--- title: Cyberint slug: connectors/cyberint docTags: createdAt: 2026-06-09T16:29:33.140Z --- Cyberint is a cybersecurity platform that provides advanced threat intelligence and protection services. Cyberint is a leading threat intelligence platform that provides comprehensive insights into cyber threats and vulnerabilities. The Cyberint connector for Swimlane Turbine enables seamless integration to automate the retrieval and analysis of threat intelligence data. This integration empowers security teams to efficiently manage alerts, enrich threat data, and update alert statuses, enhancing the overall security posture and response capabilities within the Swimlane platform. ## Prerequisites Before you can use the Cyberint connector for Turbine, you'll need access to the Cyberint API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing Cyberint's API. - API Key: A unique key provided by Cyberint to authenticate API requests. ## Capabilities This plugin provides the following capabilities: - Capabilities - Go - Here - e.g. Manage Firewall Policies instead of listing each individual tasks ### Limitations Include information about known limitations here, including supported or minimum versions, especially known unsupported versions. ## Asset Setup The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors. ## Tasks Setup Special task setup as needed depending on plugin, exclude if empty. Known available allowed input options from enum type selection ## Notes - Any other notes not fitting other sections go here. - Any reference URLs to external docs or other resources ## Additional Documentation - [Cyberint Connector Documentation](https://docs.swimlane.com/connectors/cyberint) - [Cyberint API Documentation](https://api.cyberint.com/) - [Cyberint Authentication Guide](https://docs.swimlane.com/authentication-guides/cyberint) # Configurations ## Cyberint API Key Authentication Authenticates Cyberint using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | access\_token | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Download Daily IOC Feed by Type and Activity Download a daily JSON-Lines document from Cyberint by specifying the desired date, IOC type, and detected activity. ### Endpoint - **URL:** `/ioc/api/v1/feed/daily` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ---------------------------------------------------------------------- | | `parameters.detected_activity` | string | Required | Parameters for the Download Daily IOC Feed by Type and Activity action | | `parameters.ioc_type` | string | Required | Parameters for the Download Daily IOC Feed by Type and Activity action | | `parameters.date` | string | Required | Parameters for the Download Daily IOC Feed by Type and Activity action | | `parameters.format` | string | Optional | Parameters for the Download Daily IOC Feed by Type and Activity action | ### Input Example `{"parameters":{"detected_activity":"malware_payload","ioc_type":"ipv4","date":"2024-02-28","format":"json1"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{}}` ## Get Alert Analysis Report Retrieve an analysis report for a specific alert in Cyberint using the alert reference ID. ### Endpoint - **URL:** `/alert/api/v1/alerts/{{alert_ref_id}}/analysis_report` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `path_parameters.alert_ref_id` | string | Required | Alert Ref Id | ### Input Example `{"path_parameters":{"alert_ref_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `status` | string | Status value | | `file` | array | Output field: file | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":302,"status":"OK","response_headers":{},"json_body":{}}` ## Get Alert Attachment Retrieve an attachment from Cyberint using the alert reference ID and attachment internal ID. ### Endpoint - **URL:** `/alert/api/v1/alerts/{{alert_ref_id}}/attachments/{{attachment_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------- | | `path_parameters.alert_ref_id` | string | Required | Alert Ref Id | | `path_parameters.attachment_id` | string | Required | Attachment Id | ### Input Example `{"path_parameters":{"alert_ref_id":"string","attachment_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `status` | string | Status value | | `file` | array | Output field: file | | `file.file_name` | string | Name of the resource | | `file.file` | string | Output field: file.file | ### Output Example `{"status_code":302,"status":"OK","response_headers":{},"file":[]}` ## Get Alerts Retrieve up to 100 alerts from Cyberint, sorted by modification date. Use filters like modification\_date and created\_date for specific results, or get alerts modified in the past 24 hours if no filters are applied. ### Endpoint - **URL:** `/alert/api/v1/alerts` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `page` | number | Optional | Page number to retrieve | | `size` | number | Optional | Number of alerts per page | | `filters` | object | Optional | Filters to retrieve alerts by | | `filters.created_date` | object | Optional | Query alerts by creation date if specified | | `filters.created_date.from` | string | Required | Parameter for Get Alerts | | `filters.created_date.to` | string | Required | Parameter for Get Alerts | | `filters.modification_date` | object | Optional | Query alerts by modification date if specified | | `filters.modification_date.from` | string | Required | Parameter for Get Alerts | | `filters.modification_date.to` | string | Required | Parameter for Get Alerts | | `filters.environments` | array | Optional | Filter alerts by environments. If not specified, retrieves all alerts in customer environment and all sub environments. | | `filters.status` | array | Optional | Filter alerts by status | | `filters.severity` | array | Optional | Filter alerts by severity | | `filters.type` | array | Optional | Filter alerts by type | ### Input Example `{"json_body":{"page":1,"size":10,"filters":{"created_date":{"from":"2019-08-24T14:15:22Z","to":"2019-08-24T14:15:22Z"},"modification_date":{"from":"2019-08-24T14:15:22Z","to":"2019-08-24T14:15:22Z"},"environments":["string"],"status":["open"],"severity":["low"],"type":["refund_fraud"]}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `status` | string | Status value | | `total` | number | Output field: total | | `alerts` | array | Output field: alerts | | `alerts.environment` | string | Output field: alerts.environment | | `alerts.ref_id` | string | Unique identifier | | `alerts.confidence` | number | Unique identifier | | `alerts.status` | string | Status value | | `alerts.severity` | string | Output field: alerts.severity | | `alerts.created_date` | string | Date value | | `alerts.created_by` | object | Output field: alerts.created\_by | | `alerts.created_by.email` | string | Output field: alerts.created\_by.email | | `alerts.category` | string | Output field: alerts.category | | `alerts.type` | string | Type of the resource | | `alerts.source_category` | string | Output field: alerts.source\_category | | `alerts.source` | string | Output field: alerts.source | | `alerts.targeted_vectors` | array | Output field: alerts.targeted\_vectors | | `alerts.targeted_vectors.file_name` | string | Name of the resource | | `alerts.targeted_vectors.file` | string | Output field: alerts.targeted\_vectors.file | | `alerts.targeted_brands` | array | Output field: alerts.targeted\_brands | | `alerts.targeted_brands.file_name` | string | Name of the resource | | `alerts.targeted_brands.file` | string | Output field: alerts.targeted\_brands.file | | `alerts.related_entities` | array | Output field: alerts.related\_entities | | `alerts.related_entities.file_name` | string | Name of the resource | | `alerts.related_entities.file` | string | Output field: alerts.related\_entities.file | ### Output Example `{"status_code":200,"status":"OK","response_headers":{},"json_body":{"total":0,"alerts":[{}]}}` ## Get Domain IOC Retrieve domain indicators of compromise (IOC) from Cyberint using specified parameters and value. ### Endpoint - **URL:** `/ioc/api/v1/domain` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ---------------------------------------- | | `parameters.value` | string | Required | Parameters for the Get Domain IOC action | ### Input Example `{"parameters":{"value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.entity` | object | Response data | | `data.entity.type` | string | Response data | | `data.entity.value` | string | Response data | | `data.risk` | object | Response data | | `data.risk.malicious_score` | number | Response data | | `data.risk.detected_activities` | array | Response data | | `data.risk.detected_activities.type` | string | Response data | | `data.risk.detected_activities.observation_date` | string | Response data | | `data.risk.detected_activities.description` | string | Response data | | `data.risk.detected_activities.confidence` | number | Response data | | `data.risk.detected_activities.occurrences_count` | number | Response data | | `data.risk.occurrences_count` | number | Response data | | `data.enrichment` | object | Response data | | `data.enrichment.ips` | array | Response data | | `data.enrichment.whois` | object | Response data | | `data.enrichment.whois.registrant_name` | string | Response data | | `data.enrichment.whois.registrant_email` | string | Response data | | `data.enrichment.whois.registrant_organization` | string | Response data | | `data.enrichment.whois.registrant_country` | string | Response data | | `data.enrichment.whois.registrant_telephone` | string | Response data | | `data.enrichment.whois.technical_contact_email` | string | Response data | | `data.enrichment.whois.technical_contact_name` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}` ## Get Enriched CVE Retrieve enriched Common Vulnerabilities and Exposures (CVE) details from Cyberint using the specified CVE ID. ### Endpoint - **URL:** `/cve-intel/get_enriched_cve/{{cve_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------- | | `path_parameters.cve_id` | string | Required | CVE ID | ### Input Example `{"path_parameters":{"cve_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `status` | string | Status value | | `data` | object | Response data | | `data.id` | string | Response data | | `data.cve` | object | Response data | | `data.configurations` | object | Response data | | `data.impact` | object | Response data | | `data.published_date` | string | Response data | | `data.last_modified_date` | string | Response data | | `data.cyberint_score` | number | Response data | | `data.research_content` | object | Response data | | `data.known_exploited_vulnerability` | boolean | Response data | | `data.epss` | object | Response data | | `data.cwes` | array | Response data | | `data.indicators` | array | Response data | | `data.tags` | array | Response data | | `data.indicators_histogram` | object | Response data | ### Output Example `{"status_code":200,"status":"OK","response_headers":{},"json_body":{"data":{"id":"string","cve":{},"configurations":{},"impact":{},"published_date":"2019-08-24T14:15:22Z","last_modified_date":"2019-08-24T14:15:22Z","cyberint_score":10,"research_content":{},"known_exploited_vulnerability":true,"epss":{},"cwes":[],"indicators":[],"tags":[],"indicators_histogram":{}}}}` ## Get File SHA256 IOC Retrieve the SHA256 Indicator of Compromise (IOC) for a specified file in Cyberint using the provided parameters, including the value. ### Endpoint - **URL:** `/ioc/api/v1/file/sha256` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------------- | | `parameters.value` | string | Required | Parameters for the Get File SHA256 IOC action | ### Input Example `{"parameters":{"value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.entity` | object | Response data | | `data.entity.type` | string | Response data | | `data.entity.value` | string | Response data | | `data.risk` | object | Response data | | `data.risk.malicious_score` | number | Response data | | `data.risk.detected_activities` | array | Response data | | `data.risk.detected_activities.type` | string | Response data | | `data.risk.detected_activities.observation_date` | string | Response data | | `data.risk.detected_activities.description` | string | Response data | | `data.risk.detected_activities.confidence` | number | Response data | | `data.risk.detected_activities.occurrences_count` | number | Response data | | `data.risk.occurrences_count` | number | Response data | | `data.enrichment` | object | Response data | | `data.enrichment.filenames` | array | Response data | | `data.enrichment.first_seen` | string | Response data | | `data.enrichment.download_urls` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}` ## Get IPv4 IOC Retrieve information on an IPv4 Indicator of Compromise (IOC) from Cyberint using the specified value parameter. ### Endpoint - **URL:** `/ioc/api/v1/ipv4` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------------- | | `parameters.value` | string | Required | Parameters for the Get IPv4 IOC action | ### Input Example `{"parameters":{"value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.entity` | object | Response data | | `data.entity.type` | string | Response data | | `data.entity.value` | string | Response data | | `data.risk` | object | Response data | | `data.risk.malicious_score` | number | Response data | | `data.risk.detected_activities` | array | Response data | | `data.risk.detected_activities.type` | string | Response data | | `data.risk.detected_activities.observation_date` | string | Response data | | `data.risk.detected_activities.description` | string | Response data | | `data.risk.detected_activities.confidence` | number | Response data | | `data.risk.detected_activities.occurrences_count` | number | Response data | | `data.risk.occurrences_count` | number | Response data | | `data.enrichment` | object | Response data | | `data.enrichment.geo` | object | Response data | | `data.enrichment.geo.country` | string | Response data | | `data.enrichment.geo.city` | string | Response data | | `data.enrichment.asn` | object | Response data | | `data.enrichment.asn.number` | number | Response data | | `data.enrichment.asn.organization` | string | Response data | | `data.enrichment.suspicious_urls` | array | Response data | | `data.enrichment.suspicious_domains` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}` ## Get URL IOC Retrieve URL Indicators of Compromise (IOC) from Cyberint using specified parameters, including the value parameter. ### Endpoint - **URL:** `/ioc/api/v1/url` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------- | | `parameters.value` | string | Required | Parameters for the Get URL IOC action | ### Input Example `{"parameters":{"value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.entity` | object | Response data | | `data.entity.type` | string | Response data | | `data.entity.value` | string | Response data | | `data.risk` | object | Response data | | `data.risk.malicious_score` | number | Response data | | `data.risk.detected_activities` | array | Response data | | `data.risk.detected_activities.type` | string | Response data | | `data.risk.detected_activities.observation_date` | string | Response data | | `data.risk.detected_activities.description` | string | Response data | | `data.risk.detected_activities.confidence` | number | Response data | | `data.risk.detected_activities.occurrences_count` | number | Response data | | `data.risk.occurrences_count` | number | Response data | | `data.enrichment` | object | Response data | | `data.enrichment.ips` | array | Response data | | `data.enrichment.hostname` | string | Response data | | `data.enrichment.domain` | string | Response data | ### Output Example `{"status_code":200,"reason":"OK","response_headers":{},"json_body":{"data":{"entity":{},"risk":{},"enrichment":{}}}}` ## Update Alert Status Update the status of up to 100 alerts in Cyberint. Requires alert\_ref\_ids and data in JSON body, with a closure reason if setting status to 'Close'. ### Endpoint - **URL:** `/alert/api/v1/alerts/status` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------------------- | | `alert_ref_ids` | array | Optional | ref id of the requested alerts | | `data` | object | Optional | Response data | | `data.status` | string | Optional | Desired status to update for the alerts | | `data.closure_reason` | string | Optional | Reason for updating the alerts status to close | ### Input Example `{"json_body":{"alert_ref_ids":["1","2"],"data":{"status":"closed","closure_reason":"resolved"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `status` | string | Status value | ### Output Example `{"status_code":200,"status":"OK","response_headers":{},"json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |