Digital Shadows Search Light
Digital Shadows Search Light is a digital risk protection platform that helps organizations monitor and manage their digital footprint.
Digital Shadows Search Light is a comprehensive digital risk protection and threat intelligence platform. It provides capabilities to monitor, manage, and mitigate digital risks by offering insights into potential threats and vulnerabilities. The integration with Swimlane Turbine allows users to automate the retrieval and management of alerts, incidents, and triage items, enhancing the efficiency and effectiveness of security operations. This connector empowers security teams to streamline their workflows, reduce manual effort, and respond swiftly to potential threats by leveraging actionable intelligence from Digital Shadows.
Prerequisites
Before you can use the Digital Shadows Search Light connector for Turbine, you'll need access to the Digital Shadows API. This requires the following:
- HTTP Basic authentication using the following parameters:
- URL: The endpoint URL for accessing Digital Shadows Search Light API.
- API Key: A unique key provided by Digital Shadows for API access.
- API Secret: A secret token associated with your API Key for secure communication.
- SearchLight Account ID: Your specific account identifier within Digital Shadows Search Light.
Capabilities
This Connector provides the following capabilities:
- Create Triage Item Comment
- Get Alet Screenshot
- List Alerts
- List Impersonating Domain Alerts
- List Impersonating Subdomain Alerts
- List Incidents
- List Triage Item Comments
- List Triage Item Events
- List Triage Items
- Set Triage Item State
Notes
- The documentation is only available on the digital shadows box.
Additional Documentation
Configurations
Digital Shadows SearchLight HTTP Basic Auth
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | API Key as username | string | Required |
searchlight-account-id | SearchLight Account ID. | string | Required |
password | API Secret as password | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Create Triage Item Comment
Create a new comment on a specific triage item in Digital Shadows Search Light using the 'triage-id' and 'content'.
Endpoint
- URL: /v1/triage-items/{{triage-id}}/comments
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.triage-id | string | Required | Identifier of the triage item which comments belongs. |
content | string | Optional | The comment text content. Must not include the null character. |
Input Example
{"json_body":{"content":"A custom comment has been created!"},"path_parameters":{"triage-id":"77d21124-c5e6-4386-be23-072eddc319f9"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
id | string | Unique identifier |
triage-item-id | string | Unique identifier |
content | string | Response content |
user | object | Output field: user |
user.id | string | Unique identifier |
user.name | string | Name of the resource |
created | string | Output field: created |
updated | string | Output field: updated |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 05:44:34 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"AQTI3K9F413A","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"28","retry-after":"28","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-rev...
Get Alert Screenshot
Retrieve the screenshot associated with a specified alert in Digital Shadows Search Light using the alert-id.
Endpoint
- URL: /alerts/{{alert-id}}/screenshot
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert-id | string | Required | Associated Alert ID. |
Input Example
{"path_parameters":{"alert-id":"7f0a23d0-fd8e-43ce-b267-e6386af876cf"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 17 Feb 2025 09:15:29 GMT","Content-Type":"text/html","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept-Encoding","x-amz-id-2":"S5akS/5Liqr1vGwUUZf2XJJpk9FLP0IYfpFdMdJxuYJbOox11H216pKj8nKyMPBbNWBZKZgYoh8=","x-amz-request-id":"XWFWM270WJAJVY27","Last-Modified":"Thu, 13 Feb 2025 07:55:46 GMT","x-amz-server-side-encryption":"AES256","Cache-Control":"public,must-revalidate","ETag":"W/\"56dd7570a373e62c928834ca1b...
List Alerts
Retrieve a comprehensive list of alerts from Digital Shadows Search Light for monitoring and analysis.
Endpoint
- URL: /v1/alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.id | array | Optional | One or more alert identifiers to resolve. Must provide between 1 and 100 items |
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 100. |
parameters.limit | number | Optional | The maximum number of items to return. Will default to 10 unless using id which will default to the number of ids provided. Must be any value between 0 and 100. |
Input Example
{"parameters":{"id":["e5aeafc5-fbc7-42f8-9594-fc7f23adcb78","d7f4b588-1ffb-452c-8425-f2ea9abcfb6a"],"offset":0,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 07:48:57 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"EKP5QDRJ8TRRJ","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"2","retry-after":"2","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-reva...
List Impersonating Domain Alerts
Retrieve domain impersonation alerts linked to your organization from Digital Shadows Search Light.
Endpoint
- URL: /v1/impersonating-domain-alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 100. |
parameters.limit | number | Optional | The maximum number of items to return. Will default to 10 unless using id which will default to the number of ids provided. Must be any value between 0 and 100. |
parameters.id | array | Optional | One or more alert identifiers to resolve. Must provide between 1 and 100 items. |
Input Example
{"parameters":{"offset":0,"limit":10,"id":["799098e1-d380-4f64-a8d1-2de0b265a0b8"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 05:58:09 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"4CPH9JPBRKNBK","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"51","retry-after":"51","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-re...
List Impersonating Subdomain Alerts
Retrieve a list of alerts for subdomains impersonating your domain from Digital Shadows Search Light.
Endpoint
- URL: /v1/impersonating-subdomain-alerts
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 100. |
parameters.limit | number | Optional | The maximum number of items to return. Will default to 10 unless using id which will default to the number of ids provided. Must be any value between 0 and 100. |
parameters.id | array | Optional | One or more alert identifiers to resolve. Must provide between 1 and 100 items. |
Input Example
{"parameters":{"offset":10,"limit":20,"id":["799098e1-d380-4f64-a8d1-2de0b265a0b8"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 06:40:34 GMT","Content-Type":"text/html","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{}}
List Incidents
Retrieve a comprehensive list of incidents from Digital Shadows Search Light for analysis and tracking.
Endpoint
- URL: /v1/incidents
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.id | array | Optional | One or more incident identifiers to resolve. Must provide between 1 and 100 items. |
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 100. |
parameters.limit | number | Optional | The maximum number of items to return. Will default to 10 unless using ID which will default to the number of IDs provided. Must provide between 1 and 100 items. |
Input Example
{"parameters":{"id":[952573,952574],"offset":0,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 08:39:14 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"ARA0QC4VQ686K","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"45","retry-after":"45","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-re...
List Triage Item Comments
Retrieve comments associated with a specific triage item in Digital Shadows Search Light using the triage-id path parameter.
Endpoint
- URL: /v1/triage-items/{{triage-id}}/comments
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.triage-id | string | Required | Parameters for the List Triage Item Comments action |
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 250. |
parameters.limit | number | Optional | The maximum number of items to return. If unset, the default value will be 10. Must be any value between 0 and 250. |
Input Example
{"parameters":{"offset":0,"limit":10},"path_parameters":{"triage-id":"77d21124-c5e6-4386-be23-072eddc319f9"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Mon, 15 Jul 2024 05:52:43 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"BQQ049UQVFF91","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"17","retry-after":"17","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-re...
List Triage Item Events
Retrieve a comprehensive list of events associated with triage items from Digital Shadows Search Light.
Endpoint
- URL: /v1/triage-item-events
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.event-num-after | number | Optional | Return events with an event-num greater than this value Must be greater than or equal to 0. |
parameters.event-created-before | string | Optional | Return events with a created time equal-to or before this value. |
parameters.event-created-after | string | Optional | Return events with a created time equal-to or after this value. |
parameters.limit | number | Optional | The maximum number of items to return. If unset, the default value will be 200. Must be any value between 0 and 1000. |
parameters.risk-type | array | Optional | Return events with a risk type in the provided list. Must provide between 1 and 100 items. Must provide between 1 and 100 items. |
parameters.risk-type-exclusion | array | Optional | Return events with a risk type not in the provided list. Must provide between 1 and 100 items. Must provide between 1 and 100 items. |
parameters.state | array | Optional | Return events with a state in the provided list. Must provide between 1 and 100 items. |
Input Example
{"parameters":{"event-num-after":2,"event-created-before":"2024-07-11T06:02:23.321588Z","event-created-after":"2024-07-11T06:02:23.321588Z","limit":200,"risk-type":["custom-risk"],"risk-type-exclusion":["association-with-malware"],"state":["open"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 06:17:04 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"4V34QLUF9536T","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"55","retry-after":"55","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-re...
List Triage Items
Retrieve a list of triage items linked to specific event IDs from Digital Shadows Search Light.
Endpoint
- URL: /v1/triage-items
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.id | array | Optional | One or more triage item identifiers to resolve. Must provide between 1 and 100 items. |
parameters.offset | number | Optional | The (zero-based) offset of the first item in the collection to return. Must be any value between 0 and 1000. |
parameters.limit | number | Optional | The maximum number of items to return. Will default to 10 unless using id which will default to the number of ids provided. Must be any value between 0 and 1000. |
parameters.portal-shortcode | array | Optional | One or more triage item portal-shortcode to resolve. Must provide between 1 and 100 items. |
Input Example
{"parameters":{"id":["c10407f2-1aec-4b35-b6c3-086b396eb824","f40be971-ecea-4f25-ab33-f4f2566b12ab"],"offset":0,"limit":10,"portal-shortcode":[123]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 12 Jul 2024 07:34:57 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","X-Correlation-Id":"EHOF7VR5NLJJN","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"2","retry-after":"2","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-reva...
Set Triage Item State
Update the state of a specified triage item in Digital Shadows Search Light using the provided triage-id and state.
Endpoint
- URL: /v1/triage-items/{{triage-id}}/state
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.triage-id | string | Required | Identifier of the triage item to set the state for. |
state | string | Optional | The new state to set for the triage item. |
previous-state | string | Optional | The previous state as last seen prior to requesting this change. Used to confirm that this change is not overwriting a change made by another user in the interim. |
comment | object | Optional | An optional custom comment to include with the state change. |
comment.content | string | Required | The comment text content. Must not include the null character. |
Input Example
{"json_body":{"state":"open","previous-state":"closed","comment":{"content":"A custom comment that is 1-500 characters in length"}},"path_parameters":{"triage-id":"77d21124-c5e6-4386-be23-072eddc319f9"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"status_code":204,"response_headers":{"Date":"Tue, 16 Jul 2024 05:46:59 GMT","Connection":"keep-alive","X-Correlation-Id":"31LHVT1OLKG82","Vary":"Origin, Access-Control-Request-Method, Access-Control-Request-Headers","ratelimit-limit":"100","ratelimit-remaining":"99","ratelimit-reset":"1","retry-after":"1","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Cache-Control":"no-cache, no-store, max-age=0, must-revalidate","Pragma":"no-cache","Expires":"0","X-Frame-Options":"DEN...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-eval' content.pendo.portal-digitalshadows.com data.pendo.portal-digitalshadows.com; style-src 'self' 'unsafe-inline' content.pendo.portal-digitalshadows.com data.pendo.portal-digitalshadows.com; img-src 'self' data: content.pendo.portal-digitalshadows.com data.pendo.portal-digitalshadows.com; connect-src 'self' https://*.searchlight.app content.pendo.portal-digitalshadows.com data.pendo.portal-digitalshadows.com; child-src 'self' data.pendo.portal-digitalshadows.com; frame-ancestors 'self' data.pendo.portal-digitalshadows.com; frame-src 'self' data.pendo.portal-digitalshadows.com; report-uri https://portal-digitalshadows.com/api/csp-reports |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Mon, 17 Feb 2025 09:15:29 GMT |
ETag | An identifier for a specific version of a resource | W/"56dd7570a373e62c928834ca1b4be940" |
Expires | The date/time after which the response is considered stale | 0 |
Last-Modified | The date and time at which the origin server believes the resource was last modified | Thu, 13 Feb 2025 07:55:46 GMT |
Pragma | HTTP response header: Pragma | no-cache |
ratelimit-limit | HTTP response header: ratelimit-limit | 100 |
ratelimit-remaining | HTTP response header: ratelimit-remaining | 99 |
ratelimit-reset | HTTP response header: ratelimit-reset | 28 |
Referrer-Policy | HTTP response header: Referrer-Policy | strict-origin, origin,strict-origin |
retry-after | HTTP response header: retry-after | 51 |
Server | Information about the software used by the origin server | nginx |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
Vary | HTTP response header: Vary | Accept-Encoding |
Via | HTTP response header: Via | 1.1 9e962ebb7744c5eda2db5997b7dde0c6.cloudfront.net (CloudFront) |
X-Amz-Cf-Id | HTTP response header: X-Amz-Cf-Id | CO2_SkqyUIw3iTuP3T9MSPw6QIlwESNnf_n52ZW5wN0RPukHFfpp9A== |
X-Amz-Cf-Pop | HTTP response header: X-Amz-Cf-Pop | LHR61-P5 |
x-amz-id-2 | HTTP response header: x-amz-id-2 | S5akS/5Liqr1vGwUUZf2XJJpk9FLP0IYfpFdMdJxuYJbOox11H216pKj8nKyMPBbNWBZKZgYoh8= |
x-amz-request-id | HTTP response header: x-amz-request-id | XWFWM270WJAJVY27 |
x-amz-server-side-encryption | HTTP response header: x-amz-server-side-encryption | AES256 |
X-Cache | HTTP response header: X-Cache | RefreshHit from cloudfront |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Correlation-Id | A unique identifier for correlating requests | BQQ049UQVFF91 |
X-Frame-Options | HTTP response header: X-Frame-Options | DENY |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |