Ibm Xforce

The IBM Xforce connector integrates with Swimlane to query malware, IPs, and URLs.

Capabilities

This connector provides the following capabilities:

Get IP Report

Get IP Reputation

Get Malware for Family

Get Malware for File Hash

Get Malware for IP

Get Malware for URL

Get URL Category List

Get URL History

Get URL Report

Get URL Updates of Deltas

Get Urls by Category

Wildcard Search Malware Family

Asset Setup

The IBM Xforce asset requires an url , API Key and API Password

Documentation

API Doc

Additional Documentation

Ibm Xforce Connector Documentation

Ibm Xforce API Documentation

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get IP Report

Returns the IP report for the entered IP.

Endpoint

URL: /ipr/{{ip}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Get IP Report action

Input Example

{"path_parameters":{"ip":"8.8.8.8"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ip	string	Output field: ip
history	array	Output field: history
history.created	string	Output field: history.created
history.reason	string	Response reason phrase
history.geo	object	Output field: history.geo
history.geo.country	string	Output field: history.geo.country
history.geo.countrycode	string	Output field: history.geo.countrycode
history.ip	string	Output field: history.ip
history.cats	object	Output field: history.cats
history.categoryDescriptions	object	Output field: history.categoryDescriptions
history.reasonDescription	string	Response reason phrase
history.score	number	Score value
subnets	array	Output field: subnets
subnets.created	string	Output field: subnets.created
subnets.reason	string	Response reason phrase
subnets.reason_removed	boolean	Response reason phrase
subnets.asns	object	Output field: subnets.asns
subnets.ip	string	Output field: subnets.ip
subnets.categoryDescriptions	object	Output field: subnets.categoryDescriptions
subnets.reasonDescription	string	Response reason phrase
subnets.score	number	Score value
subnets.cats	object	Output field: subnets.cats
subnets.subnet	string	Output field: subnets.subnet

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 23 Jan 2024 06:33:45 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","server-timing":"intid;desc=31fb7d7830c67ba0","x-xss-protection":"1; mode=block","content-security-policy":"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud....","x-content-security-policy":"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud....","x-webkit-...

Get IP Reputation

Returns the IP reputation report for the entered IP.

Endpoint

URL: /ipr/history/{{ip}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Get IP Reputation action

Input Example

{"path_parameters":{"ip":"216.137.61.0x08"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ip	string	Output field: ip
history	array	Output field: history
history.created	string	Output field: history.created
history.geo	object	Output field: history.geo
history.geo.country	string	Output field: history.geo.country
history.geo.countrycode	string	Output field: history.geo.countrycode
history.ip	string	Output field: history.ip
history.reason	string	Response reason phrase
history.reasonDescription	string	Response reason phrase
history.malware_extended	object	Output field: history.malware_extended
history.malware_extended.BotNet	string	Output field: history.malware_extended.BotNet
history.malware_extended.lat	number	Output field: history.malware_extended.lat
history.malware_extended.long	number	Output field: history.malware_extended.long
history.malware_extended.city	string	Output field: history.malware_extended.city
history.malware_extended.CC	string	Output field: history.malware_extended.CC
history.malware_extended.country	number	Output field: history.malware_extended.country
history.malware_extended.isnew	boolean	Output field: history.malware_extended.isnew
history.deleted	boolean	Output field: history.deleted
history.reason_removed	boolean	Response reason phrase
history.categoryDescriptions	object	Output field: history.categoryDescriptions
history.categoryDescriptions.key	string	Output field: history.categoryDescriptions.key
history.categoryDescriptions.value	string	Value for the parameter
history.cats	object	Output field: history.cats

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"ip":"216.137.61.0x08","history":[{}]}}

Get Malware Report For File Hash

Returns a malware report for the given file hash, For example, md5, sha1 and sha256.

Endpoint

URL: /malware/{{filehash}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.filehash	string	Required	Parameters for the Get Malware Report For File Hash action

Input Example

{"path_parameters":{"filehash":"474B9CCF5AB9D72CA8A333889BBB34F0"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
malware	object	Output field: malware
malware.created	string	Output field: malware.created
malware.type	string	Type of the resource
malware.family	array	Output field: malware.family
malware.familyMembers	object	Output field: malware.familyMembers
malware.md5	string	Output field: malware.md5
malware.mimetype	string	Type of the resource
malware.origins	object	Output field: malware.origins
malware.origins.CnCServers	object	Output field: malware.origins.CnCServers
malware.origins.CnCServers.rows	array	Output field: malware.origins.CnCServers.rows
malware.origins.CnCServers.rows.count	number	Count value
malware.origins.CnCServers.rows.domain	string	Output field: malware.origins.CnCServers.rows.domain
malware.origins.CnCServers.rows.filepath	string	Output field: malware.origins.CnCServers.rows.filepath
malware.origins.CnCServers.rows.firstseen	string	Output field: malware.origins.CnCServers.rows.firstseen
malware.origins.CnCServers.rows.host	string	Output field: malware.origins.CnCServers.rows.host
malware.origins.CnCServers.rows.ip	string	Output field: malware.origins.CnCServers.rows.ip
malware.origins.CnCServers.rows.lastseen	string	Output field: malware.origins.CnCServers.rows.lastseen
malware.origins.CnCServers.rows.md5	string	Output field: malware.origins.CnCServers.rows.md5
malware.origins.CnCServers.rows.origin	string	Output field: malware.origins.CnCServers.rows.origin
malware.origins.CnCServers.rows.schema	string	Output field: malware.origins.CnCServers.rows.schema
malware.origins.CnCServers.rows.type	string	Type of the resource
malware.origins.CnCServers.rows.uri	string	Output field: malware.origins.CnCServers.rows.uri
malware.origins.downloadServers	object	Output field: malware.origins.downloadServers

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"malware":{"created":"2023-10-05T06:48:26.902Z","type":"md5","family":[],"familyMembers":{},"md5":"string","mimetype":"string","origins":{},"risk":"string"},"tags":[{}]}}

Get Malware For Family

Returns the malware associated with the entered family using wildcard search.

Endpoint

URL: /malware/family/{{family}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.family	string	Required	Parameters for the Get Malware For Family action

Input Example

{"path_parameters":{"family":"tsunami"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
family	array	Output field: family
firstseen	string	Output field: firstseen
lastseen	string	Output field: lastseen
malware	array	Output field: malware
malware.created	string	Output field: malware.created
malware.family	array	Output field: malware.family
malware.md5	string	Output field: malware.md5
malware.type	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"family":["string"],"firstseen":"2023-10-05T06:52:16.276Z","lastseen":"2023-10-05T06:52:16.276Z","malware":[{}]}}

Get Malware for IP

Returns the malware associated with the entered IP.

Endpoint

URL: /ipr/malware/{{ip}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Get Malware for IP action

Input Example

{"path_parameters":{"ip":"0270.0254.0153.0362"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
malware	array	Output field: malware
malware.family	array	Output field: malware.family
malware.first	string	Output field: malware.first
malware.last	string	Output field: malware.last
malware.md5	string	Output field: malware.md5
malware.origin	string	Output field: malware.origin
malware.uri	string	Output field: malware.uri

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"malware":[{}]}}

Get Malware For URL

Returns the malware associated with the entered URL.

Endpoint

URL: /url/malware/{{url}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.url	string	Required	Parameters for the Get Malware For URL action

Input Example

{"path_parameters":{"url":"www.mediaget.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
malware	array	Output field: malware
malware.count	number	Count value
malware.domain	string	Output field: malware.domain
malware.filepath	string	Output field: malware.filepath
malware.firstseen	string	Output field: malware.firstseen
malware.host	string	Output field: malware.host
malware.ip	string	Output field: malware.ip
malware.lastseen	string	Output field: malware.lastseen
malware.md5	string	Output field: malware.md5
malware.origin	string	Output field: malware.origin
malware.schema	string	Output field: malware.schema
malware.type	string	Type of the resource
malware.uri	string	Output field: malware.uri

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"malware":[{}]}}

Return a list of URL categories provided by XFE.

Endpoint

URL: /url/categories

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
description	string	Output field: description

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"ibm","description":"xforce"}}

Get URL History

Returns the URL history for the entered URL.

Endpoint

URL: /url/history/{{url}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.url	string	Required	Parameters for the Get URL History action

Input Example

{"path_parameters":{"url":"www.ibm.com/smarterplanet"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request
created	string	Output field: created
cats	object	Output field: cats
cats.deleted	boolean	Output field: cats.deleted
cats.categoryName	object	Name of the resource
cats.categoryName.confidence	number	Unique identifier
cats.categoryName.reasons	array	Name of the resource
cats.categoryName.description	string	Name of the resource
cats.categoryName.deleted	boolean	Name of the resource
history	array	Output field: history
history.url	string	URL endpoint for the request
history.created	string	Output field: history.created
history.expired	string	Output field: history.expired
history.cats	object	Output field: history.cats
history.cats.deleted	boolean	Output field: history.cats.deleted
history.cats.categoryName	object	Name of the resource
history.cats.categoryName.confidence	number	Unique identifier
history.cats.categoryName.reasons	array	Name of the resource
history.cats.categoryName.description	string	Name of the resource
history.cats.categoryName.deleted	boolean	Name of the resource
history.score	number	Score value
score	number	Score value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"url":"www.ibm.com/smarterplanet","created":"string","cats":{"deleted":true,"categoryName":{}},"history":[{}],"score":9}}

Get URL Report

Returns the URL report for the entered URL.

Endpoint

URL: /url/{{url}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.url	string	Required	Parameters for the Get URL Report action

Input Example

{"path_parameters":{"url":"ibm.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
result	object	Result of the operation
result.url	string	URL endpoint for the request
result.cats	object	Result of the operation
result.cats.category	boolean	Result of the operation
result.categoryDescriptions	object	Result of the operation
result.categoryDescriptions.category	string	Result of the operation
result.score	number	Result of the operation
associated	array	Output field: associated
associated.url	string	URL endpoint for the request
associated.cats	object	Output field: associated.cats
associated.cats.category	boolean	Output field: associated.cats.category
associated.categoryDescriptions	object	Output field: associated.categoryDescriptions
associated.categoryDescriptions.category	string	Output field: associated.categoryDescriptions.category
associated.score	number	Score value
tags	array	Output field: tags
tags.type	string	Type of the resource
tags.tag	string	Output field: tags.tag
tags.entityType	string	Type of the resource
tags.entityId	string	Unique identifier
tags.commentId	string	Unique identifier
tags.user	string	Output field: tags.user
tags.date	string	Date value
tags.displayName	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"result":{"url":"string","cats":{},"categoryDescriptions":{},"score":9},"associated":[{}],"tags":[{}]}}

Get URL Updates of Deltas

The Delta API provides the data as a bulk download ("base content") for each category supported.

Endpoint

URL: /url/deltas

Method: GET

Input

Argument Name	Type	Required	Description
parameters.category	string	Required	Parameters for the Get URL Updates of Deltas action
parameters.pull_id	number	Optional	Parameters for the Get URL Updates of Deltas action

Input Example

{"parameters":{"category":"Illegal Activities","pull_id":5423}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	array	Response data
data.url	string	Response data
data.created	string	Response data
data.score	string	Response data
pullID	number	Unique identifier
createdAt	string	Output field: createdAt

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}],"pullID":0,"createdAt":"string"}}

Get URLs by Category

Return a list of URLs according to the category and date range.

Endpoint

URL: /url

Method: GET

Input

Argument Name	Type	Required	Description
parameters.category	string	Required	Parameters for the Get URLs by Category action
parameters.startDate	string	Optional	Parameters for the Get URLs by Category action
parameters.endDate	string	Optional	Parameters for the Get URLs by Category action
parameters.descending	string	Optional	Parameters for the Get URLs by Category action
parameters.limit	number	Optional	Parameters for the Get URLs by Category action
parameters.skip	number	Optional	Parameters for the Get URLs by Category action

Input Example

{"parameters":{"category":"Illegal Activities","startDate":"2016-01-01T00:00:00Z","endDate":"2016-01-01T00:00:00Z","descending":"string","limit":200,"skip":201}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
category	string	Output field: category
rows	array	Output field: rows
rows.url	string	URL endpoint for the request
rows.created	string	Output field: rows.created
nextPage	string	Output field: nextPage
previousPage	string	Output field: previousPage

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"category":"string","rows":[{}],"nextPage":"string","previousPage":"string"}}

Wildcard Search Malware Family

Returns the malware associated with the entered family using wildcard search.

Endpoint

URL: /malware/familyext/{{family}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.family	string	Required	Parameters for the Wildcard Search Malware Family action

Input Example

{"path_parameters":{"family":"Adw*"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
family	array	Output field: family
firstseen	string	Output field: firstseen
lastseen	string	Output field: lastseen
malware	array	Output field: malware
malware.created	string	Output field: malware.created
malware.family	array	Output field: malware.family
malware.md5	string	Output field: malware.md5
malware.type	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"family":["string"],"firstseen":"2023-10-05T06:57:16.299Z","lastseen":"2023-10-05T06:57:16.299Z","malware":[{}]}}

Response Headers

Header	Description	Example
access-control-allow-credentials	HTTP response header: access-control-allow-credentials	true
cache-control	Directives for caching mechanisms	private, no-cache, no-store, must-revalidate
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	849e01c5db251bd6-BOM
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
content-security-policy	HTTP response header: content-security-policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Tue, 23 Jan 2024 06:33:45 GMT
etag	An identifier for a specific version of a resource	W/"6716-O1RiCWxfCSsRMo9LAIFjxTTpIGU"
expires	The date/time after which the response is considered stale	-1
pragma	HTTP response header: pragma	no-cache
Server	Information about the software used by the origin server	cloudflare
server-timing	HTTP response header: server-timing	intid;desc=31fb7d7830c67ba0
set-cookie	HTTP response header: set-cookie	1da94ed293a0cf87cb3996cfe5961f3d=e230bbaa856d049ddfdf51eff8f3d99a; path=/; HttpOnly; Secure; SameSite=None, __cfruid=e11de639963482f7adf5d705ba132213b0f0cae0-1705991625; path=/; domain=.ibmcloud.com; HttpOnly; Secure; SameSite=None
strict-transport-security	HTTP response header: strict-transport-security	max-age=15552000; includeSubDomains; preload
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
vary	HTTP response header: vary	Origin, Accept-Encoding
x-content-security-policy	HTTP response header: x-content-security-policy	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'
x-content-type-options	HTTP response header: x-content-type-options	nosniff
x-webkit-csp	HTTP response header: x-webkit-csp	default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'
x-xss-protection	HTTP response header: x-xss-protection	1; mode=block

Ibm Xforce

Capabilities

Asset Setup

Documentation

Additional Documentation

Configurations

HTTP Basic Authentication

Configuration Parameters

Actions

Get IP Report

Endpoint

Input

Input Example

Output

Output Example

Get IP Reputation

Endpoint

Input

Input Example

Output

Output Example

Get Malware Report For File Hash

Endpoint

Input

Input Example

Output

Output Example

Get Malware For Family

Endpoint

Input

Input Example

Output

Output Example

Get Malware for IP

Endpoint

Input

Input Example

Output

Output Example

Get Malware For URL

Endpoint

Input

Input Example

Output

Output Example

Get URL Category List

Endpoint

Output

Output Example

Get URL History

Endpoint

Input

Input Example

Output

Output Example

Get URL Report

Endpoint

Input

Input Example

Output

Output Example

Get URL Updates of Deltas

Endpoint

Input

Input Example

Output

Output Example

Get URLs by Category

Endpoint

Input

Input Example

Output

Output Example

Wildcard Search Malware Family

Endpoint

Input

Input Example

Output

Output Example

Response Headers