Cyware
Cyware is a threat intelligence platform that facilitates threat data sharing, analysis, and response.
Cyware is a comprehensive threat intelligence platform that enhances security operations by providing detailed threat data and insights. The Cyware connector for Swimlane Turbine allows users to perform bulk lookups of threat data objects, enriching security incidents with detailed information and relationships. This integration empowers security teams to automate threat intelligence processes, improving response times and decision-making by leveraging enriched data and actionable insights directly within their workflows.
Prerequisites
Before you can use the Cyware connector for Turbine, you'll need access to the Cyware API. This requires the following:
- To authenticate the API requests made to the CTIX application, you must include:
- Access ID: Unique identifier for accessing the API.
- Expires: Timestamp indicating when the access expires.
- Signature: Cryptographic signature for request validation.
Limitations
None to date
Supported Versions
This connector supports the latest version of the Cyware Policies API.
Additional Docs
Configuration
Authentication Methods
The following authentication methods are supported for this connector:
Custom Authentication
To authenticate using Asset, you need to provide the following details:
- URL: The URL to the target host. Default is https://sample.domain.com.
- Access ID: Your CTIX access ID.
- Secret Key: Your CTIX secret key.
These credentials are required to establish a secure connection with the CTIX platform and perform various operations.
Capabilities
This connector provides the following capabilities:
- Bulk IOC Lookup Advance
- Ping
Bulk IOC Lookup Advanced
Performs a lookup for threat data objects in the CTIX platform and retrieves the details of the objects, such as basic details, enriched data, and relations.
Ping
CTIX enables you to check the connectivity with a server through the Ping Pong method. The Ping Pong method sends a request called ping to check the connection and a successful response is called a pong response.
Additional Documentation
Configurations
Asset
To authenticate the API requests made to the CTIX application, you must include Access ID, Expires, Signature.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Optional |
ctix_access_id | Access ID. | string | Optional |
ctix_secret_key | Secret key. | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Bulk IOC Lookup
Perform a bulk lookup for threat data objects in the CTIX platform, retrieving details like basic information, enriched data, and relationships. Requires object_type as a path parameter.
Endpoint
- URL: ctixpi/ingestion/openapi/bulk-lookup/{{object_type}}
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.enrichment_data | boolean | Optional | Pass true to retrieve the latest five enrichment data objects. |
parameters.relation_data | boolean | Optional | Pass true to retrieve the latest 100 relations details. |
parameters.enrichment_tools | string | Optional | Pass the name of up to five enrichment tools separated by a comma. To retrieve a list of enrichment tools, use the GET Enrichment Tools API under Administration > Enrichment Management > Enrichment Tools. |
parameters.fields | string | Optional | Pass a comma-separated list of field names to retrieve specific details of the objects. By default, all fields are retrieved. |
path_parameters.object_type | string | Required | Pass an object type to lookup. For the list of supported object types, see Supported SDO Types in Threat Data > Miscellaneous. |
data_body | object | Optional | Response data |
data_body.value | array | Optional | Response data |
Input Example
{"parameters":{"enrichment_data":true,"relation_data":true,"enrichment_tools":"AbuseIPDB","fields":"relations,enrichment_data"},"path_parameters":{"object_type":"indicator"},"data_body":{"value":["47.92.78.238","www.facebook.com"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
next | object | Output field: next |
previous | object | Output field: previous |
total | number | Output field: total |
results | array | Result of the operation |
results.analyst_score | object | Result of the operation |
results.analyst_tlp | object | Result of the operation |
results.country | string | Result of the operation |
results.created | string | Result of the operation |
results.ctix_created | string | Result of the operation |
results.ctix_modified | string | Result of the operation |
results.custom_attributes | object | Result of the operation |
results.confidence_score | number | Unique identifier |
results.description | object | Result of the operation |
results.enrichment_data | array | Response data |
results.enrichment_data.tool | string | Response data |
results.enrichment_data.tool_response | string | Response data |
results.first_seen | object | Result of the operation |
results.id | string | Unique identifier |
results.ioc_type | string | Type of the resource |
results.is_deprecated | boolean | Result of the operation |
results.is_false_positive | boolean | Result of the operation |
results.is_reviewed | boolean | Result of the operation |
results.is_whitelisted | boolean | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"next":null,"previous":null,"total":1,"results":[{}],"page_size":10}}
Ping
Verify server connectivity using the CTIX Ping Pong method, which sends a 'ping' and expects a 'pong' response.
Endpoint
- URL: ctixpi/ping/
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
result | string | Result of the operation |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"result":"pong"}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |