--- title: Cyfirma slug: connectors/cyfirma docTags: createdAt: 2026-06-09T16:29:32.708Z --- CYFIRMA is a cybersecurity platform that provides threat intelligence to help organizations anticipate and mitigate cyber risks. CYFIRMA is a leading cyber threat intelligence platform that provides proactive insights into potential threats. The CYFIRMA connector for Swimlane Turbine enables users to access Indicators of Compromise (IOCs) in STIX 1.1 JSON format, allowing for seamless integration into security workflows. By leveraging this connector, Swimlane Turbine users can automate the retrieval of critical threat intelligence, enhancing their ability to respond to emerging threats swiftly and effectively. This integration empowers security teams to maintain a proactive security posture by accessing timely and relevant threat data directly within their automation playbooks. ## Prerequisites Before you can use the CYFIRMA connector for Turbine, you'll need access to the CYFIRMA API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing CYFIRMA's API services. - Key: Your unique API key for authenticating requests to CYFIRMA. CYFIRMA is an external threat landscape management platform company offering predictive threat visibility and intelligence. ## Capabilities This connector provides the following capabilities: - Get IOC ## Asset Setup The CYFIRMA asset requires an `URL` and an `API Key` to interact with the API. ## Additional Documentation - [Cyfirma Connector Documentation](https://docs.swimlane.com/connectors/cyfirma) - [Cyfirma API Documentation](https://api.cyfirma.com/) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | key | key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get IOC Provides Indicators of Compromise (IOCs) in STIX 1.1 JSON format from CYFIRMA, requiring parameters such as delta and all. ### Endpoint - **URL:** `/core/api-ua/threatioc/stix-json` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.delta` | boolean | Required | true - will return only the IOCs that were added in the platform after the last API call. false - will return the IOCs that were added in the system in the last 24 hours. | | `parameters.all` | boolean | Required | true - will return all the IOCs irrespective of whether it has been linked to the client. false - will return only those IOCs that have been linked to the client. | ### Input Example `{"parameters":{"delta":true,"all":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | ------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `observables` | object | Output field: observables | | `indicators` | object | Output field: indicators | | `indicators.indicators` | array | Output field: indicators.indicators | | `exploitTargets` | object | Output field: exploitTargets | | `incidents` | object | Unique identifier | | `coursesOfAction` | object | Output field: coursesOfAction | | `campaigns` | object | Output field: campaigns | | `threatActors` | object | Output field: threatActors | | `reports` | object | Output field: reports | | `relatedPackages` | object | Output field: relatedPackages | | `id` | string | Unique identifier | | `idref` | object | Unique identifier | | `timestamp` | string | Output field: timestamp | | `version` | string | Output field: version | | `stixheader` | object | Output field: stixheader | | `stixheader.title` | object | Output field: stixheader.title | | `stixheader.packageIntents` | array | Output field: stixheader.packageIntents | | `stixheader.descriptions` | array | Output field: stixheader.descriptions | | `stixheader.descriptions.value` | string | Value for the parameter | | `stixheader.descriptions.id` | object | Unique identifier | | `stixheader.descriptions.ordinality` | object | Output field: stixheader.descriptions.ordinality | | `stixheader.descriptions.structuringFormat` | object | Output field: stixheader.descriptions.structuringFormat | | `stixheader.shortDescriptions` | array | Output field: stixheader.shortDescriptions | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 30 Oct 2023 17:08:47 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, A...","Content-Encoding":"gzip","expires":"0","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","x-xss-protection":"1; mode=block, 1; mode=block","pragma":"no-cache","x-content-type-options":"nosniff, nosniff","strict-transport-se...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 81e54323fddf9a90-NAG | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | content-security-policy | HTTP response header: content-security-policy | default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' [https://storage.googleapis.com](https://storage.googleapis.com) [https://d3js.org](https://d3js.org) [https://cdn.ckeditor.com](https://cdn.ckeditor.com) [https://www.amcharts.com](https://www.amcharts.com) [https://cdn.amcharts.com](https://cdn.amcharts.com) [https://d3js.org/d3.v4.min.js](https://d3js.org/d3.v4.min.js); style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline' [https://fonts.googleapis.com](https://fonts.googleapis.com) [https://www.amcharts.com](https://www.amcharts.com) [https://d3js.org](https://d3js.org) [https://cdn.ckeditor.com](https://cdn.ckeditor.com); img-src \* 'self' data:; font-src \* 'self' data: | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 30 Oct 2023 17:08:47 GMT | | expires | The date/time after which the response is considered stale | 0 | | permissions-policy | HTTP response header: permissions-policy | camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(), accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self) | | pragma | HTTP response header: pragma | no-cache | | referrer-policy | HTTP response header: referrer-policy | strict-origin-when-cross-origin | | Server | Information about the software used by the origin server | cloudflare | | strict-transport-security | HTTP response header: strict-transport-security | max-age=31536000 ; includeSubDomains, max-age=63072000; includeSubDomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers | | x-content-type-options | HTTP response header: x-content-type-options | nosniff, nosniff | | x-frame-options | HTTP response header: x-frame-options | DENY, DENY | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block, 1; mode=block |