Cyfirma V2

CYFIRMA V2 is a cyber intelligence platform that provides actionable insights into threats and vulnerabilities.

CYFIRMA V2 offers a comprehensive threat intelligence platform that provides proactive threat detection and analysis. By integrating with Swimlane Turbine, users can seamlessly access tailored alerts for attack surfaces, data breaches, and digital risks, enhancing their security posture. This integration empowers security teams to automate the retrieval and analysis of Indicators of Compromise (IOCs) in various formats, facilitating swift threat response and mitigation.

Prerequisites

Before you can use the CYFIRMA V2 connector for Turbine, you'll need access to the CYFIRMA API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing CYFIRMA V2 services.

Key: Your unique API key for authenticating requests.

Capabilities

This connector provides the following capabilities:

Get Attack Surface Alerts

Get Data Breach And Web Monitoring

Get Digitial Risk Impersonation Infringement

Get Social Public Exposure

IOCs in CSV

IOCs in JSON

IOCs in XML

List of IOCs

Seach for IOC

Asset Setup

The CYFIRMA asset requires an URL and an API Key to interact with the API.

Additional Documentation

Cyfirma V2 Connector Documentation

Cyfirma V2 API Documentation

Cyfirma V2 Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
key	Key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Attack Surface Alerts

Retrieve tailored alerts data based on the specified alert configuration in the CYFIRMA V2 on-board page, requiring 'type' parameter.

Endpoint

URL: /core/api-ua/v2/alerts/attack-surface

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	The value of the type of parameter is dependent on the API that is being called.
parameters.page	number	Optional	The records returned by the API are paginated.
parameters.size	number	Optional	The number of records per page is defined by the value of size.
parameters.impact	string	Optional	The default behaviour of the API is to return all data without being filtered by impact. If a value is passed - either single or comma separated - then the retrieved data is filtered accordingly.
parameters.after	string	Optional	Retrieve all data having created_date value greater than the value specified in this parameter.
parameters.from-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.to-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.order-by-created-date	string	Optional	The response dataset can be ordered by the created_date field. The records are in descending(desc) order by default.

Input Example

{"parameters":{"type":"open-ports","page":1,"size":10,"impact":"low","after":"","from-date-time":"","to-date-time":"","order-by-created-date":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 02 Nov 2023 10:47:40 GMT","Content-Type":"application/json","Content-Length":"3551","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","Content-Encoding":"gzip","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-security...

Get Data Breach And Web Monitoring

Retrieve CYFIRMA V2 alerts for data breaches and web monitoring based on specified alert configurations, including parameters and type.

Endpoint

URL: /core/api-ua/v2/alerts/data-breach-and-web-monitoring

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	The value of the type of parameter is dependent on the API that is being called.
parameters.page	number	Optional	The records returned by the API are paginated.
parameters.size	number	Optional	The number of records per page is defined by the value of size.
parameters.impact	string	Optional	The default behaviour of the API is to return all data without being filtered by impact. If a value is passed - either single or comma separated - then the retrieved data is filtered accordingly.
parameters.after	string	Optional	Retrieve all data having created_date value greater than the value specified in this parameter.
parameters.from-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.to-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.order-by-created-date	string	Optional	The response dataset can be ordered by the created_date field. The records are in descending(desc) order by default.

Input Example

{"parameters":{"type":"phishing","page":1,"size":10,"impact":"low","after":"","from-date-time":"","to-date-time":"","order-by-created-date":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 02 Nov 2023 10:56:22 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-security":"max-age=31536000 ...

Get Digital Risk Imperonation Infringement

Retrieve alerts for impersonation and infringement digital risks from CYFIRMA V2, filtered by the 'type' parameter.

Endpoint

URL: /core/api-ua/v2/alerts/impersonation-and-infringement

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	The value of the type of parameter is dependent on the API that is being called.
parameters.page	number	Optional	The records returned by the API are paginated.
parameters.size	number	Optional	The number of records per page is defined by the value of size.
parameters.impact	string	Optional	The default behaviour of the API is to return all data without being filtered by impact. If a value is passed - either single or comma separated - then the retrieved data is filtered accordingly.
parameters.after	string	Optional	Retrieve all data having created_date value greater than the value specified in this parameter.
parameters.from-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.to-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.order-by-created-date	string	Optional	The response dataset can be ordered by the created_date field. The records are in descending(desc) order by default.

Input Example

{"parameters":{"type":"social-handlers"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 02 Nov 2023 10:42:40 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-security":"max-age=31536000 ...

Retrieve public social exposure alerts from CYFIRMA V2 based on a specified alert type.

Endpoint

URL: /core/api-ua/v2/alerts/social-and-public-exposure

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	The value of the type of parameter is dependent on the API that is being called.
parameters.page	number	Optional	The records returned by the API are paginated.
parameters.size	number	Optional	The number of records per page is defined by the value of size.
parameters.impact	string	Optional	The default behaviour of the API is to return all data without being filtered by impact. If a value is passed - either single or comma separated - then the retrieved data is filtered accordingly.
parameters.after	string	Optional	Retrieve all data having created_date value greater than the value specified in this parameter.
parameters.from-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.to-date-time	string	Optional	Retrieve data having created_date value between from-date-time and to-date-time.
parameters.order-by-created-date	string	Optional	The response dataset can be ordered by the created_date field. The records are in descending(desc) order by default.

Input Example

{"parameters":{"type":"source-code"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 02 Nov 2023 11:05:13 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","Content-Encoding":"gzip","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-se...

IOCs in CSV

Retrieve Indicators of Compromise in STIX 1.1 CSV format from CYFIRMA V2, with options for delta or full export using parameters.

Endpoint

URL: /core/api-ua/threatioc/csv

Method: GET

Input

Argument Name	Type	Required	Description
parameters.delta	boolean	Required	• true - will return only the IOCs that were added in the platform after the last API call. • false - will return the IOCs that were added in the system in the last 24 hours.
parameters.all	boolean	Required	• true - will return all the IOCs irrespective of whether it has been linked to the client. • false - will return only those IOCs that have been linked to the client.
parameters.with-risk-score	boolean	Optional	• true - will return the IOCs with risk score. • false - will return the IOCs without risk score.

Input Example

{"parameters":{"key":"API_KEY_VALUE","delta":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	object	Output field: file
file.file_name	string	Name of the resource
file.file	string	Output field: file.file

Output Example

{"file":{"file_name":"Example Name","file":"string"}}

IOCs in JSON

Obtain Indicators of Compromise in STIX 1.1 JSON format from CYFIRMA V2, with options for delta or full export using parameters.

Endpoint

URL: /core/api-ua/threatioc/stix-json

Method: GET

Input

Argument Name	Type	Required	Description
parameters.delta	boolean	Required	• true - will return only the IOCs that were added in the platform after the last API call. • false - will return the IOCs that were added in the system in the last 24 hours.
parameters.all	boolean	Required	• true - will return all the IOCs irrespective of whether it has been linked to the client. • false - will return only those IOCs that have been linked to the client.

Input Example

{"parameters":{"all":true,"delta":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"observables":null,"indicators":{},"exploitTargets":null,"incidents":null,"coursesOfAction":null,"campaigns":null,"threatActors":null,"reports":null,"relatedPackages":null,"id":"{https://www.cyfirma.com/}package-6a445526-98ce-4d99-8ebd-6fcffa086128","idref":null,"timestamp":"2020-09-30T08:23:33.945+0000","version":"1.2","stixheader":{},"ttps":null}]}

IOCs in XML

Retrieve Indicators of Compromise in STIX 1.1 XML format from CYFIRMA V2, with options for delta or full data retrieval.

Endpoint

URL: /core/api-ua/threatioc/stix-xml

Method: GET

Input

Argument Name	Type	Required	Description
parameters.delta	boolean	Required	• true - will return only the IOCs that were added in the platform after the last API call. • false - will return the IOCs that were added in the system in the last 24 hours.
parameters.all	boolean	Required	• true - will return all the IOCs irrespective of whether it has been linked to the client. • false - will return only those IOCs that have been linked to the client.

Input Example

{"parameters":{"key":"API_KEY_VALUE","delta":true}}

Output

Output Example

{"status_code":200,"reason":"OK","json_body":{"STIX_Package":{"STIX_Header":{},"Indicators":{},"_xmlns":"http://xml/metadataSharing.xsd","_xmlns:AddressObj":"http://cybox.mitre.org/objects#AddressObject-2","_xmlns:Cyfirma":"https://www.cyfirma.com/","_xmlns:URIObj":"http://cybox.mitre.org/objects#URIObject-2","_xmlns:cybox":"http://cybox.mitre.org/cybox-2","_xmlns:cyboxCommon":"http://cybox.mitre.org/common-2","_xmlns:indicator":"http://stix.mitre.org/Indicator-2","_xmlns:stix":"http://stix.mitr...

List of IOCs

Retrieve a list of Indicators of Compromise (IOCs) from CYFIRMA V2 in STIX 2.1 format, with options for delta and all.

Endpoint

URL: /core/api-ua/threatioc/stix/v2.1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.delta	boolean	Required	• true - will return only the IOCs that were added in the platform after the last API call. • false - will return the IOCs that were added in the system in the last 24 hours.
parameters.all	boolean	Required	• true - will return all the IOCs irrespective of whether it has been linked to the client. • false - will return only those IOCs that have been linked to the client.

Input Example

{"parameters":{"key":"API_KEY_VALUE","delta":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"type":"indicator","spec_version":"2.1","id":"indicator--8e2e2d2b-17d4-4cbf-938f-98ee46b3cd3f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2016-04-06T20:03:48.000Z","modified":"2016-04-06T20:03:48.000Z","indicator_types":[],"name":"Poison Ivy Malware","description":"This file is part of Poison Ivy","pattern":"[ file:hashes.'SHA-256' = '4bac27393bdd9777ce02453256c5577cd02275510b2227f473d03...","valid_from":"2016-01-01...

Search for IOCs

Retrieve IOCs in STIX 2.1 JSON format by searching with specific indicator types such as MD5, SHA, IP, DOMAIN, etc., using 'indicatorType' and 'value' parameters.

Endpoint

URL: /core/api-ua/threatioc/stix/v2.1/search

Method: GET

Input

Argument Name	Type	Required	Description
parameters.indicatorType	string	Required	If the search is using the IOC api, the value, indicator type param value needs to be defined. One of the value types from the indicator types (MD5, SHA, IP, DOMAIN, HOSTNAME, URL, EMAIL, CVE, EXPLOIT, MUTEX) can be passed to the API, which retrieves the details according to that request.
parameters.value	string	Required	The param for value requires to get the details of the IOC’s in STIX2.1 format and all associated with threat actors, Campaign, Intrusion-Set, etc.

Input Example

{"parameters":{"key":"API_KEY_VALUE","indicatorType":"MD5","value":"STIX2.1 format String"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, max-age=0, must-revalidate
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	81fbccfa3d589a95-NAG
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	3551
content-security-policy	HTTP response header: content-security-policy	default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com https://d3js.org https://cdn.ckeditor.com https://www.amcharts.com https://cdn.amcharts.com https://d3js.org/d3.v4.min.js; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://www.amcharts.com https://d3js.org https://cdn.ckeditor.com; img-src * 'self' data:; font-src * 'self' data:
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 02 Nov 2023 10:42:40 GMT
expires	The date/time after which the response is considered stale	0
permissions-policy	HTTP response header: permissions-policy	camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(), accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self)
pragma	HTTP response header: pragma	no-cache
referrer-policy	HTTP response header: referrer-policy	strict-origin-when-cross-origin
Server	Information about the software used by the origin server	cloudflare
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000 ; includeSubDomains, max-age=63072000; includeSubDomains; preload
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
x-content-type-options	HTTP response header: x-content-type-options	nosniff, nosniff
x-frame-options	HTTP response header: x-frame-options	DENY, DENY
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block, 1; mode=block

Cyfirma V2

Prerequisites

Capabilities

Asset Setup

Additional Documentation

Configurations

API Key Authentication

Configuration Parameters

Actions

Get Attack Surface Alerts

Endpoint

Input

Input Example

Output

Output Example

Get Data Breach And Web Monitoring

Endpoint

Input

Input Example

Output

Output Example

Get Digital Risk Imperonation Infringement

Endpoint

Input

Input Example

Output

Output Example

Get Social Public Exposure

Endpoint

Input

Input Example

Output

Output Example

IOCs in CSV

Endpoint

Input

Input Example

Output

Output Example

IOCs in JSON

Endpoint

Input

Input Example

Output

Output Example

IOCs in XML

Endpoint

Input

Input Example

Output

Output Example

List of IOCs

Endpoint

Input

Input Example

Output

Output Example

Search for IOCs

Endpoint

Input

Input Example

Output

Output Example

Response Headers