--- title: Cybersixgill slug: connectors/cybersixgill docTags: createdAt: 2026-06-09T16:29:36.218Z --- Cybersixgill is a threat intelligence platform that provides real-time insights into cyber threats from the deep and dark web. Cybersixgill is a leading threat intelligence platform that provides real-time insights into cyber threats from the deep and dark web. This connector enables Swimlane Turbine users to seamlessly integrate Cybersixgill's actionable intelligence into their security operations. By leveraging this integration, users can automate the retrieval, update, and deletion of actionable alerts, conduct threat analysis, and engage with Cybersixgill's IQ for enhanced threat detection and response. This empowers security teams to streamline their workflows, enhance threat visibility, and respond to threats more efficiently. ## Prerequisites Before you can use the Cybersixgill connector for Turbine, you'll need access to the Cybersixgill API. This requires the following: - OAuth 2.0 client credentials authentication using the following parameters: - URL: The endpoint for accessing Cybersixgill's API services. - Client ID: Your unique identifier for authenticating API requests. - Client Secret: A secret key used in conjunction with the Client ID to authenticate API requests. ## Capabilities This connector provides the following capabilities: - Get actionable alerts by ID. - Deletes a list of actionable alerts by ID. - Updates a list of actionable alerts by ID. - Get actionable alerts statistics per user. - Gets an actionable alert by ID. - Deletes an actionable alert by ID. - Updates an actionable alert by ID. - IQ/Chat - Enter a question and return a response. - IQ/Chat by Request ID. ## Additional Documentation - [Cybersixgill Connector Documentation](https://docs.swimlane.com/connectors/cybersixgill) - [Cybersixgill API Documentation](https://api.cybersixgill.com/) - [Cybersixgill Authentication Guide](https://docs.swimlane.com/authentication-guides/cybersixgill) # Configurations ## Cybersixgill Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Delete Actionable Alert by ID Remove a specified actionable alert from Cybersixgill using the unique alert ID provided as a path parameter. ### Endpoint - **URL:** `/alerts/actionable_alert/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Delete Actionable Alert by ID action | ### Input Example `{"path_parameters":{"id":"5fbcfeb23a5ce900013de081"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items_modified` | array | Output field: items\_modified | | `items_modified_count` | number | Count value | | `message` | string | Response message | | `status` | number | Status value | ### Output Example `{"items_modified":["5fbcfeb23a5ce900013de081"],"items_modified_count":1,"message":"Successfully deleted 5fbcfeb23a5ce900013de081","status":200}` ## Delete Actionable Alerts Remove specified actionable alerts from Cybersixgill using a list of IDs and optional filters. Requires data\_body input. ### Endpoint - **URL:** `/alerts/actionable-alert` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.organization_id` | string | Optional | Parameters for the Delete Actionable Alerts action | | `parameters.is_read` | string | Optional | Parameters for the Delete Actionable Alerts action | | `parameters.threat_level` | string | Optional | Parameters for the Delete Actionable Alerts action | | `parameters.threat_type` | string | Optional | Parameters for the Delete Actionable Alerts action | | `data_body` | string | Required | Response data | ### Input Example `{"parameters":{"organization_id":"string","is_read":"unread","threat_level":"emerging","threat_type":"string"},"data_body":"[\"5ebc3929a4a7e300012365ae\"]"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items_modified_count` | number | Count value | | `message` | string | Response message | | `status` | number | Status value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified_count":1,"message":"Successfully deleted 1 Actionable Alerts","status":200}}` ## Get Actionable Alert by ID Retrieve a specific actionable alert from Cybersixgill using the unique alert ID provided in the path parameters. ### Endpoint - **URL:** `/alerts/actionable_alert/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------------------- | | `parameters.organization_id` | string | Optional | Parameters for the Get Actionable Alert by ID action | | `path_parameters.id` | string | Required | Parameters for the Get Actionable Alert by ID action | ### Input Example `{"parameters":{"organization_id":"string"},"path_parameters":{"id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------- | -------- | ------------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `additional_info` | object | Output field: additional\_info | | `additional_info.asset_attributes` | array | Output field: additional\_info.asset\_attributes | | `additional_info.date` | string | Date value | | `additional_info.matched_organization_aliases` | array | Output field: additional\_info.matched\_organization\_aliases | | `additional_info.matched_organization_aliases.file_name` | string | Name of the resource | | `additional_info.matched_organization_aliases.file` | string | Output field: additional\_info.matched\_organization\_aliases.file | | `additional_info.organization_aliases` | array | Output field: additional\_info.organization\_aliases | | `additional_info.organization_name` | string | Name of the resource | | `additional_info.post_attributes` | array | Output field: additional\_info.post\_attributes | | `additional_info.query_attributes` | array | Output field: additional\_info.query\_attributes | | `additional_info.site` | string | Output field: additional\_info.site | | `additional_info.template_id` | string | Unique identifier | | `alert_id` | string | Unique identifier | | `alert_name` | string | Name of the resource | | `assessment` | string | Output field: assessment | | `category` | string | Output field: category | | `content_type` | string | Type of the resource | | `description` | string | Output field: description | | `es_id` | string | Unique identifier | | `es_item` | object | Output field: es\_item | | `es_item.category` | string | Output field: es\_item.category | | `es_item.channel_message_id` | number | Unique identifier | | `es_item.collection_date` | string | Date value | ### Output Example `{"additional_info":{"asset_attributes":["string"],"date":"2024-01-01T00:00:00Z","matched_organization_aliases":[{}],"organization_aliases":["string"],"organization_name":"Example Name","post_attributes":["string"],"query_attributes":["string"],"site":"string","template_id":"string"},"alert_id":"string","alert_name":"Example Name","assessment":"string","category":"string","content_type":"string","description":"string","es_id":"string","es_item":{"category":"string","channel_message_id":123,"colle...` ## Get Actionable Alert Stats per User Retrieve statistics for actionable alerts on a per-user basis in Cybersixgill. ### Endpoint - **URL:** `/alerts/actionable_alert/stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------------- | | `parameters.organization_id` | string | Optional | Parameters for the Get Actionable Alert Stats per User action | | `parameters.threat_level` | string | Optional | Parameters for the Get Actionable Alert Stats per User action | ### Input Example `{"parameters":{"organization_id":"string","threat_level":"emerging"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `by_threat_level` | object | Output field: by\_threat\_level | | `by_threat_level.emerging` | number | Output field: by\_threat\_level.emerging | | `by_threat_level.imminent` | number | Output field: by\_threat\_level.imminent | | `by_threat_type` | object | Type of the resource | | `by_threat_type.Brand Protection` | number | Type of the resource | | `by_threat_type.Compromised Accounts` | number | Type of the resource | | `by_threat_type.DDoS Attack` | number | Type of the resource | | `by_threat_type.Data Leak` | number | Response data | | `by_threat_type.Defacement` | number | Type of the resource | | `by_threat_type.Fraud` | number | Type of the resource | | `by_threat_type.Malware` | number | Type of the resource | | `by_threat_type.Phishing` | number | Type of the resource | | `by_threat_type.Vulnerability Exploit` | number | Type of the resource | | `by_threat_type.Web Attack` | number | Type of the resource | | `total` | number | Output field: total | ### Output Example `{"by_threat_level":{"emerging":140,"imminent":360},"by_threat_type":{"Brand Protection":9,"Compromised Accounts":48,"DDoS Attack":96,"Data Leak":49,"Defacement":97,"Fraud":164,"Malware":9,"Phishing":82,"Vulnerability Exploit":129,"Web Attack":96},"total":500}` ## Get Actionable Alerts Retrieve a list of actionable alerts from Cybersixgill using optional filters to refine results. ### Endpoint - **URL:** `/alerts/actionable-alert` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.alert_type_id` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.organization_id` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.sort_by` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.sort_order` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.offset` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.fetch_size` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.from_date` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.to_date` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.is_read` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.threat_level` | string | Optional | Parameters for the Get Actionable Alerts action | | `parameters.threat_type` | string | Optional | Parameters for the Get Actionable Alerts action | ### Input Example `{"parameters":{"alert_type_id":"string","organization_id":"string","sort_by":"date","sort_order":"asc","offset":"200","fetch_size":"50","from_date":"YYYY-MM-DD","to_date":"YYYY-MM-DD","is_read":"unread","threat_level":"imminent","threat_type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"alert_name":"RogueAppAlert","category":"regular","content":"String","date":"2020-05-13 18:15:05","id":"5ebc3929a4a7e300012365ae","read":false,"severity":10,"threat_level":"imminent","threats":["Data Leak","Brand Protection","Phishing"],"title":"An App Matching JJ Halen Assets was Found in an App Store","user_id":"5d2336aef8db38787dbe4f69"}` ## IQ Chat Pose a question to Cybersixgill's IQ and receive relevant answers. Requires a 'query' in the JSON body. ### Endpoint - **URL:** `/iq/chat` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------- | | `query` | string | Optional | Parameter for IQ Chat | | `add_references` | boolean | Optional | Parameter for IQ Chat | ### Input Example `{"json_body":{"query":"Is there a CVE related to the BlackLotus malware?","add_references":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `answer` | string | Output field: answer | | `request_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"answer":"Yes, there is a CVE related to the BlackLotus malware. The CVE is CVE2022-21894....","request_id":"846c19a4-a70c-4595-ac19-a4a70c9595d4"}}` ## IQ Chat by Request ID Retrieve query results applicable to your organization using the ID from a previous iq/chat request in Cybersixgill. Requires answer\_request\_id in the JSON body. ### Endpoint - **URL:** `/iq/chat/my_organization` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------- | | `answer_request_id` | string | Optional | Unique identifier | ### Input Example `{"json_body":{"answer_request_id":"5607113f-b7e2-4a50-adcb-7f1634baa228"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `answer` | string | Output field: answer | | `request_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"answer":"string","request_id":"fc01ca85-f074-4e84-81ca-85f074be8442"}}` ## Update Actionable Alert by ID Update a specific actionable alert in Cybersixgill using its unique ID, modifying parameters such as read status, threat level, and current status. ### Endpoint - **URL:** `/alerts/actionable_alert/{{id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Update Actionable Alert by ID action | | `parameters.organization_id` | string | Optional | Parameters for the Update Actionable Alert by ID action | | `read` | string | Optional | Parameter for Update Actionable Alert by ID | | `threat_level` | string | Optional | Parameter for Update Actionable Alert by ID | | `status` | string | Optional | Status value | ### Input Example `{"parameters":{"organization_id":"string"},"json_body":{"read":"read","threat_level":"emerging","status":"resolved"},"path_parameters":{"id":"5fbcfeb23a5ce900013de081"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items_modified` | array | Output field: items\_modified | | `items_modified_count` | number | Count value | | `message` | string | Response message | | `status` | number | Status value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified":["5fbcfeb23a5ce900013de081"],"items_modified_count":1,"message":"Successfully deleted 5fbcfeb23a5ce900013de081","status":200}}` ## Update Actionable Alerts Update Cybersixgill actionable alerts by ID, with options to mark them as read or unread and change their treatment status. ### Endpoint - **URL:** `/alerts/actionable-alert` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.organization_id` | string | Optional | Parameters for the Update Actionable Alerts action | | `id_list` | array | Optional | Unique identifier | | `set_read` | string | Optional | Parameter for Update Actionable Alerts | | `threat_level` | string | Optional | Parameter for Update Actionable Alerts | | `threat_type` | string | Optional | Type of the resource | ### Input Example `{"parameters":{"organization_id":"string"},"json_body":{"id_list":["5fb4c6a6d604c200010f0916"],"set_read":"read","threat_level":"emerging","threat_type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items_modified_count` | number | Count value | | `message` | string | Response message | | `status` | number | Status value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"items_modified_count":1,"message":"Successfully updated 1 Actionable Alerts","status":200}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |