--- title: Cofense Triage slug: connectors/cofense-triage docTags: createdAt: 2026-06-09T16:30:31.592Z --- Cofense Triage is an email security platform that helps organizations detect and respond to phishing threats. Cofense Triage is a leading phishing threat analysis and response platform that helps organizations manage and respond to phishing threats effectively. By integrating with Swimlane Turbine, users can automate the categorization of phishing reports, create and manage threat indicators, and streamline incident response processes. This integration enhances security operations by providing real-time insights and automating repetitive tasks, allowing security teams to focus on more strategic initiatives. ## Prerequisites Before you can use the Cofense Triage connector for Turbine, you'll need access to the Cofense Triage API. This requires the following: - OAuth 2.0 Client Credentials authentication using the following parameters: - URL: The endpoint URL for accessing the Cofense Triage API. - Client ID: The unique identifier for your application to authenticate with the API. - Client Secret: A secret key used in conjunction with the Client ID to authenticate your application. ## Capabilities This connector provides the following capabilities: - Categorize a Report - Create a Threat Indicator - Create Category - Create Response - Delete To-Many Relationship - Delete To-One Relationship - Get a Category - Get a Cluster - Get a Header - Get a Hostname - Get a Report - Get a Reporter - Get a Response - Get a Rule - Get a Threat Indicator *... and so on* ## Installation You will need to generate a Cofense Triage API token to use this connector. To generate the API token: 1. Open `Administration > Account Management > Operators`. 2. In the API Token Actions column of the superuser who will access the API, click (+) to generate the token for that superuser. Cofense Triage generates the token and displays the token in the API Token column. You will use the token and associated email address in the asset of this connection. ## Filtering Lists As explained in the API documentation, the general form of the URL is: `https://hostname/api/public/v2/example_resources?filter[ATTRIBUTE_OP]=VALUE` Given that a query string can be of arbitrary size, Swimlane accepts a query string with the format: `filter[attribute_name_1_OP]=value_1,value_2...value_n&filter[attribute_name_2_OP]=value_1,value_2...value_n&filter[attribute_name_n_OP]=value_1,value_2...value_n` This string, if given, will be appended to the request query. ### Limit Results Some tasks receive an optional limit parameter. When given, buckets of 50 records are going to be returned up to the limit defined. ### Filter OPs ### Comparison Operators - eq This is the default comparison operator if no operator is specified. Returns results when an attribute is equal to the supplied value. - not\_eq Returns results when an attribute is not equal to the supplied value. - lt Returns results when an attribute is less than the supplied value. - lteq Returns results when an attribute is less than or equal to the supplied value. - gt Returns results when an attribute is greater than the supplied value. - gteq Returns results when an attribute is greater than or equal to the supplied value. ### Examples filter\[report\_count]=5 filter\[report\_count\_eq]=5 filter\[report\_count\_not\_eq]=5 filter\[report\_count\_not\_lt]=100 filter\[report\_count\_not\_lteq]=101 filter\[report\_count\_not\_gt]=0 filter\[report\_count\_not\_gteq]=1 filter\[id]=1,2,3,4 filter\[id\_gteq]=5 ### String Comparison Operators The Cofense Triage API also permits string comparison operators in addition to the standard operators above. - start Returns results when an attribute starts with the supplied value. - not\_start Returns results when an attribute does not start with the supplied value. - end Returns results when an attribute ends with the supplied value. - not\_end Returns results when an attribute does not end with the supplied value. - cont Returns results when an attribute contains the supplied value. - not\_cont Returns results when an attribute does not contain the supplied value. ### Examples filter\[subject\_start]=congratulations filter\[subject\_not\_start]=voice filter\[subject\_end]=urgent payment filter\[subject\_not\_end]=payment filter\[subject\_cont]=gift,present filter\[subject\_not\_cont]=notification ### Array Comparison Operators Some resources have an array attribute that contains a list of values. Array attributes follow a common usage pattern, but the filters supported will vary. Reference the resource description for available filters. - any\_OP Returns resources where any value in the array matches the standard or string comparison operator ( OP ). ### Examples filter\[filenames\_any]=.png filter\[filenames\_any\_start]=taco filter\[filenames\_any\_end]=png filter\[filenames\_any\_cont]=menu ### Tag List Comparison Operators Some resources have a tag\_list attribute that contains a list of Triage tags that were applied to that resource. For example, the report resourceʼs categorization\_tag\_list attribute contains any tags assigned to a report when the report was processed. Tag List attributes do not support the standard or string comparison operators. Attributes of this type support the following comparison operators: - any Returns results when a resource is tagged with any of the specified tags. - all Returns results when a resource is tagged with all of the specified tags. - none Returns results when a resource is not tagged with any of the specified tags. ### Examples filter\[categorization\_tag\_list\_any]=tag1 filter\[categorization\_tag\_list\_any]=tag1,tag2 filter\[categorization\_tag\_list\_all]=tag1,tag3 filter\[categorization\_tag\_list\_none]=tag4 ### Spare Fieldsets All API resources can be instructed to only return specific attributes in the endpoint's response by using the fields query parameter. Limiting the amount of returned data in this way can improve the performance of the query. The general fields syntax is as follows: `fields[TYPE]=ATTRIBUTE` TYPE is the name of the resource type. ATTRIBUTE is the name of the attribute to return. To return multiple attributes, specify ATTRIBUTE as a comma-separated list. For example: fields\[reports]=name,address. ### Examples fields\[reports]=subject fields\[reports]=subject,match\_priority ```## For more information, access the Cofense Triage API documentation with your Cofense Triage customer account [here](https://community.cofense.com). ``` This connector was last tested against product version: API version 2 ## Additional Documentation - [Cofense Triage Connector Documentation](https://docs.swimlane.com/connectors/cofense-triage) - [Cofense Triage API Documentation](https://community.cofense.com) - [Cofense Triage Authentication Guide](https://docs.swimlane.com/authentication-guides/cofense-triage) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | -------------------------------------- | -------- | ------------ | | url | Server Host Address. | string | Required | | client\_id | Client ID used for authentication. | string | Required | | client\_secret | Client Secret used for authentication. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Categorize a Report Categorize a report in Cofense Triage using the specified report ID, enabling email responses and tagging. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}/categorize` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | number | Required | The category ID. | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.category_id` | string | Required | A category\_id property set to the unique identifier of the category. | | `data_body.data.outbound_template_id` | string | Optional | An outbound\_template\_id property set to the unique identifier of the outbound template. | | `data_body.data.categorization_tags` | array | Optional | A categorization\_tags property set to an array of strings containing the tags to apply to the categorized report. | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"id":1},"data_body":{"data":{"category_id":"1","outbound_template_id":"2","categorization_tags":["one","two","three"]}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}` ## Create a Threat Indicator Generate a new threat indicator in Cofense Triage using specified data body and headers. ### Endpoint - **URL:** `/api/public/v2/threat_indicators` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Optional | An id property set to the unique identifier for the object. | | `data_body.data.type` | string | Required | A type property set to threat\_indicators. | | `data_body.data.attributes` | object | Required | An attributes section containing, at a minimum, these attributes threat\_level , threat\_type , and threat\_value. | | `data_body.data.attributes.threat_level` | string | Required | Response data | | `data_body.data.attributes.threat_type` | string | Required | Response data | | `data_body.data.attributes.threat_value` | string | Required | Response data | | `data_body.data.attributes.threat_source` | string | Optional | Response data | | `data_body.data.attributes.created_at` | string | Optional | Response data | | `data_body.data.attributes.updated_at` | string | Optional | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"data_body":{"data":{"id":"1","type":"categories","attributes":{"threat_level":"Malicious","threat_type":"Sender","threat_value":"zoe.watts@example.org","threat_source":"Triage-UI","created_at":"2022-07-13T09:07:22.562Z","updated_at":"2022-07-13T09:07:22.562Z"}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.threat_level` | string | Response data | | `data.attributes.threat_type` | string | Response data | | `data.attributes.threat_value` | string | Response data | | `data.attributes.threat_source` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.owner` | object | Response data | | `data.relationships.owner.links` | object | Response data | | `data.relationships.owner.links.self` | string | Response data | | `data.relationships.owner.links.related` | string | Response data | | `data.relationships.owner.data` | object | Response data | | `data.relationships.owner.data.type` | string | Response data | | `data.relationships.owner.data.id` | string | Response data | | `data.relationships.comments` | object | Response data | | `data.relationships.comments.links` | object | Response data | | `data.relationships.comments.links.self` | string | Response data | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"threat_indicators","links":{},"attributes":{},"relationships":{}}}}` ## Create Category Create a new category in Cofense Triage using the specified data body and headers. ### Endpoint - **URL:** `/api/public/v2/categories` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Optional | An id property set to the unique identifier for the object. | | `data_body.data.type` | string | Required | A type property set to categories. | | `data_body.data.attributes` | object | Required | An attributes section containing, at a minimum, these attributes name , score , and color. | | `data_body.data.attributes.name` | string | Required | Response data | | `data_body.data.attributes.score` | number | Required | Response data | | `data_body.data.attributes.malicious` | boolean | Optional | Response data | | `data_body.data.attributes.color` | string | Required | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"data_body":{"data":{"id":"1","type":"categories","attributes":{"name":"Crimeware","score":5,"malicious":true,"color":"#c6911f"}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.score` | number | Response data | | `data.attributes.malicious` | boolean | Response data | | `data.attributes.color` | string | Response data | | `data.attributes.archived` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.playbooks` | object | Response data | | `data.relationships.playbooks.links` | object | Response data | | `data.relationships.playbooks.links.self` | string | Response data | | `data.relationships.playbooks.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"categories","links":{},"attributes":{},"relationships":{}}}}` ## Create Response Create a new response in Cofense Triage using the specified data body for targeted incident handling. ### Endpoint - **URL:** `/api/public/v2/responses` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------- | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Optional | Response data | | `data_body.data.type` | string | Required | Response data | | `data_body.data.attributes` | object | Required | Response data | | `data_body.data.attributes.name` | string | Required | Response data | | `data_body.data.attributes.subject` | string | Required | Response data | | `data_body.data.attributes.body` | string | Required | Response data | ### Input Example `{"data_body":{"data":{"id":"1","type":"responses","attributes":{"name":"Example Response","subject":"Email '[SUBJECT]' reported [REPORT_DATE] is SAFE","body":"

The email '[SUBJECT]' that you reported on [REPORT_DATE] is safe.

"}}}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data_links_self` | string | Response data | | `data_attributes_bcc_address` | string | Response data | | `data_type` | string | Response data | | `data_id` | number | Response data | | `data_relationships_one_clicks_links_self` | string | Response data | | `data_attributes_cc_address` | string | Response data | | `raw_json` | string | Output field: raw\_json | | `data_attributes_description` | string | Response data | | `data_attributes_to_other` | number | Response data | | `data_attributes_to_reporter` | number | Response data | | `data_attributes_attach_original` | number | Response data | | `data_relationships_one_clicks_links_related` | string | Response data | | `data_attributes_updated_at` | string | Response data | | `data_attributes_to_other_address` | string | Response data | | `data_attributes_name` | string | Response data | | `data_attributes_created_at` | string | Response data | | `data_attributes_subject` | string | Response data | | `data_attributes_body` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data_links_self":"Data Links Self","data_attributes_bcc_address":"Data Attributes Bcc Address","data_type":"Data Type","data_id":1,"data_relationships_one_clicks_links_self":"Data Relationships One Clicks Links Self","data_attributes_cc_address":"Data Attributes CC Address","raw_json":"Raw JSON","data_attributes_description":"Data Att...` ## Delete To-Many Relationship Remove a specified to-many relationship in Cofense Triage using resource type, ID, and relationship name. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | -------------------------------------------------------------------------- | | `path_parameters.resource_type` | string | Required | The value identified in the Type section of the resource description. | | `path_parameters.id` | string | Required | The Resource ID. | | `path_parameters.relationship_name` | string | Required | The plural name of the related resource, e.g "categories", not "category". | | `data_body` | object | Required | Response data | | `data_body.data` | array | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the related resource. | | `data_body.data.type` | string | Required | A type property set to the type of the related resource. | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"resource_type":"responses","id":"24","relationship_name":"recipes"},"data_body":{"data":[{"id":"1","type":"recipes"},{"id":"2","type":"recipes"}]},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}` ## Delete To-One Relationship Remove a specified to-one relationship in Cofense Triage using the provided resource type, ID, and relationship name. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------- | | `path_parameters.resource_type` | string | Required | The value identified in the Type section of the resource description. | | `path_parameters.id` | string | Required | The Resource ID. | | `path_parameters.relationship_name` | string | Required | The singular name of the related resource, e.g "category", not "categories". | ### Input Example `{"path_parameters":{"resource_type":"responses","id":"24","relationship_name":"recipes"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}` ## Get a Category Retrieve detailed information for a specific category in Cofense Triage using the provided ID. ### Endpoint - **URL:** `/api/public/v2/categories/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | Category Resource ID. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.score` | number | Response data | | `data.attributes.malicious` | boolean | Response data | | `data.attributes.color` | string | Response data | | `data.attributes.archived` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.playbooks` | object | Response data | | `data.relationships.playbooks.links` | object | Response data | | `data.relationships.playbooks.links.self` | string | Response data | | `data.relationships.playbooks.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"categories","links":{},"attributes":{},"relationships":{}}}}` ## Get a Cluster Retrieve a specific cluster from Cofense Triage using the provided unique identifier (ID). ### Endpoint - **URL:** `/api/public/v2/clusters/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the cluster to fetch. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.first_reported_at` | string | Response data | | `data.attributes.oldest_unprocessed_reported_at` | string | Response data | | `data.attributes.last_reported_at` | string | Response data | | `data.attributes.last_received_at` | string | Response data | | `data.attributes.last_from_address` | string | Response data | | `data.attributes.last_subject` | string | Response data | | `data.attributes.average_reporter_reputation` | string | Response data | | `data.attributes.match_priority` | number | Response data | | `data.attributes.tags` | array | Response data | | `data.attributes.host_source` | string | Response data | | `data.attributes.attachments_count` | number | Response data | | `data.attributes.unprocessed_reports_count` | number | Response data | | `data.attributes.processed_reports_count` | number | Response data | | `data.attributes.total_reports_count` | number | Response data | | `data.attributes.rules_count` | number | Response data | | `data.attributes.urls_count` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"clusters","links":{},"attributes":{},"relationships":{}}}}` ## Get a Header Retrieve header information for a specified ID in Cofense Triage using the provided path parameter. ### Endpoint - **URL:** `/api/public/v2/headers/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The Header ID. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.key` | string | Response data | | `data.attributes.value` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"headers","links":{},"attributes":{},"relationships":{}}}}` ## Get a Hostname Retrieve detailed host information for a specified ID from Cofense Triage using path parameters. ### Endpoint - **URL:** `/api/public/v2/hostnames/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The Host ID. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.hostname` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.domain` | object | Response data | | `data.relationships.domain.links` | object | Response data | | `data.relationships.domain.links.self` | string | Response data | | `data.relationships.domain.links.related` | string | Response data | | `data.relationships.domain.data` | object | Response data | | `data.relationships.domain.data.type` | string | Response data | | `data.relationships.domain.data.id` | string | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"hostnames","links":{},"attributes":{},"relationships":{}}}}` ## Get a Report Retrieve detailed information for a specific report in Cofense Triage using the unique identifier provided. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The Report ID. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.location` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.from_address` | string | Response data | | `data.attributes.subject` | string | Response data | | `data.attributes.received_at` | string | Response data | | `data.attributes.reported_at` | string | Response data | | `data.attributes.raw_headers` | string | Response data | | `data.attributes.text_body` | string | Response data | | `data.attributes.html_body` | string | Response data | | `data.attributes.md5` | string | Response data | | `data.attributes.sha256` | string | Response data | | `data.attributes.match_priority` | number | Response data | | `data.attributes.attachments_count` | number | Response data | | `data.attributes.comments_count` | number | Response data | | `data.attributes.rules_count` | number | Response data | | `data.attributes.urls_count` | number | Response data | | `data.attributes.tags` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"reports","links":{},"attributes":{},"relationships":{}}}}` ## Get a Reporter Retrieve detailed information for a specific reporter in Cofense Triage using their unique ID. ### Endpoint - **URL:** `/api/public/v2/reporters/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The Reporter ID. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.email` | string | Response data | | `data.attributes.reports_count` | number | Response data | | `data.attributes.last_reported_at` | string | Response data | | `data.attributes.reputation_score` | number | Response data | | `data.attributes.vip` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"reporters","links":{},"attributes":{},"relationships":{}}}}` ## Get a Response Retrieve a specific response from Cofense Triage using the provided unique identifier (ID). ### Endpoint - **URL:** `/api/public/v2/responses/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------- | | `path_parameters.id` | string | Required | The response ID. | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attributes_attach_original` | number | Output field: attributes\_attach\_original | | `links_self` | string | Output field: links\_self | | `attributes_name` | string | Name of the resource | | `raw_json` | string | Output field: raw\_json | | `attributes_body` | string | Request body data | | `attributes_subject` | string | Output field: attributes\_subject | | `attributes_to_reporter` | number | Output field: attributes\_to\_reporter | | `relationships_one_clicks_links_related` | string | Output field: relationships\_one\_clicks\_links\_related | | `relationships_one_clicks_links_self` | string | Output field: relationships\_one\_clicks\_links\_self | | `id` | number | Unique identifier | | `attributes_updated_at` | string | Output field: attributes\_updated\_at | | `type` | string | Type of the resource | | `attributes_to_other` | number | Output field: attributes\_to\_other | | `attributes_created_at` | string | Output field: attributes\_created\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_attach_original":1,"links_self":"Links Self","attributes_name":"Attributes Name","raw_json":"Raw JSON","attributes_body":"Attributes Body","attributes_subject":"Attributes Subject","attributes_to_reporter":1,"relationships_one_clicks_links_related":"Relationships One Clicks Links Related","relationships_one_clicks_links_sel...` ## Get a Rule Retrieve a specific Cofense Triage rule using its unique identifier (ID). ### Endpoint - **URL:** `/api/public/v2/rules/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the rule to fetch. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.description` | string | Response data | | `data.attributes.priority` | number | Response data | | `data.attributes.tags` | array | Response data | | `data.attributes.scope` | string | Response data | | `data.attributes.author_name` | string | Response data | | `data.attributes.rule_context` | string | Response data | | `data.attributes.active` | boolean | Response data | | `data.attributes.content` | string | Response data | | `data.attributes.time_to_live` | string | Response data | | `data.attributes.share_with_cofense` | boolean | Response data | | `data.attributes.reports_count` | number | Response data | | `data.attributes.imported_at` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.cluster_context` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"rules","links":{},"attributes":{},"relationships":{}}}}` ## Get a Threat Indicator Retrieve a specific threat indicator from Cofense Triage using the provided unique identifier. ### Endpoint - **URL:** `/api/public/v2/threat_indicators/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.id` | string | Required | The ID of the indicator to fetch. | | `parameters.fields` | string | Optional | Parameters for the Get a Threat Indicator action | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.threat_level` | string | Response data | | `data.attributes.threat_type` | string | Response data | | `data.attributes.threat_value` | string | Response data | | `data.attributes.threat_source` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.owner` | object | Response data | | `data.relationships.owner.links` | object | Response data | | `data.relationships.owner.links.self` | string | Response data | | `data.relationships.owner.links.related` | string | Response data | | `data.relationships.owner.data` | object | Response data | | `data.relationships.owner.data.type` | string | Response data | | `data.relationships.owner.data.id` | string | Response data | | `data.relationships.comments` | object | Response data | | `data.relationships.comments.links` | object | Response data | | `data.relationships.comments.links.self` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"threat_indicators","links":{},"attributes":{},"relationships":{}}}}` ## Get a URL Retrieve detailed information for a specific URL in Cofense Triage using the unique identifier (ID) provided. ### Endpoint - **URL:** `/api/public/v2/urls/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.id` | string | Required | The URL ID. | | `parameters.fields` | string | Optional | Parameters for the Get a URL action | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.url` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.domain` | object | Response data | | `data.relationships.domain.links` | object | Response data | | `data.relationships.domain.links.self` | string | Response data | | `data.relationships.domain.links.related` | string | Response data | | `data.relationships.hostname` | object | Response data | | `data.relationships.hostname.links` | object | Response data | | `data.relationships.hostname.links.self` | string | Response data | | `data.relationships.hostname.links.related` | string | Response data | | `data.relationships.hostname.data` | object | Response data | | `data.relationships.hostname.data.type` | string | Response data | | `data.relationships.hostname.data.id` | string | Response data | | `data.relationships.clusters` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"urls","links":{},"attributes":{},"relationships":{}}}}` ## Get an Attachment Retrieve a specific attachment from Cofense Triage using the provided resource ID as a path parameter. ### Endpoint - **URL:** `/api/public/v2/attachments/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.id` | string | Required | ID of the resource to which the attachment belongs. | | `parameters.fields` | string | Optional | Parameters for the Get an Attachment action | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.filename` | string | Response data | | `data.attributes.size` | number | Response data | | `data.attributes.is_child` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.attachment_payload` | object | Response data | | `data.relationships.attachment_payload.links` | object | Response data | | `data.relationships.attachment_payload.links.self` | string | Response data | | `data.relationships.attachment_payload.links.related` | string | Response data | | `data.relationships.attachment_payload.data` | object | Response data | | `data.relationships.attachment_payload.data.type` | string | Response data | | `data.relationships.attachment_payload.data.id` | string | Response data | | `data.relationships.parent` | object | Response data | | `data.relationships.parent.links` | object | Response data | | `data.relationships.parent.links.self` | string | Response data | | `data.relationships.parent.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"attachments","links":{},"attributes":{},"relationships":{}}}}` ## Get an Operator Retrieve details for a specific operator in Cofense Triage using the provided unique ID. ### Endpoint - **URL:** `/api/public/v2/operators/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the operator to fetch. | | `parameters.fields` | string | Optional | Optional field, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.email` | string | Response data | | `data.attributes.first_name` | string | Response data | | `data.attributes.last_name` | string | Response data | | `data.attributes.nickname` | string | Response data | | `data.attributes.time_zone` | string | Response data | | `data.attributes.permissions` | object | Response data | | `data.attributes.permissions.triage` | string | Response data | | `data.attributes.permissions.vision` | string | Response data | | `data.attributes.sso_enabled` | boolean | Response data | | `data.attributes.two_factor_enabled` | boolean | Response data | | `data.attributes.locked` | boolean | Response data | | `data.attributes.sign_in_count` | number | Response data | | `data.attributes.last_sign_in_at` | string | Response data | | `data.attributes.password_changed_at` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"operators","links":{},"attributes":{},"relationships":{}}}}` ## Get Attachment List Retrieve a list of attachments from Cofense Triage for further analysis or processing. ### Endpoint - **URL:** `/api/public/v2/attachments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-name). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.filename` | string | Response data | | `data.attributes.size` | number | Response data | | `data.attributes.is_child` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.attachment_payload` | object | Response data | | `data.relationships.attachment_payload.links` | object | Response data | | `data.relationships.attachment_payload.links.self` | string | Response data | | `data.relationships.attachment_payload.links.related` | string | Response data | | `data.relationships.attachment_payload.data` | object | Response data | | `data.relationships.attachment_payload.data.type` | string | Response data | | `data.relationships.attachment_payload.data.id` | string | Response data | | `data.relationships.parent` | object | Response data | | `data.relationships.parent.links` | object | Response data | | `data.relationships.parent.links.self` | string | Response data | | `data.relationships.parent.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Attachment Payload Retrieve the payload of an attachment from Cofense Triage using a specified ID as a path parameter. ### Endpoint - **URL:** `/api/public/v2/attachment_payloads/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `path_parameters.id` | string | Required | ID of the resource to which the attachment payload belongs. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"fields":"fields[reports]=subject"},"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.mime_type` | string | Response data | | `data.attributes.md5` | string | Response data | | `data.attributes.sha256` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.attachments` | object | Response data | | `data.relationships.attachments.links` | object | Response data | | `data.relationships.attachments.links.self` | string | Response data | | `data.relationships.attachments.links.related` | string | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.integration_submissions` | object | Response data | | `data.relationships.integration_submissions.links` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"attachment_payloads","links":{},"attributes":{},"relationships":{}}}}` ## Get Attachment Payload List Retrieve a list of attachment payloads from Cofense Triage for analysis or processing. ### Endpoint - **URL:** `/api/public/v2/attachment_payloads` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.mime_type` | string | Response data | | `data.attributes.md5` | string | Response data | | `data.attributes.sha256` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.attachments` | object | Response data | | `data.relationships.attachments.links` | object | Response data | | `data.relationships.attachments.links.self` | string | Response data | | `data.relationships.attachments.links.related` | string | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.integration_submissions` | object | Response data | | `data.relationships.integration_submissions.links` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Category List Retrieve and classify a list of categories from Cofense Triage to organize reports effectively. ### Endpoint - **URL:** `/api/public/v2/categories` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.score` | number | Response data | | `data.attributes.malicious` | boolean | Response data | | `data.attributes.color` | string | Response data | | `data.attributes.archived` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.playbooks` | object | Response data | | `data.relationships.playbooks.links` | object | Response data | | `data.relationships.playbooks.links.self` | string | Response data | | `data.relationships.playbooks.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Comments List all comments within Cofense Triage to provide a comprehensive overview of user feedback and annotations. ### Endpoint - **URL:** `/api/public/v2/comments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | -------------------------------------- | | `parameters.sort` | string | Optional | Parameters for the Get Comments action | | `parameters.filter[tags_any]` | string | Optional | Parameters for the Get Comments action | | `parameters.filter[created_at_gt]` | string | Optional | Parameters for the Get Comments action | | `parameters.page[size]` | string | Optional | Parameters for the Get Comments action | ### Input Example `{"parameters":{"sort":"id","filter[tags_any]":"Escalation_ticket","filter[created_at_gt]":"string","page[size]":"50"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `meta` | object | Output field: meta | | `meta.record_count` | number | Count value | | `meta.page_count` | number | Count value | | `links` | object | Output field: links | | `links.first` | string | Output field: links.first | | `links.last` | string | Output field: links.last | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 02 Sep 2024 08:51:33 GMT","Content-Type":"application/vnd.api+json","Transfer-Encoding":"chunked","Connection":"keep-alive","x-frame-options":"SAMEORIGIN","x-xss-protection":"1; mode=block","x-content-type-options":"nosniff","x-download-options":"noopen","x-permitted-cross-domain-policies":"none","referrer-policy":"strict-origin-when-cross-origin","vary":"Accept, Origin","etag":"W/\"acbbf2b0841e547967b280c8f81aff6f\"","Cache-Control":"max-age=0...` ## Get Download Original File Retrieve the original file from Cofense Triage using a specific resource ID provided as a path parameter. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}/download` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | The Report ID. | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","file":[]}` ## Get Download Preview(jpg) Retrieve a JPEG preview of a report from Cofense Triage using the provided Report ID. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}/download.jpg` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | The Report ID. | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Get Download Preview(png) Retrieve a PNG preview of a specific report from Cofense Triage using the provided Report ID. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}/download.png` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | The Report ID. | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Get Email Preview Image (PNG) Download a PNG preview image of an email from Cofense Triage using a unique identifier as the path parameter. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}/download.png` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the report containing the email to generate the preview from. | ### Input Example `{"path_parameters":{"id":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","file":[]}` ## Get Header List Retrieve a list of email headers from Cofense Triage for further analysis. ### Endpoint - **URL:** `/api/public/v2/headers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-name). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.key` | string | Response data | | `data.attributes.value` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Hostnames List Retrieve a comprehensive list of hostnames from Cofense Triage for enhanced analysis or investigative purposes. ### Endpoint - **URL:** `/api/public/v2/hostnames` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"-id","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.hostname` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.domain` | object | Response data | | `data.relationships.domain.links` | object | Response data | | `data.relationships.domain.links.self` | string | Response data | | `data.relationships.domain.links.related` | string | Response data | | `data.relationships.domain.data` | object | Response data | | `data.relationships.domain.data.type` | string | Response data | | `data.relationships.domain.data.id` | string | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Relationship to Many Retrieve to-many relationship data for a specified resource in Cofense Triage using the relationship name, ID, and resource type. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/{{relationship_name}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | --------------------------------------------------------------------- | | `path_parameters.relationship_name` | string | Required | The plural name of the related resource. | | `path_parameters.id` | string | Required | The Resource ID. | | `path_parameters.resource_type` | string | Required | The value identified in the Type section of the resource description. | ### Input Example `{"path_parameters":{"relationship_name":"rules","id":"24","resource_type":"reports"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attributes_updated_at` | string | Output field: attributes\_updated\_at | | `relationships_reports_links_related` | string | Output field: relationships\_reports\_links\_related | | `links_self` | string | Output field: links\_self | | `attributes_score` | number | Score value | | `type` | string | Type of the resource | | `raw_json` | string | Output field: raw\_json | | `relationships_reports_links_self` | string | Output field: relationships\_reports\_links\_self | | `relationships_one_clicks_links_self` | string | Output field: relationships\_one\_clicks\_links\_self | | `attributes_malicious` | number | Output field: attributes\_malicious | | `attributes_color` | string | Output field: attributes\_color | | `relationships_one_clicks_links_related` | string | Output field: relationships\_one\_clicks\_links\_related | | `attributes_created_at` | string | Output field: attributes\_created\_at | | `attributes_name` | string | Name of the resource | | `id` | number | Unique identifier | | `attributes_archived` | number | Output field: attributes\_archived | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_updated_at":"Attributes Updated At","relationships_reports_links_related":"Relationships Reports Links Related","links_self":"Links Self","attributes_score":1,"type":"type","raw_json":"Raw JSON","relationships_reports_links_self":"Relationships Reports Links Self","relationships_one_clicks_links_self":"Relationships One Cli...` ## Get Relationship to One Retrieve to-one relationship data in Cofense Triage by specifying the relationship name, ID, and resource type. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/{{relationship_name}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------- | | `path_parameters.relationship_name` | string | Required | The singular name of the related resource, e.g "category", not "categories". | | `path_parameters.id` | string | Required | The Resource ID. | | `path_parameters.resource_type` | string | Required | The value identified in the Type section of the resource description. | ### Input Example `{"path_parameters":{"relationship_name":"rules","id":"24","resource_type":"reports"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attributes_updated_at` | string | Output field: attributes\_updated\_at | | `relationships_reports_links_related` | string | Output field: relationships\_reports\_links\_related | | `links_self` | string | Output field: links\_self | | `attributes_score` | number | Score value | | `type` | string | Type of the resource | | `raw_json` | string | Output field: raw\_json | | `relationships_reports_links_self` | string | Output field: relationships\_reports\_links\_self | | `relationships_one_clicks_links_self` | string | Output field: relationships\_one\_clicks\_links\_self | | `attributes_malicious` | number | Output field: attributes\_malicious | | `attributes_color` | string | Output field: attributes\_color | | `relationships_one_clicks_links_related` | string | Output field: relationships\_one\_clicks\_links\_related | | `attributes_created_at` | string | Output field: attributes\_created\_at | | `attributes_name` | string | Name of the resource | | `id` | number | Unique identifier | | `attributes_archived` | number | Output field: attributes\_archived | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_updated_at":"Attributes Updated At","relationships_reports_links_related":"Relationships Reports Links Related","links_self":"Links Self","attributes_score":1,"type":"type","raw_json":"Raw JSON","relationships_reports_links_self":"Relationships Reports Links Self","relationships_one_clicks_links_self":"Relationships One Cli...` ## Get Report List Retrieve a detailed list of reports from Cofense Triage, including identifiers, status, and threat levels. ### Endpoint - **URL:** `/api/public/v2/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.location` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.from_address` | string | Response data | | `data.attributes.subject` | string | Response data | | `data.attributes.received_at` | string | Response data | | `data.attributes.reported_at` | string | Response data | | `data.attributes.raw_headers` | string | Response data | | `data.attributes.text_body` | string | Response data | | `data.attributes.html_body` | string | Response data | | `data.attributes.md5` | string | Response data | | `data.attributes.sha256` | string | Response data | | `data.attributes.match_priority` | number | Response data | | `data.attributes.attachments_count` | number | Response data | | `data.attributes.comments_count` | number | Response data | | `data.attributes.rules_count` | number | Response data | | `data.attributes.urls_count` | number | Response data | | `data.attributes.tags` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Reporter List Retrieve a detailed list of reporters from Cofense Triage, including contact information and report history. ### Endpoint - **URL:** `/api/public/v2/reporters` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.email` | string | Response data | | `data.attributes.reports_count` | number | Response data | | `data.attributes.last_reported_at` | string | Response data | | `data.attributes.reputation_score` | number | Response data | | `data.attributes.vip` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.clusters` | object | Response data | | `data.relationships.clusters.links` | object | Response data | | `data.relationships.clusters.links.self` | string | Response data | | `data.relationships.clusters.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Response List Retrieve an overview of all available response actions from Cofense Triage. ### Endpoint - **URL:** `/api/public/v2/responses` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attributes_attach_original` | number | Output field: attributes\_attach\_original | | `attributes_to_other` | number | Output field: attributes\_to\_other | | `links_self` | string | Output field: links\_self | | `type` | string | Type of the resource | | `raw_json` | string | Output field: raw\_json | | `attributes_updated_at` | string | Output field: attributes\_updated\_at | | `attributes_subject` | string | Output field: attributes\_subject | | `attributes_to_reporter` | number | Output field: attributes\_to\_reporter | | `relationships_one_clicks_links_related` | string | Output field: relationships\_one\_clicks\_links\_related | | `id` | number | Unique identifier | | `relationships_one_clicks_links_self` | string | Output field: relationships\_one\_clicks\_links\_self | | `attributes_name` | string | Name of the resource | | `attributes_body` | string | Request body data | | `attributes_created_at` | string | Output field: attributes\_created\_at | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributes_attach_original":1,"attributes_to_other":1,"links_self":"Links Self","type":"Type","raw_json":"Raw JSON","attributes_updated_at":"Attributes Updated At","attributes_subject":"Attributes Subject","attributes_to_reporter":1,"relationships_one_clicks_links_related":"Relationships One Clicks Links Related","id":1,"relationships...` ## Get Rule List Fetch the list of rules from Cofense Triage for analysis and processing. ### Endpoint - **URL:** `/api/public/v2/rules` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.description` | string | Response data | | `data.attributes.priority` | number | Response data | | `data.attributes.tags` | array | Response data | | `data.attributes.scope` | string | Response data | | `data.attributes.author_name` | string | Response data | | `data.attributes.rule_context` | string | Response data | | `data.attributes.active` | boolean | Response data | | `data.attributes.content` | string | Response data | | `data.attributes.time_to_live` | string | Response data | | `data.attributes.share_with_cofense` | boolean | Response data | | `data.attributes.reports_count` | number | Response data | | `data.attributes.imported_at` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.cluster_context` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get Status Retrieve the current operational health and performance metrics from Cofense Triage. ### Endpoint - **URL:** `/api/public/v2/system/status` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.health` | object | Response data | | `data.health.cpu_usage_percent` | string | Response data | | `data.health.memory_in_kilobytes` | object | Response data | | `data.health.memory_in_kilobytes.total_memory` | number | Response data | | `data.health.memory_in_kilobytes.used_memory` | number | Response data | | `data.health.memory_in_kilobytes.active_memory` | number | Response data | | `data.health.memory_in_kilobytes.inactive_memory` | number | Response data | | `data.health.memory_in_kilobytes.free_memory` | number | Response data | | `data.health.partition_used_percent` | object | Response data | | `data.health.partition_used_percent./dev/mapper/triage-root` | string | Response data | | `data.health.partition_used_percent.devtmpfs` | string | Response data | | `data.health.partition_used_percent./dev/sda1` | string | Response data | | `data.health.partition_used_percent./dev/mapper/triage-pgsqldumps` | string | Response data | | `data.health.partition_used_percent./dev/mapper/triage-varlibpgsql` | string | Response data | | `data.health.partition_used_percent./dev/mapper/triage-srv` | string | Response data | | `data.health.partition_used_percent./dev/mapper/triage-pgsqlbu` | string | Response data | | `data.health.last_time_ingested` | string | Response data | | `data.health.last_user_login` | string | Response data | | `data.health.license_expiration` | string | Response data | | `data.status` | object | Response data | | `data.status.mail_account_worker` | boolean | Response data | | `data.status.postgresql` | boolean | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"health":{},"status":{},"version":"1.21.0"}}}` ## Get Threat Indicator List Retrieve a list of Indicators of Compromise (IOCs) classified as malicious, suspicious, or benign from Cofense Triage. ### Endpoint - **URL:** `/api/public/v2/threat_indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.threat_level` | string | Response data | | `data.attributes.threat_type` | string | Response data | | `data.attributes.threat_value` | string | Response data | | `data.attributes.threat_source` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.owner` | object | Response data | | `data.relationships.owner.links` | object | Response data | | `data.relationships.owner.links.self` | string | Response data | | `data.relationships.owner.links.related` | string | Response data | | `data.relationships.owner.data` | object | Response data | | `data.relationships.owner.data.type` | string | Response data | | `data.relationships.owner.data.id` | string | Response data | | `data.relationships.comments` | object | Response data | | `data.relationships.comments.links` | object | Response data | | `data.relationships.comments.links.self` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Get URL List Retrieve a comprehensive list of URLs from Cofense Triage for subsequent analysis or action. ### Endpoint - **URL:** `/api/public/v2/urls` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.page` | string | Optional | Optional page to apply to the list. i.e page\[number]=VALUE1\&page\[size]=VALUE2. page\[number] is the page number to return. The default is 1. page\[size] is the number of returned objects to display per page. Valid values are 1 through 200. The default is 20. | | `parameters.sort` | string | Optional | Optional sorting filter to apply to the list; must be a comma separated string. To sort an attribute in descending order, prefix the attribute with a hyphen (for example, sort=-d). | | `parameters.filter` | string | Optional | Optional filter to apply to the list; more than one filter can be defined, i.e filter\[ATTRIBUTE1\_OP]=VALUE1\&filter\[ATTRIBUTE2\_OP]=VALUE2. See README for further details. | | `parameters.limit` | number | Optional | Maximum number of results to return. Defaults to all results. | | `parameters.fields` | string | Optional | Optional field to apply to the list, i.e fields\[Type]=ATTRIBUTE. | ### Input Example `{"parameters":{"page":"page[number]=2&page[size]=50","sort":"name","filter":"filter[id_eq]=26,27&filter[filename]=image006.png","limit":200,"fields":"fields[reports]=subject"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.url` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.domain` | object | Response data | | `data.relationships.domain.links` | object | Response data | | `data.relationships.domain.links.self` | string | Response data | | `data.relationships.domain.links.related` | string | Response data | | `data.relationships.hostname` | object | Response data | | `data.relationships.hostname.links` | object | Response data | | `data.relationships.hostname.links.self` | string | Response data | | `data.relationships.hostname.links.related` | string | Response data | | `data.relationships.hostname.data` | object | Response data | | `data.relationships.hostname.data.type` | string | Response data | | `data.relationships.hostname.data.id` | string | Response data | | `data.relationships.clusters` | object | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}]}}` ## Update a Category Update a specific Cofense Triage category by ID, requiring path parameters and data body with attributes. ### Endpoint - **URL:** `/api/public/v2/categories/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `path_parameters.id` | string | Required | The Category ID. | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the object. | | `data_body.data.type` | string | Required | A type property set to categories. | | `data_body.data.attributes` | object | Required | An attributes section containing the attributes to update. | | `data_body.data.attributes.name` | string | Optional | Response data | | `data_body.data.attributes.score` | number | Optional | Response data | | `data_body.data.attributes.malicious` | boolean | Optional | Response data | | `data_body.data.attributes.color` | string | Optional | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"categories","attributes":{"name":"Crimeware","score":5,"malicious":true,"color":"#c6911f"}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.score` | number | Response data | | `data.attributes.malicious` | boolean | Response data | | `data.attributes.color` | string | Response data | | `data.attributes.archived` | boolean | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.playbooks` | object | Response data | | `data.relationships.playbooks.links` | object | Response data | | `data.relationships.playbooks.links.self` | string | Response data | | `data.relationships.playbooks.links.related` | string | Response data | | `data.relationships.reports` | object | Response data | | `data.relationships.reports.links` | object | Response data | | `data.relationships.reports.links.self` | string | Response data | | `data.relationships.reports.links.related` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"categories","links":{},"attributes":{},"relationships":{}}}}` ## Update a Report Update a specific Cofense Triage report by ID using path parameters and data body. ### Endpoint - **URL:** `/api/public/v2/reports/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `path_parameters.id` | string | Required | The report ID. | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the object. | | `data_body.data.type` | string | Required | A type property set to reports. | | `data_body.data.attributes` | object | Required | An attributes section containing the attributes to update. | | `data_body.data.attributes.tags` | array | Required | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"reports","attributes":{"tags":["one","two"]}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.location` | string | Response data | | `data.attributes.risk_score` | number | Response data | | `data.attributes.from_address` | string | Response data | | `data.attributes.subject` | string | Response data | | `data.attributes.received_at` | string | Response data | | `data.attributes.reported_at` | string | Response data | | `data.attributes.raw_headers` | string | Response data | | `data.attributes.text_body` | string | Response data | | `data.attributes.html_body` | string | Response data | | `data.attributes.md5` | string | Response data | | `data.attributes.sha256` | string | Response data | | `data.attributes.match_priority` | number | Response data | | `data.attributes.attachments_count` | number | Response data | | `data.attributes.comments_count` | number | Response data | | `data.attributes.rules_count` | number | Response data | | `data.attributes.urls_count` | number | Response data | | `data.attributes.tags` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"reports","links":{},"attributes":{},"relationships":{}}}}` ## Update a Response Update a specific response in Cofense Triage using the provided ID, path parameters, and data body. ### Endpoint - **URL:** `/api/public/v2/responses/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | ---------------------------- | | `path_parameters.id` | string | Required | The response ID. | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Required | Response data | | `data_body.data.type` | string | Required | Response data | | `data_body.data.attributes` | object | Required | Response data | | `data_body.data.attributes.name` | string | Optional | Response data | | `data_body.data.attributes.description` | string | Optional | Response data | | `data_body.data.attributes.to_reporter` | boolean | Optional | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"responses","attributes":{"name":"Example Response","description":"This is an example response for documentation purposes.","to_reporter":true}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data_links_self` | string | Response data | | `data_attributes_bcc_address` | string | Response data | | `data_type` | string | Response data | | `data_id` | number | Response data | | `data_relationships_one_clicks_links_self` | string | Response data | | `data_attributes_cc_address` | string | Response data | | `raw_json` | string | Output field: raw\_json | | `data_attributes_description` | string | Response data | | `data_attributes_to_other` | number | Response data | | `data_attributes_to_reporter` | number | Response data | | `data_attributes_attach_original` | number | Response data | | `data_relationships_one_clicks_links_related` | string | Response data | | `data_attributes_updated_at` | string | Response data | | `data_attributes_to_other_address` | string | Response data | | `data_attributes_name` | string | Response data | | `data_attributes_created_at` | string | Response data | | `data_attributes_subject` | string | Response data | | `data_attributes_body` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data_links_self":"Data Links Self","data_attributes_bcc_address":"Data Attributes Bcc Address","data_type":"Data Type","data_id":1,"data_relationships_one_clicks_links_self":"Data Relationships One Clicks Links Self","data_attributes_cc_address":"Data Attributes CC Address","raw_json":"Raw JSON","data_attributes_description":"Data Att...` ## Update a Threat Indicator Update a specific threat indicator in Cofense Triage using the provided ID, attribute data, and necessary headers. ### Endpoint - **URL:** `/api/public/v2/threat_indicators/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `path_parameters.id` | string | Required | The ID of the indicator to fetch. | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the object. | | `data_body.data.type` | string | Required | A type property set to threat indicators. | | `data_body.data.attributes` | object | Required | An attributes section containing the attributes to update. | | `data_body.data.attributes.threat_level` | string | Required | Response data | | `data_body.data.attributes.threat_source` | string | Required | Response data | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"id":"1"},"data_body":{"data":{"id":"1","type":"threat_indicators","attributes":{"threat_level":"Malicious","threat_source":"Triage-UI"}}},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.threat_level` | string | Response data | | `data.attributes.threat_type` | string | Response data | | `data.attributes.threat_value` | string | Response data | | `data.attributes.threat_source` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.relationships` | object | Response data | | `data.relationships.owner` | object | Response data | | `data.relationships.owner.links` | object | Response data | | `data.relationships.owner.links.self` | string | Response data | | `data.relationships.owner.links.related` | string | Response data | | `data.relationships.owner.data` | object | Response data | | `data.relationships.owner.data.type` | string | Response data | | `data.relationships.owner.data.id` | string | Response data | | `data.relationships.comments` | object | Response data | | `data.relationships.comments.links` | object | Response data | | `data.relationships.comments.links.self` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"data":{"id":"1","type":"threat_indicators","links":{},"attributes":{},"relationships":{}}}}` ## Update To-Many Relationship Update a 'to-many' relationship for a specified resource in Cofense Triage using path parameters and a data body. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.resource_type` | string | Required | Resource Type is the value identified in the Type section of the resource description. | | `path_parameters.id` | string | Required | Resource ID is the unique identifier of an instance of the resource. | | `path_parameters.relationship_name` | string | Required | Relationship Name is the name of the relationship. The plural name of the related resource, e.g "categories", not "category". | | `data_body` | object | Required | Response data | | `data_body.data` | array | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the related resource. | | `data_body.data.type` | string | Required | A type property set to the type of the related resource. | | `headers` | object | Required | HTTP headers for the request | | `headers.Content-Type` | string | Required | HTTP headers for the request | ### Input Example `{"path_parameters":{"resource_type":"reports","id":"24","relationship_name":"category"},"data_body":{"data":[{"id":"1","type":"one_clicks"},{"id":"2","type":"one_clicks"}]},"headers":{"Content-Type":"application/vnd.api+json"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}` ## Update TO-One Relationship Update a specific to-one relationship in Cofense Triage using the provided resource type, ID, and relationship name. ### Endpoint - **URL:** `/api/public/v2/{{resource_type}}/{{id}}/relationships/{{relationship_name}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------ | | `path_parameters.resource_type` | string | Required | The value identified in the Type section of the resource description. | | `path_parameters.id` | string | Required | Set to the unique identifier for the related resource. | | `path_parameters.relationship_name` | string | Required | Relationship Name is the name of the relationship.The singular name of the related resource, e.g "category", not "categories". | | `data_body` | object | Required | Response data | | `data_body.data` | object | Required | Response data | | `data_body.data.id` | string | Required | An id property set to the unique identifier for the related resource. | | `data_body.data.type` | string | Required | Property set to the type of the related resource. | ### Input Example `{"path_parameters":{"resource_type":"reports","id":"24","relationship_name":"rules"},"data_body":{"data":{"id":"1","type":"responses"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK"}` # Response Headers | **Header** | **Description** | **Example** | | ----------------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | alt-svc | HTTP response header: alt-svc | h3=":443"; ma=86400 | | Cache-Control | Directives for caching mechanisms | max-age=0, private, must-revalidate | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 8bcc4241ecfca053-SIN | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | content-length | The length of the response body in bytes | 140 | | content-security-policy-report-only | HTTP response header: content-security-policy-report-only | default-src 'self' triage-insights.cofense-triage.com; font-src 'self' data:; img-src 'self' data: content.triage-insights.cofense-triage.com data.triage-insights.cofense-triage.com pendo-static-5635959691542528.storage.googleapis.com; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' triage-insights.cofense-triage.com; style-src 'self'; style-src-attr 'self' 'unsafe-inline'; script-src-attr 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' content.triage-insights.cofense-triage.com pendo-static-5635959691542528.storage.googleapis.com; script-src-elem 'self' 'unsafe-inline' content.triage-insights.cofense-triage.com data.triage-insights.cofense-triage.com; connect-src 'self' data.triage-insights.cofense-triage.com api.feedback.us.pendo.io; report-uri /csp-report | | Content-Type | The media type of the resource | application/vnd.api+json | | Date | The date and time at which the message was originated | Mon, 02 Sep 2024 08:51:33 GMT | | etag | An identifier for a specific version of a resource | W/"acbbf2b0841e547967b280c8f81aff6f" | | NEL | HTTP response header: NEL | \{"success\_fraction":0,"report\_to":"cf-nel","max\_age":604800} | | referrer-policy | HTTP response header: referrer-policy | strict-origin-when-cross-origin | | Report-To | HTTP response header: Report-To | \{"endpoints":\[\{"url":"https\://a.nel.cloudflare.com/report/v4?s=%2BcMx2o%2Fh7vCp9Pf1ZtT14qjGANkfk2OnrZq3tyX1umyO2%2BtVqI23uKEfVL4hqOZnU4ioLdSTSsHWlJkEzn8mkdXxanxfBsqOtlemMjZO7K8qZ%2BkcOHRYJ%2FA%2F2oXPZUXU%2F9Xc2tTclc5uj2nUGg%3D%3D"}],"group":"cf-nel","max\_age":604800} | | Server | Information about the software used by the origin server | cloudflare | | strict-transport-security | HTTP response header: strict-transport-security | max-age=63072000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Accept, Origin | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-download-options | HTTP response header: x-download-options | noopen | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-permitted-cross-domain-policies | HTTP response header: x-permitted-cross-domain-policies | none | | x-request-id | A unique identifier for the request | cb702bdb-99e1-4cd5-9d54-25a8e1f19338 | | x-runtime | HTTP response header: x-runtime | 0.025454 | | x-served-by | HTTP response header: x-served-by | triage.curbsidebrewing.dev | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |