--- title: Flashpoint slug: connectors/flashpoint docTags: createdAt: 2026-06-09T16:29:52.892Z --- Flashpoint is a threat intelligence platform that aggregates data from various sources to provide actionable insights into potential threats. Flashpoint is a leading provider of threat intelligence and insights, offering comprehensive data on potential threats and malicious activities. The Flashpoint connector for Swimlane Turbine enables users to seamlessly integrate Flashpoint's intelligence into their security automation workflows. This integration allows for the retrieval of indicators, forum posts, reports, and more, enhancing the ability to proactively identify and respond to threats. By leveraging Flashpoint's data, Swimlane Turbine users can automate threat detection and response, improving the efficiency and effectiveness of their security operations. ## Prerequisites Before you can use the Flashpoint connector for Turbine, you'll need access to the Flashpoint API. This requires the following: - HTTP Bearer authentication using the following parameters: - URL: The endpoint URL for accessing Flashpoint's API services. - Token: A valid bearer token for authenticating API requests. ## Capabilities This connector provides the following capabilities: - Get forum posts - Get indicators of compromise - Get reports ## Setup ### Generate API Token 1. Login to the [Flashpoint Intelligence Platform](fp.tools) with your individualized credentials. 2. Click the settings icon on the upper right-hand corner of the screen. 3. Click **Enter Credentials** and enter your fp.tools credentials. If you do not see this section in your settings, confirm that you have API access. Your API token is now valid for API calls until you revoke it. ## Notes - Tasks that use the `since` and `until` input parameters accept the following formats: - Most standard datetime formats will work. You can also use a relative time period. For example -5h indicates the previous five hours and +2d indicates the two following days. Valid units are; years(y), months(M), weeks(w), days(d), hours(h), minutes(m), seconds(s). ## Additional Documentation - [Flashpoint Connector Documentation](https://docs.swimlane.com/connectors/flashpoint) - [Flashpoint API Documentation](https://api.flashpoint.io/) # Configurations ## Flashpoint HTTP Bearer Authentication Authenticates using bearer token such as a API Key token, JWT etc. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API key, token, etc. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get an Indicator by ID Retrieve a specific indicator from Flashpoint using its unique identifier. Requires the 'id' as a path parameter. ### Endpoint - **URL:** `technical-intelligence/v2/indicators/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the indicator | | `parameters.sighting_count` | integer | Optional | Maximum number of most recent sightings to return | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"sighting_count":100}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | `id` | string | The unique identifier for this indicator within Flashpoint's dataset | | `type` | string | Defines what type of indicator this is (e.g. file, ipv4, url, etc.) | | `value` | string | The value of the indicator (e.g. a hash value, an IP address, a URL, etc.) | | `href` | string | The URL to the indicator's full context data | | `entity_type` | string | The entity type of the object (e.g. indicator) | | `score` | object | The score of the indicator | | `score.value` | string | The score tier of the indicator | | `score.last_scored_at` | \['string', 'null'] | The date and time the indicator was last scored | | `score.raw_score` | \['number', 'null'] | The raw score of the indicator | | `modified_at` | string | The date and time the indicator was last modified within Flashpoint's dataset | | `created_at` | string | The date and time the indicator was created within Flashpoint's dataset | | `last_seen_at` | string | The date and time the indicator was last seen by related sources | | `sort_date` | string | The date and time defaulted for sorting indicators. This is the same value as last\_seen\_at | | `platform_urls` | object | Links to the indicator in various Flashpoint platforms | | `platform_urls.ignite` | string | URL endpoint for the request | | `apt_description` | \['string', 'null'] | A description of the related threat actor, where available | | `external_references` | \['array', 'null'] | A list of external references relating to the indicator | | `hashes` | \['object', 'null'] | Hashes associated with the indicator, in the event that the indicator is a file. If the indicator is not a file, this field will be null | | `malware_description` | \['string', 'null'] | A description of the related malware family, where available | | `mitre_attack_ids` | \['array', 'null'] | A list of MITRE ATT\&CK techniques associated with the indicator | | `relationships` | \['object', 'null'] | Relationships to other entities | | `sightings` | \['array', 'null'] | A list of relevant sightings for the indicator | | `latest_sighting` | \['object', 'null'] | The most recent sighting of the indicator | | `total_sightings` | \['integer', 'null'] | The total number of sightings for the indicator | | `historical_tags` | array | A list of all tags associated with the indicator, across all sightings | ### Output Example `{"id":"string","type":"string","value":"string","href":"string","entity_type":"string","score":{"value":"string"},"modified_at":"string","created_at":"string","last_seen_at":"string","sort_date":"string","platform_urls":{"ignite":"string"},"hashes":{},"relationships":{"iocs":[{}]},"latest_sighting":{"id":"12345678-1234-1234-1234-123456789abc","href":"string","source":"string","sighted_at":"string","tags":["string"]},"historical_tags":[]}` ## Get Forum Posts Retrieve forum posts matching specific search parameters from Flashpoint. ### Endpoint - **URL:** `/api/v4/forums/posts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------- | | `parameters.limit` | integer | Optional | The number of results to return per page. | | `parameters.query` | string | Optional | A search term. IE threat | | `parameters.since` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | | `parameters.until` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | ### Input Example `{"parameters":{"limit":20,"query":"string","since":"string","until":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | | `response.body` | string | Request body data | | `response.thread` | string | Output field: response.thread | | `response.forum` | string | Output field: response.forum | | `response.author` | string | Output field: response.author | | `response.url` | string | URL endpoint for the request | | `response.native_id` | string | Unique identifier | | `response.published_at` | string | Output field: response.published\_at | | `response.legacy_id` | string | Unique identifier | | `response.reply_number` | string | Output field: response.reply\_number | | `response.platform_url` | string | URL endpoint for the request | | `response.id` | string | Unique identifier | | `response.room` | string | Output field: response.room | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{"body":"body","thread":"thread","forum":"forum","author":"author","url":"url","native_id":"native_id","published_at":"published_at","legacy_id":"legacy_id","reply_number":"reply_number","platform_url":"platform_url","id":"id","room":"room"}}` ## Get IOCs Retrieve indicators of compromise from Flashpoint based on specified search parameters. ### Endpoint - **URL:** `/api/v4/indicators/attribute` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------- | | `parameters.limit` | integer | Optional | The number of results to return per page. | | `parameters.query` | string | Optional | A search term. IE threat | | `parameters.since` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | | `parameters.until` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | ### Input Example `{"parameters":{"limit":20,"query":"string","since":"string","until":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | | `response.category` | string | Output field: response.category | | `response.uuid` | string | Unique identifier | | `response.event_id` | string | Unique identifier | | `response.timestamp` | string | Output field: response.timestamp | | `response.header__source` | string | Output field: response.header\_\_source | | `response.basetypes` | array | Type of the resource | | `response.fpid` | string | Unique identifier | | `response.value` | string | Value for the parameter | | `response.header__ingested_at` | string | Output field: response.header\_\_ingested\_at | | `response.header__observed_at` | string | Output field: response.header\_\_observed\_at | | `response.type` | string | Type of the resource | | `response.header__indexed_at` | string | Output field: response.header\_\_indexed\_at | | `response.header__is_visible` | boolean | Output field: response.header\_\_is\_visible | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{"category":"category","uuid":"uuid","event_id":"event_id","timestamp":"timestamp","header__source":"header__source","basetypes":["basetypes"],"fpid":"fpid","value":"value","header__ingested_at":"header__ingested_at","header__observed_at":"header__observed_at","type":"type","header__indexed_at":"header__indexed_at","header__is_visible":false}}` ## Get Reports Retrieve Flashpoint reports using specified search parameters to deliver relevant threat intelligence data. ### Endpoint - **URL:** `/api/v4/reports` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------- | | `parameters.limit` | integer | Optional | The number of results to return per page. | | `parameters.query` | string | Optional | A search term. IE threat | | `parameters.since` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | | `parameters.until` | string | Optional | A timestamp. IE 2019-10-01T16:58:00+00:00 | ### Input Example `{"parameters":{"limit":20,"query":"string","since":"string","until":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `headers` | object | HTTP headers for the request | | `response` | object | Output field: response | | `response.asset_ids` | string | Unique identifier | | `response.notified_at` | string | Output field: response.notified\_at | | `response.updated_at` | string | Output field: response.updated\_at | | `response.published_status` | string | Status value | | `response.id` | string | Unique identifier | | `response.sources_original` | array | Output field: response.sources\_original | | `response.tags` | array | Output field: response.tags | | `response.title` | string | Output field: response.title | | `response.posted_at` | string | Output field: response.posted\_at | | `response.version_posted_at` | string | Output field: response.version\_posted\_at | | `response.ingested_at` | string | Output field: response.ingested\_at | | `response.body` | string | Request body data | | `response.platform_url` | string | URL endpoint for the request | | `response.is_featured` | boolean | Output field: response.is\_featured | | `response.title_asset_id` | string | Unique identifier | | `response.summary` | string | Output field: response.summary | ### Output Example `{"status_code":200,"reason":"Ok","headers":null,"response":{"asset_ids":"asset_ids","notified_at":"notified_at","updated_at":"updated_at","published_status":"published_status","id":"id","sources_original":["sources_original"],"tags":["tags"],"title":"title","posted_at":"posted_at","version_posted_at":"version_posted_at","ingested_at":"ingested_at","body":"body","platform_url":"platform_url","is_featured":false,"title_asset_id":"title_asset_id"}}` ## List Indicators Retrieve a list of indicators from Flashpoint, providing insights into potential threats and malicious activities. ### Endpoint - **URL:** `technical-intelligence/v2/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.size` | number | Optional | Maximum number of records to return. | | `parameters.from` | number | Optional | The initial index from which to return the results. | | `parameters.ioc_value` | string | Optional | Plain-text string to match against indicator values. Supports partial matching. | | `parameters.cidr_range` | string | Optional | CIDR range to match against ipv4 or ipv6 indicator values. | | `parameters.has_intel_report` | boolean | Optional | Flag to filter indicators that have an associated intelligence report. | | `parameters.has_extracted_config` | boolean | Optional | Flag to filter indicators that have an associated extracted configuration. | | `parameters.sort` | string | Optional | Defines which date-time field and direction to sort response records. | | `parameters.include_total_count` | boolean | Optional | Flag to request the exact count of records that match the query. IMPORTANT: This will increase the response time for large result-sets. | | `parameters.max_score` | string | Optional | Filter indicators by their maximum score tier. | | `parameters.min_score` | string | Optional | Filter indicators by their minimum score tier. | | `parameters.ioc_types` | array | Optional | A comma-delimited list of values to match against indicator types. | | `parameters.tags` | array | Optional | A comma-delimited list of values to match against indicator tags. Must be exact tag matches. | | `parameters.mitre_attack_ids` | array | Optional | A comma-delimited list of values to match against MITRE ATT\&CK IDs. | | `parameters.embed` | array | Optional | A comma-delimited list of fields to embed in the response. NOTE: A maximum of 500 records can be requested when including embed. Options: all, mitre\_attack\_ids, external\_references, apt\_description, malware\_description, related\_iocs. | | `parameters.actors` | array | Optional | A comma-delimited list of values to match against actor tags. Must be exact tag matches. Inclusion of the actor: prefix is optional. | | `parameters.malware` | array | Optional | A comma-delimited list of values to match against malware tags. Must be exact tag matches. Inclusion of the malware: prefix is optional. | | `parameters.sources` | array | Optional | A comma-delimited list of values to match against source tags. Must be exact tag matches. Inclusion of the source: prefix is optional. | | `parameters.last_seen_after` | string | Optional | Include indicators last seen on or after this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.last_seen_before` | string | Optional | Include indicators last seen before this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.modified_after` | string | Optional | Include indicators modified on or after this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.modified_before` | string | Optional | Include indicators modified before this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.created_after` | string | Optional | Include indicators created on or after this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.created_before` | string | Optional | Include indicators created before this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.last_scored_after` | string | Optional | Include indicators last scored on or after this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | | `parameters.last_scored_before` | string | Optional | Include indicators last scored before this date. Supports absolute datetime strings in ISO-8601/RFC-3339 format and relative datetime strings. | ### Input Example `{"parameters":{"size":10,"from":0,"ioc_value":"192.168.1.0","cidr_range":"192.168.1.0/24","has_intel_report":false,"has_extracted_config":false,"sort":"last_seen_at:desc","include_total_count":false,"max_score":"max","min_score":"min","ioc_types":["type1","type2","type3"],"tags":["tag1","tag2","tag3"],"mitre_attack_ids":["id1","id2","id3"],"embed":["all","mitre_attack_ids","external_references","apt_description","malware_description","related_iocs"],"actors":["actor1","actor2","actor3"],"malware":["malware: one","malware: two","malware: three"],"sources":["source: one","source: two","source: three"],"last_seen_after":"2025-12-10T07:34:00Z","last_seen_before":"2025-12-10T07:34:00Z","modified_after":"2025-12-10T07:34:00Z","modified_before":"2025-12-10T07:34:00Z","created_after":"2025-12-10T07:34:00Z","created_before":"2025-12-10T07:34:00Z","last_scored_after":"2025-12-10T07:34:00Z","last_scored_before":"2025-12-10T07:34:00Z"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | `items` | array | A list of Indicator objects. | | `items.id` | string | The unique identifier for this indicator within Flashpoint's dataset. | | `items.type` | string | Defines what type of indicator this is (e.g. file, ipv4, url, etc.). | | `items.value` | string | The value of the indicator (e.g. a hash value, an IP address, a URL, etc.). | | `items.href` | string | The URL to the indicator's full context data. | | `items.entity_type` | string | The entity type of the object (e.g. indicator). | | `items.score` | object | The score of the indicator. | | `items.score.value` | string | The score tier of the indicator. | | `items.score.last_scored_at` | \['string', 'null'] | The date and time the indicator was last scored. | | `items.score.raw_score` | \['number', 'null'] | The raw score of the indicator. | | `items.modified_at` | string | The date and time the indicator was last modified within Flashpoint's dataset. | | `items.created_at` | string | The date and time the indicator was created within Flashpoint's dataset. | | `items.last_seen_at` | string | The date and time the indicator was last seen by related sources. | | `items.sort_date` | string | The date and time defaulted for sorting indicators. This is the same value as last\_seen\_at. | | `items.platform_urls` | object | Links to the indicator in various Flashpoint platforms. | | `items.platform_urls.ignite` | string | URL endpoint for the request | | `items.apt_description` | \['string', 'null'] | A description of the related threat actor, where available. | | `items.external_references` | \['array', 'null'] | A list of external references relating to the indicator. | | `items.hashes` | \['object', 'null'] | Hashes associated with the indicator, in the event that the indicator is a file. If the indicator is not a file, this field will be null. | | `items.malware_description` | \['string', 'null'] | A description of the related malware family, where available. | | `items.mitre_attack_ids` | array | A list of MITRE ATT\&CK techniques associated with the indicator. | | `items.mitre_attack_ids.id` | string | Unique identifier | | `items.mitre_attack_ids.name` | string | Unique identifier | | `items.mitre_attack_ids.tactics` | array | A list of tactics associated with the MITRE ATT\&CK technique. | | `items.mitre_attack_ids.tactic` | \['string', 'null'] | The tactic of the MITRE ATT\&CK technique. (Deprecated in favor of tactics.) | ### Output Example `{"items":[],"total":{},"pagination":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |