EclecticIQ

EclecticIQ is a threat intelligence platform designed to help organizations manage and operationalize their cyber threat intelligence.

EclecticIQ is a leading threat intelligence platform that empowers organizations to manage and analyze cyber threats effectively. The EclecticIQ connector for Swimlane Turbine enables seamless integration with EclecticIQ's robust threat intelligence capabilities, allowing users to create and manage observables and entities, and retrieve detailed threat data. This integration enhances security automation by providing real-time insights and actionable intelligence, enabling security teams to respond swiftly and efficiently to emerging threats.

Limitations

None to date.

Supported Versions

This EclecticIQ connector uses the latest Version API.

Additional Documents

Documentation Click Here

Prerequisites

Before you can use the EclecticIQ connector for Turbine, you'll need access to the EclecticIQ API. This requires the following:

HTTP Bearer authentication using the following parameters:

URL: The endpoint URL for accessing the EclecticIQ API.

API Key: A valid API key to authenticate requests to the EclecticIQ platform.

Authentication Methods

HTTP Bearer Authentication Method

URL: The endpoint URL for accessing the EclecticIQ API.

API Key: A valid API key for authenticating requests to the EclecticIQ API.

Capabilities

This EclecticIQ Connector provides the following capabilities:

Create a New Observable

Create an Entity

Get a List of Entities

Get a List of Observables

Get an Entity by ID

Get an Observable by ID

Create a New Observable

Create a new observable in EclecticIQ using the provided data in JSON format Click Here.

Create an Entity

This action leverages the external (STIX) ID provided on the payload's data attribute to de-duplicate the entity Click Here.

Get a List of Entities

Retrieves a paginated list of entities with sorting, optional field projection, structured filters, and Lucene full-text or faceted search Click Here.

Get a List of Observables

Retrieve observables with pagination, sorting, optional field projection, filters (type, value, sources, entities), and Lucene-style search Click Here.

Get an Entity by ID

Retrieves an entity by its ID. The ID can be either a STIX ID or an EclecticIQ ID Click Here.

Get an Observable by ID

Retrieve an observable from EclecticIQ using its unique ID provided as a path parameter Click Here.

Configurations

HTTP Bearer Authentication

Authenticates using bearer token such as a JWT, etc.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	The API key, token, etc.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create a New Observable

Create a new observable in EclecticIQ using the provided data in JSON format.

Endpoint

URL: api/v2/observables

Method: POST

Input

Argument Name	Type	Required	Description
data	object	Optional	Response data
data.meta	object	Optional	Meta data for the observable
data.meta.link_type	string	Optional	Link type for the observable
data.meta.maliciousness	string	Optional	Maliciousness for the observable
data.type	string	Required	Type of the observable.
data.sources	array	Optional	Source associated to this object. (ID/URL) Only the source of type {'group'} can be assigned. But any source types may be returned if assigned by the system, like an incoming feed source.
data.value	string	Required	Value of the observable.

Input Example

{"json_body":{"data":{"meta":{"link_type":"test link","maliciousness":"safe","newKey":"New Value"},"type":"ja3-full","sources":["http://localhost/api/v2/sources/a1711a44-41cc-4c32-aaf1-9bbd734c00c5","http://localhost/api/v2/sources/a1711a44-41cc-4c32-aaf1-9bbd734c00c5"],"value":"test"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.created_at	string	Response data
data.entities	array	Response data
data.id	number	Response data
data.last_updated_at	string	Response data
data.meta	object	Response data
data.meta.link_type	string	Response data
data.meta.maliciousness	string	Response data
data.meta.risk_score	string	Response data
data.meta.additionalProp	object	Response data
data.sources	array	Response data
data.type	string	Response data
data.value	string	Response data

Output Example

{"status_code":201,"response_headers":{},"reason":"Created","json_body":{"data":[{}]}}

Create an Entity

Leverage the external STIX ID in the payload's data attribute to de-duplicate and create an entity in EclecticIQ.

Endpoint

URL: api/v2/entities

Method: POST

Input

Argument Name	Type	Required	Description
data	object	Optional	Response data
data.data	object	Required	Response data
data.data.type	string	Optional	The type of the associated object.
data.meta	object	Optional	Response data
data.meta.report_template	object	Optional	Basic metadata of the associated report template
data.meta.report_template.id	number	Optional	ID of the associated report template.
data.meta.report_template.sub_title	string	Optional	Sub title of the associated report template.
data.meta.report_template.super_title	string	Optional	Super title of the associated report template.
data.meta.tags	array	Optional	Tags associated to this object.
data.meta.taxonomies	array	Optional	Taxonomy ID, URL or path expressed as a lists of strings.
data.meta.alias	string	Optional	User defined title.
data.meta.attacks	array	Optional	MITRE ATT&CK ID/URL. The parent ATT&CK like a tactic for a technique are not included except if specifically classified.
data.meta.source_reliability	string	Optional	Source reliability of the associated object. Possible values are A, B, C, D.
data.meta.tlp_color	string	Optional	The current TLP value. The values CLEAR and AMBER_STRICT are also accepted as an input but converted to TLP v1 on the response side.
data.meta.estimated_observed_time	string	Optional	Timestamp in UTC ISO-8601 format.
data.meta.estimated_threat_end_time	string	Optional	Timestamp in UTC ISO-8601 format.
data.meta.estimated_threat_start_time	string	Optional	Timestamp in UTC ISO-8601 format.
data.meta.half_life	number	Optional	Half life of the associated object in days.
data.sources	array	Optional	Source associated to this object. (ID/URL) Only the source of type {'group'} can be assigned. But any source types may be returned if assigned by the system, like an incoming feed source.
data.datasets	array	Optional	Dataset ID/URL.
data.observables	array	Optional	Observables are always returned as list of API URLs, but it is also possible to provide them as objects with type and value attributes - if such objects do not exist, they will be created.
data.attachments	array	Optional	Entity attachment ID/URL.
data.id	string	Optional	Internal EclecticIQ entity UUID.

Input Example

{"json_body":{"data":{"data":{"type":"exploit-target"},"meta":{"report_template":{"id":5,"sub_title":"test sub tile","super_title":"test super title"},"tags":["test tag 1"],"taxonomies":["http://localhost/api/v2/taxonomies/1"],"alias":"test alias","attacks":["http://localhost/api/v2/attacks/TA0001:T1078.001"],"source_reliability":"D","tlp_color":"GREEN","estimated_observed_time":"2016-12-31T16:28:00+00:00","estimated_threat_end_time":"2016-12-31T16:28:00+00:00","estimated_threat_start_time":"2016-12-31T16:28:00+00:00","half_life":5},"sources":["http://localhost/api/v2/sources/a86de6e0-af20-4a57-93d9-826e1ef4a47a"],"datasets":["http://localhost/api/v2/datasets/1"],"observables":["http://localhost/api/v2/observables/1"],"attachments":["http://localhost/api/v2/entities/attachments/1"],"id":"a86de6e0-af20-4a57-93d9-826e1ef4a47a"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.attachments	array	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.data	object	Response data
data.data.aliases	array	Response data
data.data.aliases.value	string	Response data
data.data.confidence	string	Response data
data.data.description	string	Response data
data.data.description_structuring_format	string	Response data
data.data.external_references	array	Response data
data.data.external_references.description	string	Response data
data.data.external_references.external_id	string	Response data
data.data.external_references.source_name	string	Response data
data.data.external_references.url	string	Response data
data.data.external_references.hashes	object	Response data
data.data.external_references.hashes.additionalProp	string	Response data
data.data.handling	array	Response data
data.data.handling.controlled_structure	string	Response data
data.data.handling.id	string	Response data
data.data.handling.idref	string	Response data
data.data.handling.information_source	object	Response data
data.data.handling.information_source.description	string	Response data

Output Example

{"status_code":202,"response_headers":{},"reason":"Created","json_body":{"data":{"attachments":[],"created_at":"2016-12-31T16:28:00+00:00","created_by":"http://localhost/api/v2/users/1","data":{},"datasets":[],"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","incoming_feed":"http://localhost/api/v2/incoming-feeds/1","last_updated_at":"2016-12-31T16:28:00+00:00","meta":{},"observables":[],"outgoing_feeds":[],"relevancy":0,"sources":[]}}}

Get a List of Entities

Retrieve a paginated list of entities in EclecticIQ with sorting, optional field projection, structured filters, and Lucene full-text or faceted search.

Endpoint

URL: api/v2/entities

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Maximum number of items to be returned (int32).
parameters.offset	number	Optional	Return results starting from the specified zero-based index (int32).
parameters.sort	string	Optional	Comma-separated list of fields to sort on. Prefix a field with the minus "-" sign to apply descending sort.
parameters.data	boolean	Optional	Set to false to retrieve only the count of objects matching the query; otherwise full result data is returned.
parameters.attributes	string	Optional	Comma-separated list of attributes to return. Nested attributes are separated by dots (e.g. data.title).
parameters.filter[id]	string	Optional	Filter by entity internal UUID.
parameters.filter[type]	string	Optional	Filter by entity type.
parameters.filter[data.id]	string	Optional	Filter by STIX ID.
parameters.filter[data.title]	string	Optional	Filter by title.
parameters.filter[data.description]	string	Optional	Filter by description.
parameters.filter[data.test_mechanisms.test_mechanism_type]	string	Optional	Filter by test mechanism type.
parameters.filter[data.producer.identity]	string	Optional	Filter by producer identity.
parameters.filter[data.producer.roles]	string	Optional	Filter by producer roles.
parameters.filter[meta.alias]	string	Optional	Filter by entity alias.
parameters.filter[meta.half_life]	string	Optional	Filter by entity half-life.
parameters.filter[sources]	string	Optional	Filter by source(s).
parameters.filter[incoming_feed]	string	Optional	Filter by incoming feed ID/URL.
parameters.filter[outgoing_feeds]	string	Optional	Filter by outgoing feed IDs/URLs.
parameters.filter[meta.source_reliability]	string	Optional	Filter by entity source reliability (Admiralty scale letter).
parameters.filter[meta.tags]	string	Optional	Filter by tags.
parameters.filter[meta.taxonomies]	string	Optional	Filter by taxonomy node IDs/URLs.
parameters.filter[meta.is_unresolved_idref]	string	Optional	Filter by unresolved idref flag. To exclude all unresolved entities, use filter[!meta.is_unresolved_idref]=true on the API.
parameters.filter[meta.tlp_color]	string	Optional	Filter by TLP color. CLEAR and AMBER_STRICT may be accepted as input and mapped on the server.
parameters.filter[meta.attacks]	string	Optional	Filter by MITRE ATT&CK IDs/URLs. The filter follows parent relationships: if an entity is classified with a technique, filtering on the parent tactic still includes that entity.
parameters.filter[attack_classifications]	string	Optional	Filter by MITRE ATT&CK IDs/URLs for explicit classifications only: filtering on a parent tactic does not include entities classified only with a child technique.

Input Example

{"parameters":{"limit":26,"offset":495,"sort":"id","data":true,"attributes":"data.description,meta.tags,id","filter[id]":"6f3c1dc4-9d3e-4959-98d1-d3a1803040d9","filter[type]":"attack-pattern","filter[data.id]":"{https://d440jsdt.example.com}indicator-5d8d2f67-2511-447c-bb11-64d35a32aae2","filter[data.title]":"zzyfgg1a ee4fxd title","filter[data.description]":"Random description oz14do1fsi5ireunxjbt.","filter[data.test_mechanisms.test_mechanism_type]":"yara","filter[data.producer.identity]":"http://localhost/api/v2/sources/f015be5a-be3f-40b9-92cd-20f9f06376e7","filter[data.producer.roles]":"Reporter","filter[meta.alias]":"alias-l8yfkh","filter[meta.half_life]":"86400","filter[sources]":"http://localhost/api/v2/sources/7e2539fc-7612-413f-b784-6e3fea683665","filter[incoming_feed]":"http://localhost/api/v2/incoming-feeds/43738","filter[outgoing_feeds]":"http://localhost/api/v2/outgoing-feeds/77285","filter[meta.source_reliability]":"C","filter[meta.tags]":"rch8k,p062a,ssd38,9www8","filter[meta.taxonomies]":"http://localhost/api/v2/taxonomies/87436,http://localhost/api/v2/taxonomies/70569","filter[meta.is_unresolved_idref]":"false","filter[meta.tlp_color]":"RED","filter[meta.attacks]":"http://localhost/api/v2/attacks/TA0002:T1084.4","filter[attack_classifications]":"http://localhost/api/v2/attacks/TA0001:T1051","filter[datasets]":"http://localhost/api/v2/datasets/81290","filter[observables]":"http://localhost/api/v2/observables/95810","filter[_lucene_search]":"attached_files: *"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.attachments	array	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.data	object	Response data
data.data.aliases	array	Response data
data.data.aliases.value	string	Response data
data.data.confidence	string	Response data
data.data.description	string	Response data
data.data.description_structuring_format	string	Response data
data.data.external_references	array	Response data
data.data.external_references.description	string	Response data
data.data.external_references.external_id	string	Response data
data.data.external_references.source_name	string	Response data
data.data.external_references.url	string	Response data
data.data.handling	array	Response data
data.data.handling.controlled_structure	string	Response data
data.data.handling.id	string	Response data
data.data.handling.idref	string	Response data
data.data.handling.information_source	object	Response data
data.data.handling.information_source.description	string	Response data
data.data.handling.information_source.description_structuring_format	string	Response data
data.data.handling.information_source.identity	object	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}]}}

Get a List of Observables

Retrieve a list of observables from EclecticIQ with options for pagination, sorting, field projection, filters, and Lucene-style search.

Endpoint

URL: api/v2/observables

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Maximum number of items to be returned (int32).
parameters.offset	number	Optional	Return results starting from the specified zero-based index (int32).
parameters.sort	string	Optional	Comma-separated list of fields to sort on. Prefix a field with the minus "-" sign to apply descending sort.
parameters.data	boolean	Optional	Set to false to retrieve only the count of objects matching the query; otherwise full result data is returned.
parameters.attributes	string	Optional	Comma-separated list of attributes to return. Use dots for nested attributes (e.g. data.title).
parameters.filter[type]	string	Optional	Filter by observable type.
parameters.filter[value]	string	Optional	Filter by observable value.
parameters.filter[sources]	string	Optional	Filter by source ID/URL.
parameters.filter[entities]	string	Optional	Filter by related entity ID/URL.
parameters.filter[_lucene_search]	string	Optional	Full-text or faceted search with logic operators such as AND and OR.

Input Example

{"parameters":{"limit":12,"offset":0,"sort":"field_1","data":true,"attributes":"field_1","filter[type]":"test type","filter[value]":"test value","filter[sources]":"test sources","filter[entities]":"test entities","filter[_lucene_search]":"field_1:value AND field_2:other"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.created_at	string	Response data
data.entities	array	Response data
data.id	number	Response data
data.last_updated_at	string	Response data
data.meta	object	Response data
data.meta.link_type	string	Response data
data.meta.maliciousness	string	Response data
data.meta.risk_score	string	Response data
data.meta.additionalProp	object	Response data
data.sources	array	Response data
data.type	string	Response data
data.value	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}]}}

Get an Entity by ID

Retrieve an entity using its STIX or EclecticIQ ID. Requires the 'id' as a path parameter.

Endpoint

URL: api/v2/entities/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.attributes	string	Optional	Comma-separated list of attributes to be returned. Nested attributes are separated by dots - e.g. data.title.
path_parameters.id	string	Required	Entity ID. It can be either a STIX ID or an EclecticIQ ID.

Input Example

{"parameters":{"attributes":"data.title,meta.alias,data.id"},"path_parameters":{"id":"1"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.attachments	array	Response data
data.created_at	string	Response data
data.created_by	string	Response data
data.data	object	Response data
data.data.aliases	array	Response data
data.data.aliases.value	string	Response data
data.data.confidence	string	Response data
data.data.description	string	Response data
data.data.description_structuring_format	string	Response data
data.data.external_references	array	Response data
data.data.external_references.description	string	Response data
data.data.external_references.external_id	string	Response data
data.data.external_references.source_name	string	Response data
data.data.external_references.url	string	Response data
data.data.external_references.hashes	object	Response data
data.data.external_references.hashes.additionalProp	string	Response data
data.data.handling	array	Response data
data.data.handling.controlled_structure	string	Response data
data.data.handling.id	string	Response data
data.data.handling.idref	string	Response data
data.data.handling.information_source	object	Response data
data.data.handling.information_source.description	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"attachments":[],"created_at":"2026-03-03T04:18:53+00:00","created_by":"http://localhost/api/v2/users/18341","data":{},"datasets":[],"id":"2d3f8587-0f63-4833-b7ff-134e97bd2f8f","incoming_feed":"http://localhost/api/v2/incoming-feeds/65270","last_updated_at":"2026-03-02T17:01:14.647Z","meta":{},"observables":[],"outgoing_feeds":[],"relevancy":151,"sources":[]}}}

Get an Observable by ID

Retrieve an observable from EclecticIQ using its unique ID provided as a path parameter.

Endpoint

URL: api/v2/observables/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.attributes	string	Optional	Comma-separated list of attributes to be returned. Nested attributes are separated by dots.
path_parameters.id	number	Required	Observable ID.

Input Example

{"parameters":{"attributes":"data.title"},"path_parameters":{"id":5}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.created_at	string	Response data
data.entities	array	Response data
data.id	number	Response data
data.last_updated_at	string	Response data
data.meta	object	Response data
data.meta.link_type	string	Response data
data.meta.maliciousness	string	Response data
data.meta.risk_score	string	Response data
data.meta.additionalProp	object	Response data
data.sources	array	Response data
data.type	string	Response data
data.value	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":{"created_at":"2016-12-31T16:28:00+00:00","entities":[],"id":0,"last_updated_at":"2016-12-31T16:28:00+00:00","meta":{},"sources":[],"type":"ja3-full","value":"test"}}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT