	An attributes section containing, at a minimum, these attributes threat_level , threat_type , and threat_value.
data_body.data.attributes.threat_level	string	Required	Response data
data_body.data.attributes.threat_type	string	Required	Response data
data_body.data.attributes.threat_value	string	Required	Response data
data_body.data.attributes.threat_source	string	Optional	Response data
data_body.data.attributes.created_at	string	Optional	Response data
data_body.data.attributes.updated_at	string	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"data_body":{"data":{"id":"1","type":"categories","attributes":{"threat_level":"Malicious","threat_type":"Sender","threat_value":"[email protected]","threat_source":"Triage-UI","created_at":"2022-07-13T09:07:22.562Z","updated_at":"2022-07-13T09:07:22.562Z"}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.threat_level	string	Response data
data.attributes.threat_type	string	Response data
data.attributes.threat_value	string	Response data
data.attributes.threat_source	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.owner	object	Response data
data.relationships.owner.links	object	Response data
data.relationships.owner.links.self	string	Response data
data.relationships.owner.links.related	string	Response data
data.relationships.owner.data	object	Response data
data.relationships.owner.data.type	string	Response data
data.relationships.owner.data.id	string	Response data
data.relationships.comments	object	Response data
data.relationships.comments.links	object	Response data
data.relationships.comments.links.self	string	Response data

Output Example

{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"threat_indicators","links":{},"attributes":{},"relationships":{}}}}

Create Category

Create a new category in Cofense Triage using the specified data body and headers.

Endpoint

URL: /api/public/v2/categories

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Optional	An id property set to the unique identifier for the object.
data_body.data.type	string	Required	A type property set to categories.
data_body.data.attributes	object	Required	An attributes section containing, at a minimum, these attributes name , score , and color.
data_body.data.attributes.name	string	Required	Response data
data_body.data.attributes.score	number	Required	Response data
data_body.data.attributes.malicious	boolean	Optional	Response data
data_body.data.attributes.color	string	Required	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"data_body":{"data":{"id":"1","type":"categories","attributes":{"name":"Crimeware","score":5,"malicious":true,"color":"#c6911f"}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.score	number	Response data
data.attributes.malicious	boolean	Response data
data.attributes.color	string	Response data
data.attributes.archived	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.playbooks	object	Response data
data.relationships.playbooks.links	object	Response data
data.relationships.playbooks.links.self	string	Response data
data.relationships.playbooks.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"categories","links":{},"attributes":{},"relationships":{}}}}

Create Response

Create a new response in Cofense Triage using the specified data body for targeted incident handling.

Endpoint

URL: /api/public/v2/responses

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Optional	Response data
data_body.data.type	string	Required	Response data
data_body.data.attributes	object	Required	Response data
data_body.data.attributes.name	string	Required	Response data
data_body.data.attributes.subject	string	Required	Response data
data_body.data.attributes.body	string	Required	Response data

Input Example

{"data_body":{"data":{"id":"1","type":"responses","attributes":{"name":"Example Response","subject":"Email '[SUBJECT]' reported [REPORT_DATE] is SAFE","body":"<p>The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe.</p>"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data_links_self	string	Response data
data_attributes_bcc_address	string	Response data
data_type	string	Response data
data_id	number	Response data
data_relationships_one_clicks_links_self	string	Response data
data_attributes_cc_address	string	Response data
raw_json	string	Output field: raw_json
data_attributes_description	string	Response data
data_attributes_to_other	number	Response data
data_attributes_to_reporter	number	Response data
data_attributes_attach_original	number	Response data
data_relationships_one_clicks_links_related	string	Response data
data_attributes_updated_at	string	Response data
data_attributes_to_other_address	string	Response data
data_attributes_name	string	Response data
data_attributes_created_at	string	Response data
data_attributes_subject	string	Response data
data_attributes_body	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data_links_self":"Data Links Self","data_attributes_bcc_address":"Data Attributes Bcc Address","data_type":"Data Type","data_id":1,"data_relationships_one_clicks_links_self":"Data Relationships One Clicks Links Self","data_attributes_cc_address":"Data Attributes CC Address","raw_json":"Raw JSON","data_attributes_description":"Data Att...

Delete To-Many Relationship

Remove a specified to-many relationship in Cofense Triage using resource type, ID, and relationship name.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.resource_type	string	Required	The value identified in the Type section of the resource description.
path_parameters.id	string	Required	The Resource ID.
path_parameters.relationship_name	string	Required	The plural name of the related resource, e.g "categories", not "category".
data_body	object	Required	Response data
data_body.data	array	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the related resource.
data_body.data.type	string	Required	A type property set to the type of the related resource.
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"resource_type":"responses","id":"24","relationship_name":"recipes"},"data_body":{"data":[{"id":"1","type":"recipes"},{"id":"2","type":"recipes"}]},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}

Delete To-One Relationship

Remove a specified to-one relationship in Cofense Triage using the provided resource type, ID, and relationship name.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}

Method: DELETE

Input

Argument Name	Type	Required	Description
path_parameters.resource_type	string	Required	The value identified in the Type section of the resource description.
path_parameters.id	string	Required	The Resource ID.
path_parameters.relationship_name	string	Required	The singular name of the related resource, e.g "category", not "categories".

Input Example

{"path_parameters":{"resource_type":"responses","id":"24","relationship_name":"recipes"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}

Get a Category

Retrieve detailed information for a specific category in Cofense Triage using the provided ID.

Endpoint

URL: /api/public/v2/categories/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Category Resource ID.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.score	number	Response data
data.attributes.malicious	boolean	Response data
data.attributes.color	string	Response data
data.attributes.archived	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.playbooks	object	Response data
data.relationships.playbooks.links	object	Response data
data.relationships.playbooks.links.self	string	Response data
data.relationships.playbooks.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

Get a Cluster

Retrieve a specific cluster from Cofense Triage using the provided unique identifier (ID).

Endpoint

URL: /api/public/v2/clusters/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the cluster to fetch.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.risk_score	number	Response data
data.attributes.first_reported_at	string	Response data
data.attributes.oldest_unprocessed_reported_at	string	Response data
data.attributes.last_reported_at	string	Response data
data.attributes.last_received_at	string	Response data
data.attributes.last_from_address	string	Response data
data.attributes.last_subject	string	Response data
data.attributes.average_reporter_reputation	string	Response data
data.attributes.match_priority	number	Response data
data.attributes.tags	array	Response data
data.attributes.host_source	string	Response data
data.attributes.attachments_count	number	Response data
data.attributes.unprocessed_reports_count	number	Response data
data.attributes.processed_reports_count	number	Response data
data.attributes.total_reports_count	number	Response data
data.attributes.rules_count	number	Response data
data.attributes.urls_count	number	Response data

Output Example

Get a Header

Retrieve header information for a specified ID in Cofense Triage using the provided path parameter.

Endpoint

URL: /api/public/v2/headers/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Header ID.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.key	string	Response data
data.attributes.value	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

Get a Hostname

Retrieve detailed host information for a specified ID from Cofense Triage using path parameters.

Endpoint

URL: /api/public/v2/hostnames/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Host ID.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.hostname	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.domain	object	Response data
data.relationships.domain.links	object	Response data
data.relationships.domain.links.self	string	Response data
data.relationships.domain.links.related	string	Response data
data.relationships.domain.data	object	Response data
data.relationships.domain.data.type	string	Response data
data.relationships.domain.data.id	string	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.reports	object	Response data

Output Example

Get a Report

Retrieve detailed information for a specific report in Cofense Triage using the unique identifier provided.

Endpoint

URL: /api/public/v2/reports/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Report ID.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.location	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.from_address	string	Response data
data.attributes.subject	string	Response data
data.attributes.received_at	string	Response data
data.attributes.reported_at	string	Response data
data.attributes.raw_headers	string	Response data
data.attributes.text_body	string	Response data
data.attributes.html_body	string	Response data
data.attributes.md5	string	Response data
data.attributes.sha256	string	Response data
data.attributes.match_priority	number	Response data
data.attributes.attachments_count	number	Response data
data.attributes.comments_count	number	Response data
data.attributes.rules_count	number	Response data
data.attributes.urls_count	number	Response data
data.attributes.tags	array	Response data

Output Example

Get a Reporter

Retrieve detailed information for a specific reporter in Cofense Triage using their unique ID.

Endpoint

URL: /api/public/v2/reporters/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Reporter ID.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.email	string	Response data
data.attributes.reports_count	number	Response data
data.attributes.last_reported_at	string	Response data
data.attributes.reputation_score	number	Response data
data.attributes.vip	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

Get a Response

Retrieve a specific response from Cofense Triage using the provided unique identifier (ID).

Endpoint

URL: /api/public/v2/responses/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The response ID.

Input Example

{"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attributes_attach_original	number	Output field: attributes_attach_original
links_self	string	Output field: links_self
attributes_name	string	Name of the resource
raw_json	string	Output field: raw_json
attributes_body	string	Request body data
attributes_subject	string	Output field: attributes_subject
attributes_to_reporter	number	Output field: attributes_to_reporter
relationships_one_clicks_links_related	string	Output field: relationships_one_clicks_links_related
relationships_one_clicks_links_self	string	Output field: relationships_one_clicks_links_self
id	number	Unique identifier
attributes_updated_at	string	Output field: attributes_updated_at
type	string	Type of the resource
attributes_to_other	number	Output field: attributes_to_other
attributes_created_at	string	Output field: attributes_created_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_attach_original":1,"links_self":"Links Self","attributes_name":"Attributes Name","raw_json":"Raw JSON","attributes_body":"Attributes Body","attributes_subject":"Attributes Subject","attributes_to_reporter":1,"relationships_one_clicks_links_related":"Relationships One Clicks Links Related","relationships_one_clicks_links_sel...

Get a Rule

Retrieve a specific Cofense Triage rule using its unique identifier (ID).

Endpoint

URL: /api/public/v2/rules/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the rule to fetch.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.description	string	Response data
data.attributes.priority	number	Response data
data.attributes.tags	array	Response data
data.attributes.scope	string	Response data
data.attributes.author_name	string	Response data
data.attributes.rule_context	string	Response data
data.attributes.active	boolean	Response data
data.attributes.content	string	Response data
data.attributes.time_to_live	string	Response data
data.attributes.share_with_cofense	boolean	Response data
data.attributes.reports_count	number	Response data
data.attributes.imported_at	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.cluster_context	object	Response data

Output Example

Get a Threat Indicator

Retrieve a specific threat indicator from Cofense Triage using the provided unique identifier.

Endpoint

URL: /api/public/v2/threat_indicators/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the indicator to fetch.
parameters.fields	string	Optional	Parameters for the Get a Threat Indicator action

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.threat_level	string	Response data
data.attributes.threat_type	string	Response data
data.attributes.threat_value	string	Response data
data.attributes.threat_source	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.owner	object	Response data
data.relationships.owner.links	object	Response data
data.relationships.owner.links.self	string	Response data
data.relationships.owner.links.related	string	Response data
data.relationships.owner.data	object	Response data
data.relationships.owner.data.type	string	Response data
data.relationships.owner.data.id	string	Response data
data.relationships.comments	object	Response data
data.relationships.comments.links	object	Response data
data.relationships.comments.links.self	string	Response data

Output Example

Get a URL

Retrieve detailed information for a specific URL in Cofense Triage using the unique identifier (ID) provided.

Endpoint

URL: /api/public/v2/urls/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The URL ID.
parameters.fields	string	Optional	Parameters for the Get a URL action

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.url	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.domain	object	Response data
data.relationships.domain.links	object	Response data
data.relationships.domain.links.self	string	Response data
data.relationships.domain.links.related	string	Response data
data.relationships.hostname	object	Response data
data.relationships.hostname.links	object	Response data
data.relationships.hostname.links.self	string	Response data
data.relationships.hostname.links.related	string	Response data
data.relationships.hostname.data	object	Response data
data.relationships.hostname.data.type	string	Response data
data.relationships.hostname.data.id	string	Response data
data.relationships.clusters	object	Response data

Output Example

Get an Attachment

Retrieve a specific attachment from Cofense Triage using the provided resource ID as a path parameter.

Endpoint

URL: /api/public/v2/attachments/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	ID of the resource to which the attachment belongs.
parameters.fields	string	Optional	Parameters for the Get an Attachment action

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.filename	string	Response data
data.attributes.size	number	Response data
data.attributes.is_child	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.attachment_payload	object	Response data
data.relationships.attachment_payload.links	object	Response data
data.relationships.attachment_payload.links.self	string	Response data
data.relationships.attachment_payload.links.related	string	Response data
data.relationships.attachment_payload.data	object	Response data
data.relationships.attachment_payload.data.type	string	Response data
data.relationships.attachment_payload.data.id	string	Response data
data.relationships.parent	object	Response data
data.relationships.parent.links	object	Response data
data.relationships.parent.links.self	string	Response data
data.relationships.parent.links.related	string	Response data

Output Example

Get an Operator

Retrieve details for a specific operator in Cofense Triage using the provided unique ID.

Endpoint

URL: /api/public/v2/operators/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the operator to fetch.
parameters.fields	string	Optional	Optional field, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.email	string	Response data
data.attributes.first_name	string	Response data
data.attributes.last_name	string	Response data
data.attributes.nickname	string	Response data
data.attributes.time_zone	string	Response data
data.attributes.permissions	object	Response data
data.attributes.permissions.triage	string	Response data
data.attributes.permissions.vision	string	Response data
data.attributes.sso_enabled	boolean	Response data
data.attributes.two_factor_enabled	boolean	Response data
data.attributes.locked	boolean	Response data
data.attributes.sign_in_count	number	Response data
data.attributes.last_sign_in_at	string	Response data
data.attributes.password_changed_at	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data

Output Example

Get Attachment List

Retrieve a list of attachments from Cofense Triage for further analysis or processing.

Endpoint

URL: /api/public/v2/attachments

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-name).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.filename	string	Response data
data.attributes.size	number	Response data
data.attributes.is_child	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.attachment_payload	object	Response data
data.relationships.attachment_payload.links	object	Response data
data.relationships.attachment_payload.links.self	string	Response data
data.relationships.attachment_payload.links.related	string	Response data
data.relationships.attachment_payload.data	object	Response data
data.relationships.attachment_payload.data.type	string	Response data
data.relationships.attachment_payload.data.id	string	Response data
data.relationships.parent	object	Response data
data.relationships.parent.links	object	Response data
data.relationships.parent.links.self	string	Response data
data.relationships.parent.links.related	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Attachment Payload

Retrieve the payload of an attachment from Cofense Triage using a specified ID as a path parameter.

Endpoint

URL: /api/public/v2/attachment_payloads/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	ID of the resource to which the attachment payload belongs.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.mime_type	string	Response data
data.attributes.md5	string	Response data
data.attributes.sha256	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.attachments	object	Response data
data.relationships.attachments.links	object	Response data
data.relationships.attachments.links.self	string	Response data
data.relationships.attachments.links.related	string	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.integration_submissions	object	Response data
data.relationships.integration_submissions.links	object	Response data

Output Example

Get Attachment Payload List

Retrieve a list of attachment payloads from Cofense Triage for analysis or processing.

Endpoint

URL: /api/public/v2/attachment_payloads

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.mime_type	string	Response data
data.attributes.md5	string	Response data
data.attributes.sha256	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.attachments	object	Response data
data.relationships.attachments.links	object	Response data
data.relationships.attachments.links.self	string	Response data
data.relationships.attachments.links.related	string	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.integration_submissions	object	Response data
data.relationships.integration_submissions.links	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Retrieve and classify a list of categories from Cofense Triage to organize reports effectively.

Endpoint

URL: /api/public/v2/categories

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.score	number	Response data
data.attributes.malicious	boolean	Response data
data.attributes.color	string	Response data
data.attributes.archived	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.playbooks	object	Response data
data.relationships.playbooks.links	object	Response data
data.relationships.playbooks.links.self	string	Response data
data.relationships.playbooks.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Comments

List all comments within Cofense Triage to provide a comprehensive overview of user feedback and annotations.

Endpoint

URL: /api/public/v2/comments

Method: GET

Input

Argument Name	Type	Required	Description
parameters.sort	string	Optional	Parameters for the Get Comments action
parameters.filter[tags_any]	string	Optional	Parameters for the Get Comments action
parameters.filter[created_at_gt]	string	Optional	Parameters for the Get Comments action
parameters.page[size]	string	Optional	Parameters for the Get Comments action

Input Example

{"parameters":{"sort":"id","filter[tags_any]":"Escalation_ticket","filter[created_at_gt]":"string","page[size]":"50"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.file_name	string	Response data
data.file	string	Response data
meta	object	Output field: meta
meta.record_count	number	Count value
meta.page_count	number	Count value
links	object	Output field: links
links.first	string	Output field: links.first
links.last	string	Output field: links.last

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 02 Sep 2024 08:51:33 GMT","Content-Type":"application/vnd.api+json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","x-xss-protection":"1; mode=block","x-content-type-options":"nosniff","x-download-options":"noopen","x-permitted-cross-domain-policies":"none","referrer-policy":"strict-origin-when-cross-origin","vary":"Accept, Origin","etag":"W/\"acbbf2b0841e547967b280c8f81aff6f\"","Cache-Control":"max-age=0...

Get Download Original File

Retrieve the original file from Cofense Triage using a specific resource ID provided as a path parameter.

Endpoint

URL: /api/public/v2/reports/{{id}}/download

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Report ID.

Input Example

{"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	array	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","file":[]}

Get Download Preview(jpg)

Retrieve a JPEG preview of a report from Cofense Triage using the provided Report ID.

Endpoint

URL: /api/public/v2/reports/{{id}}/download.jpg

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Report ID.

Input Example

{"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Get Download Preview(png)

Retrieve a PNG preview of a specific report from Cofense Triage using the provided Report ID.

Endpoint

URL: /api/public/v2/reports/{{id}}/download.png

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Report ID.

Input Example

{"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}

Get Email Preview Image (PNG)

Download a PNG preview image of an email from Cofense Triage using a unique identifier as the path parameter.

Endpoint

URL: /api/public/v2/reports/{{id}}/download.png

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the report containing the email to generate the preview from.

Input Example

{"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	array	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","file":[]}

Get Header List

Retrieve a list of email headers from Cofense Triage for further analysis.

Endpoint

URL: /api/public/v2/headers

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-name).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.key	string	Response data
data.attributes.value	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Hostnames List

Retrieve a comprehensive list of hostnames from Cofense Triage for enhanced analysis or investigative purposes.

Endpoint

URL: /api/public/v2/hostnames

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"-id","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.hostname	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.domain	object	Response data
data.relationships.domain.links	object	Response data
data.relationships.domain.links.self	string	Response data
data.relationships.domain.links.related	string	Response data
data.relationships.domain.data	object	Response data
data.relationships.domain.data.type	string	Response data
data.relationships.domain.data.id	string	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.reports	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Relationship to Many

Retrieve to-many relationship data for a specified resource in Cofense Triage using the relationship name, ID, and resource type.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/{{relationship_name}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.relationship_name	string	Required	The plural name of the related resource.
path_parameters.id	string	Required	The Resource ID.
path_parameters.resource_type	string	Required	The value identified in the Type section of the resource description.

Input Example

{"path_parameters":{"relationship_name":"rules","id":"24","resource_type":"reports"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attributes_updated_at	string	Output field: attributes_updated_at
relationships_reports_links_related	string	Output field: relationships_reports_links_related
links_self	string	Output field: links_self
attributes_score	number	Score value
type	string	Type of the resource
raw_json	string	Output field: raw_json
relationships_reports_links_self	string	Output field: relationships_reports_links_self
relationships_one_clicks_links_self	string	Output field: relationships_one_clicks_links_self
attributes_malicious	number	Output field: attributes_malicious
attributes_color	string	Output field: attributes_color
relationships_one_clicks_links_related	string	Output field: relationships_one_clicks_links_related
attributes_created_at	string	Output field: attributes_created_at
attributes_name	string	Name of the resource
id	number	Unique identifier
attributes_archived	number	Output field: attributes_archived

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_updated_at":"Attributes Updated At","relationships_reports_links_related":"Relationships Reports Links Related","links_self":"Links Self","attributes_score":1,"type":"type","raw_json":"Raw JSON","relationships_reports_links_self":"Relationships Reports Links Self","relationships_one_clicks_links_self":"Relationships One Cli...

Get Relationship to One

Retrieve to-one relationship data in Cofense Triage by specifying the relationship name, ID, and resource type.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/{{relationship_name}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.relationship_name	string	Required	The singular name of the related resource, e.g "category", not "categories".
path_parameters.id	string	Required	The Resource ID.
path_parameters.resource_type	string	Required	The value identified in the Type section of the resource description.

Input Example

{"path_parameters":{"relationship_name":"rules","id":"24","resource_type":"reports"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attributes_updated_at	string	Output field: attributes_updated_at
relationships_reports_links_related	string	Output field: relationships_reports_links_related
links_self	string	Output field: links_self
attributes_score	number	Score value
type	string	Type of the resource
raw_json	string	Output field: raw_json
relationships_reports_links_self	string	Output field: relationships_reports_links_self
relationships_one_clicks_links_self	string	Output field: relationships_one_clicks_links_self
attributes_malicious	number	Output field: attributes_malicious
attributes_color	string	Output field: attributes_color
relationships_one_clicks_links_related	string	Output field: relationships_one_clicks_links_related
attributes_created_at	string	Output field: attributes_created_at
attributes_name	string	Name of the resource
id	number	Unique identifier
attributes_archived	number	Output field: attributes_archived

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_updated_at":"Attributes Updated At","relationships_reports_links_related":"Relationships Reports Links Related","links_self":"Links Self","attributes_score":1,"type":"type","raw_json":"Raw JSON","relationships_reports_links_self":"Relationships Reports Links Self","relationships_one_clicks_links_self":"Relationships One Cli...

Get Report List

Retrieve a detailed list of reports from Cofense Triage, including identifiers, status, and threat levels.

Endpoint

URL: /api/public/v2/reports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.location	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.from_address	string	Response data
data.attributes.subject	string	Response data
data.attributes.received_at	string	Response data
data.attributes.reported_at	string	Response data
data.attributes.raw_headers	string	Response data
data.attributes.text_body	string	Response data
data.attributes.html_body	string	Response data
data.attributes.md5	string	Response data
data.attributes.sha256	string	Response data
data.attributes.match_priority	number	Response data
data.attributes.attachments_count	number	Response data
data.attributes.comments_count	number	Response data
data.attributes.rules_count	number	Response data
data.attributes.urls_count	number	Response data
data.attributes.tags	array	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Reporter List

Retrieve a detailed list of reporters from Cofense Triage, including contact information and report history.

Endpoint

URL: /api/public/v2/reporters

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.email	string	Response data
data.attributes.reports_count	number	Response data
data.attributes.last_reported_at	string	Response data
data.attributes.reputation_score	number	Response data
data.attributes.vip	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.clusters	object	Response data
data.relationships.clusters.links	object	Response data
data.relationships.clusters.links.self	string	Response data
data.relationships.clusters.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Response List

Retrieve an overview of all available response actions from Cofense Triage.

Endpoint

URL: /api/public/v2/responses

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
attributes_attach_original	number	Output field: attributes_attach_original
attributes_to_other	number	Output field: attributes_to_other
links_self	string	Output field: links_self
type	string	Type of the resource
raw_json	string	Output field: raw_json
attributes_updated_at	string	Output field: attributes_updated_at
attributes_subject	string	Output field: attributes_subject
attributes_to_reporter	number	Output field: attributes_to_reporter
relationships_one_clicks_links_related	string	Output field: relationships_one_clicks_links_related
id	number	Unique identifier
relationships_one_clicks_links_self	string	Output field: relationships_one_clicks_links_self
attributes_name	string	Name of the resource
attributes_body	string	Request body data
attributes_created_at	string	Output field: attributes_created_at

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_attach_original":1,"attributes_to_other":1,"links_self":"Links Self","type":"Type","raw_json":"Raw JSON","attributes_updated_at":"Attributes Updated At","attributes_subject":"Attributes Subject","attributes_to_reporter":1,"relationships_one_clicks_links_related":"Relationships One Clicks Links Related","id":1,"relationships...

Get Rule List

Fetch the list of rules from Cofense Triage for analysis and processing.

Endpoint

URL: /api/public/v2/rules

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.description	string	Response data
data.attributes.priority	number	Response data
data.attributes.tags	array	Response data
data.attributes.scope	string	Response data
data.attributes.author_name	string	Response data
data.attributes.rule_context	string	Response data
data.attributes.active	boolean	Response data
data.attributes.content	string	Response data
data.attributes.time_to_live	string	Response data
data.attributes.share_with_cofense	boolean	Response data
data.attributes.reports_count	number	Response data
data.attributes.imported_at	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.cluster_context	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get Status

Retrieve the current operational health and performance metrics from Cofense Triage.

Endpoint

URL: /api/public/v2/system/status

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.health	object	Response data
data.health.cpu_usage_percent	string	Response data
data.health.memory_in_kilobytes	object	Response data
data.health.memory_in_kilobytes.total_memory	number	Response data
data.health.memory_in_kilobytes.used_memory	number	Response data
data.health.memory_in_kilobytes.active_memory	number	Response data
data.health.memory_in_kilobytes.inactive_memory	number	Response data
data.health.memory_in_kilobytes.free_memory	number	Response data
data.health.partition_used_percent	object	Response data
data.health.partition_used_percent./dev/mapper/triage-root	string	Response data
data.health.partition_used_percent.devtmpfs	string	Response data
data.health.partition_used_percent./dev/sda1	string	Response data
data.health.partition_used_percent./dev/mapper/triage-pgsqldumps	string	Response data
data.health.partition_used_percent./dev/mapper/triage-varlibpgsql	string	Response data
data.health.partition_used_percent./dev/mapper/triage-srv	string	Response data
data.health.partition_used_percent./dev/mapper/triage-pgsqlbu	string	Response data
data.health.last_time_ingested	string	Response data
data.health.last_user_login	string	Response data
data.health.license_expiration	string	Response data
data.status	object	Response data
data.status.mail_account_worker	boolean	Response data
data.status.postgresql	boolean	Response data

Output Example

Get Threat Indicator List

Retrieve a list of Indicators of Compromise (IOCs) classified as malicious, suspicious, or benign from Cofense Triage.

Endpoint

URL: /api/public/v2/threat_indicators

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.threat_level	string	Response data
data.attributes.threat_type	string	Response data
data.attributes.threat_value	string	Response data
data.attributes.threat_source	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.owner	object	Response data
data.relationships.owner.links	object	Response data
data.relationships.owner.links.self	string	Response data
data.relationships.owner.links.related	string	Response data
data.relationships.owner.data	object	Response data
data.relationships.owner.data.type	string	Response data
data.relationships.owner.data.id	string	Response data
data.relationships.comments	object	Response data
data.relationships.comments.links	object	Response data
data.relationships.comments.links.self	string	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Get URL List

Retrieve a comprehensive list of URLs from Cofense Triage for subsequent analysis or action.

Endpoint

URL: /api/public/v2/urls

Method: GET

Input

Argument Name	Type	Required	Description
parameters.page	string	Optional	Optional page to apply to the list. i.e page[number]=VALUE1&page[size]=VALUE2. page[number] is the page number to return. The default is 1. page[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20.
parameters.sort	string	Optional	Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d).
parameters.filter	string	Optional	Optional filter to apply to the list; more than one filter can be defined, i.e filter[ATTRIBUTE1_OP]=VALUE1&filter[ATTRIBUTE2_OP]=VALUE2. See README for further details.
parameters.limit	number	Optional	Maximum number of results to return. Defaults to all results.
parameters.fields	string	Optional	Optional field to apply to the list, i.e fields[Type]=ATTRIBUTE.

Input Example

{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.url	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.domain	object	Response data
data.relationships.domain.links	object	Response data
data.relationships.domain.links.self	string	Response data
data.relationships.domain.links.related	string	Response data
data.relationships.hostname	object	Response data
data.relationships.hostname.links	object	Response data
data.relationships.hostname.links.self	string	Response data
data.relationships.hostname.links.related	string	Response data
data.relationships.hostname.data	object	Response data
data.relationships.hostname.data.type	string	Response data
data.relationships.hostname.data.id	string	Response data
data.relationships.clusters	object	Response data

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}

Update a Category

Update a specific Cofense Triage category by ID, requiring path parameters and data body with attributes.

Endpoint

URL: /api/public/v2/categories/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The Category ID.
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the object.
data_body.data.type	string	Required	A type property set to categories.
data_body.data.attributes	object	Required	An attributes section containing the attributes to update.
data_body.data.attributes.name	string	Optional	Response data
data_body.data.attributes.score	number	Optional	Response data
data_body.data.attributes.malicious	boolean	Optional	Response data
data_body.data.attributes.color	string	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"categories","attributes":{"name":"Crimeware","score":5,"malicious":true,"color":"#c6911f"}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.name	string	Response data
data.attributes.score	number	Response data
data.attributes.malicious	boolean	Response data
data.attributes.color	string	Response data
data.attributes.archived	boolean	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.playbooks	object	Response data
data.relationships.playbooks.links	object	Response data
data.relationships.playbooks.links.self	string	Response data
data.relationships.playbooks.links.related	string	Response data
data.relationships.reports	object	Response data
data.relationships.reports.links	object	Response data
data.relationships.reports.links.self	string	Response data
data.relationships.reports.links.related	string	Response data

Output Example

Update a Report

Update a specific Cofense Triage report by ID using path parameters and data body.

Endpoint

URL: /api/public/v2/reports/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The report ID.
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the object.
data_body.data.type	string	Required	A type property set to reports.
data_body.data.attributes	object	Required	An attributes section containing the attributes to update.
data_body.data.attributes.tags	array	Required	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"reports","attributes":{"tags":["one","two"]}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.location	string	Response data
data.attributes.risk_score	number	Response data
data.attributes.from_address	string	Response data
data.attributes.subject	string	Response data
data.attributes.received_at	string	Response data
data.attributes.reported_at	string	Response data
data.attributes.raw_headers	string	Response data
data.attributes.text_body	string	Response data
data.attributes.html_body	string	Response data
data.attributes.md5	string	Response data
data.attributes.sha256	string	Response data
data.attributes.match_priority	number	Response data
data.attributes.attachments_count	number	Response data
data.attributes.comments_count	number	Response data
data.attributes.rules_count	number	Response data
data.attributes.urls_count	number	Response data
data.attributes.tags	array	Response data

Output Example

Update a Response

Update a specific response in Cofense Triage using the provided ID, path parameters, and data body.

Endpoint

URL: /api/public/v2/responses/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The response ID.
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Required	Response data
data_body.data.type	string	Required	Response data
data_body.data.attributes	object	Required	Response data
data_body.data.attributes.name	string	Optional	Response data
data_body.data.attributes.description	string	Optional	Response data
data_body.data.attributes.to_reporter	boolean	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"responses","attributes":{"name":"Example Response","description":"This is an example response for documentation purposes.","to_reporter":true}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data_links_self	string	Response data
data_attributes_bcc_address	string	Response data
data_type	string	Response data
data_id	number	Response data
data_relationships_one_clicks_links_self	string	Response data
data_attributes_cc_address	string	Response data
raw_json	string	Output field: raw_json
data_attributes_description	string	Response data
data_attributes_to_other	number	Response data
data_attributes_to_reporter	number	Response data
data_attributes_attach_original	number	Response data
data_relationships_one_clicks_links_related	string	Response data
data_attributes_updated_at	string	Response data
data_attributes_to_other_address	string	Response data
data_attributes_name	string	Response data
data_attributes_created_at	string	Response data
data_attributes_subject	string	Response data
data_attributes_body	string	Response data

Output Example

Update a Threat Indicator

Update a specific threat indicator in Cofense Triage using the provided ID, attribute data, and necessary headers.

Endpoint

URL: /api/public/v2/threat_indicators/{{id}}

Method: PUT

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The ID of the indicator to fetch.
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the object.
data_body.data.type	string	Required	A type property set to threat indicators.
data_body.data.attributes	object	Required	An attributes section containing the attributes to update.
data_body.data.attributes.threat_level	string	Required	Response data
data_body.data.attributes.threat_source	string	Required	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"threat_indicators","attributes":{"threat_level":"Malicious","threat_source":"Triage-UI"}}},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.id	string	Response data
data.type	string	Response data
data.links	object	Response data
data.links.self	string	Response data
data.attributes	object	Response data
data.attributes.threat_level	string	Response data
data.attributes.threat_type	string	Response data
data.attributes.threat_value	string	Response data
data.attributes.threat_source	string	Response data
data.attributes.created_at	string	Response data
data.attributes.updated_at	string	Response data
data.relationships	object	Response data
data.relationships.owner	object	Response data
data.relationships.owner.links	object	Response data
data.relationships.owner.links.self	string	Response data
data.relationships.owner.links.related	string	Response data
data.relationships.owner.data	object	Response data
data.relationships.owner.data.type	string	Response data
data.relationships.owner.data.id	string	Response data
data.relationships.comments	object	Response data
data.relationships.comments.links	object	Response data
data.relationships.comments.links.self	string	Response data

Output Example

Update To-Many Relationship

Update a 'to-many' relationship for a specified resource in Cofense Triage using path parameters and a data body.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.resource_type	string	Required	Resource Type is the value identified in the Type section of the resource description.
path_parameters.id	string	Required	Resource ID is the unique identifier of an instance of the resource.
path_parameters.relationship_name	string	Required	Relationship Name is the name of the relationship. The plural name of the related resource, e.g "categories", not "category".
data_body	object	Required	Response data
data_body.data	array	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the related resource.
data_body.data.type	string	Required	A type property set to the type of the related resource.
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"resource_type":"reports","id":"24","relationship_name":"category"},"data_body":{"data":[{"id":"1","type":"one_clicks"},{"id":"2","type":"one_clicks"}]},"headers":{"Content-Type":"application/vnd.api+json"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}

Update TO-One Relationship

Update a specific to-one relationship in Cofense Triage using the provided resource type, ID, and relationship name.

Endpoint

URL: /api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.resource_type	string	Required	The value identified in the Type section of the resource description.
path_parameters.id	string	Required	Set to the unique identifier for the related resource.
path_parameters.relationship_name	string	Required	Relationship Name is the name of the relationship.The singular name of the related resource, e.g "category", not "categories".
data_body	object	Required	Response data
data_body.data	object	Required	Response data
data_body.data.id	string	Required	An id property set to the unique identifier for the related resource.
data_body.data.type	string	Required	Property set to the type of the related resource.

Input Example

{"path_parameters":{"resource_type":"reports","id":"24","relationship_name":"rules"},"data_body":{"data":{"id":"1","type":"responses"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}

Response Headers

Header	Description	Example
alt-svc	HTTP response header: alt-svc	h3=":443"; ma=86400
Cache-Control	Directives for caching mechanisms	max-age=0, private, must-revalidate
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	8bcc4241ecfca053-SIN
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
content-length	The length of the response body in bytes	140
content-security-policy-report-only	HTTP response header: content-security-policy-report-only	default-src 'self' triage-insights.cofense-triage.com; font-src 'self' data:; img-src 'self' data: content.triage-insights.cofense-triage.com data.triage-insights.cofense-triage.com pendo-static-5635959691542528.storage.googleapis.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' triage-insights.cofense-triage.com; style-src 'self'; style-src-attr 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' content.triage-insights.cofense-triage.com pendo-static-5635959691542528.storage.googleapis.com; script-src-elem 'self' 'unsafe-inline' content.triage-insights.cofense-triage.com data.triage-insights.cofense-triage.com; connect-src 'self' data.triage-insights.cofense-triage.com api.feedback.us.pendo.io; report-uri /csp-report
Content-Type	The media type of the resource	application/vnd.api+json
Date	The date and time at which the message was originated	Mon, 02 Sep 2024 08:51:33 GMT
etag	An identifier for a specific version of a resource	W/"acbbf2b0841e547967b280c8f81aff6f"
NEL	HTTP response header: NEL	{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy	HTTP response header: referrer-policy	strict-origin-when-cross-origin
Report-To	HTTP response header: Report-To	{"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BcMx2o%2Fh7vCp9Pf1ZtT14qjGANkfk2OnrZq3tyX1umyO2%2BtVqI23uKEfVL4hqOZnU4ioLdSTSsHWlJkEzn8mkdXxanxfBsqOtlemMjZO7K8qZ%2BkcOHRYJ%2FA%2F2oXPZUXU%2F9Xc2tTclc5uj2nUGg%3D%3D"}],"group":"cf-nel","max_age":604800}
Server	Information about the software used by the origin server	cloudflare
strict-transport-security	HTTP response header: strict-transport-security	max-age=63072000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Accept, Origin
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-download-options	HTTP response header: x-download-options	noopen
x-frame-options	HTTP response header: x-frame-options	SAMEORIGIN
x-permitted-cross-domain-policies	HTTP response header: x-permitted-cross-domain-policies	none
x-request-id	A unique identifier for the request	cb702bdb-99e1-4cd5-9d54-25a8e1f19338
x-runtime	HTTP response header: x-runtime	0.025454
x-served-by	HTTP response header: x-served-by	triage.curbsidebrewing.dev
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block

Cofense Triage

Prerequisites

Capabilities

Installation

Filtering Lists

Limit Results

Filter OPs

Comparison Operators

Examples

String Comparison Operators

Examples

Array Comparison Operators

Examples

Tag List Comparison Operators

Examples

Spare Fieldsets

Examples

Additional Documentation

Configurations

Oauth 2.0 Client Credentials

Configuration Parameters

Actions

Categorize a Report

Endpoint

Input

Input Example

Output

Output Example

Create a Threat Indicator

Endpoint

Input

Input Example

Output

Output Example

Create Category

Endpoint

Input

Input Example

Output

Output Example

Create Response

Endpoint

Input

Input Example

Output

Output Example

Delete To-Many Relationship

Endpoint

Input

Input Example

Output

Output Example

Delete To-One Relationship

Endpoint

Input

Input Example

Output

Output Example

Get a Category

Endpoint

Input

Input Example

Output

Output Example

Get a Cluster

Endpoint

Input

Input Example

Output

Output Example

Get a Header

Endpoint

Input

Input Example

Output

Output Example

Get a Hostname

Endpoint

Input

Input Example