--- title: Ibm Xforce slug: connectors/ibm-xforce docTags: createdAt: 2026-06-09T16:30:31.592Z --- The IBM Xforce connector integrates with Swimlane to query malware, IPs, and URLs. ## Capabilities This connector provides the following capabilities: - Get IP Report - Get IP Reputation - Get Malware for Family - Get Malware for File Hash - Get Malware for IP - Get Malware for URL - Get URL Category List - Get URL History - Get URL Report - Get URL Updates of Deltas - Get Urls by Category - Wildcard Search Malware Family ## Asset Setup The IBM Xforce asset requires an `url` , `API Key` and `API Password` ## Documentation [API Doc](https://api.xforce.ibmcloud.com) ## Additional Documentation - [Ibm Xforce Connector Documentation](https://docs.swimlane.com/connectors/ibm-xforce) - [Ibm Xforce API Documentation](https://api.xforce.ibmcloud.com/) # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get IP Report Returns the IP report for the entered IP. ### Endpoint - **URL:** `/ipr/{{ip}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Get IP Report action | ### Input Example `{"path_parameters":{"ip":"8.8.8.8"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ip` | string | Output field: ip | | `history` | array | Output field: history | | `history.created` | string | Output field: history.created | | `history.reason` | string | Response reason phrase | | `history.geo` | object | Output field: history.geo | | `history.geo.country` | string | Output field: history.geo.country | | `history.geo.countrycode` | string | Output field: history.geo.countrycode | | `history.ip` | string | Output field: history.ip | | `history.cats` | object | Output field: history.cats | | `history.categoryDescriptions` | object | Output field: history.categoryDescriptions | | `history.reasonDescription` | string | Response reason phrase | | `history.score` | number | Score value | | `subnets` | array | Output field: subnets | | `subnets.created` | string | Output field: subnets.created | | `subnets.reason` | string | Response reason phrase | | `subnets.reason_removed` | boolean | Response reason phrase | | `subnets.asns` | object | Output field: subnets.asns | | `subnets.ip` | string | Output field: subnets.ip | | `subnets.categoryDescriptions` | object | Output field: subnets.categoryDescriptions | | `subnets.reasonDescription` | string | Response reason phrase | | `subnets.score` | number | Score value | | `subnets.cats` | object | Output field: subnets.cats | | `subnets.subnet` | string | Output field: subnets.subnet | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 23 Jan 2024 06:33:45 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","server-timing":"intid;desc=31fb7d7830c67ba0","x-xss-protection":"1; mode=block","content-security-policy":"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud....","x-content-security-policy":"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud....","x-webkit-...` ## Get IP Reputation Returns the IP reputation report for the entered IP. ### Endpoint - **URL:** `/ipr/history/{{ip}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Get IP Reputation action | ### Input Example `{"path_parameters":{"ip":"216.137.61.0x08"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ip` | string | Output field: ip | | `history` | array | Output field: history | | `history.created` | string | Output field: history.created | | `history.geo` | object | Output field: history.geo | | `history.geo.country` | string | Output field: history.geo.country | | `history.geo.countrycode` | string | Output field: history.geo.countrycode | | `history.ip` | string | Output field: history.ip | | `history.reason` | string | Response reason phrase | | `history.reasonDescription` | string | Response reason phrase | | `history.malware_extended` | object | Output field: history.malware\_extended | | `history.malware_extended.BotNet` | string | Output field: history.malware\_extended.BotNet | | `history.malware_extended.lat` | number | Output field: history.malware\_extended.lat | | `history.malware_extended.long` | number | Output field: history.malware\_extended.long | | `history.malware_extended.city` | string | Output field: history.malware\_extended.city | | `history.malware_extended.CC` | string | Output field: history.malware\_extended.CC | | `history.malware_extended.country` | number | Output field: history.malware\_extended.country | | `history.malware_extended.isnew` | boolean | Output field: history.malware\_extended.isnew | | `history.deleted` | boolean | Output field: history.deleted | | `history.reason_removed` | boolean | Response reason phrase | | `history.categoryDescriptions` | object | Output field: history.categoryDescriptions | | `history.categoryDescriptions.key` | string | Output field: history.categoryDescriptions.key | | `history.categoryDescriptions.value` | string | Value for the parameter | | `history.cats` | object | Output field: history.cats | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"ip":"216.137.61.0x08","history":[{}]}}` ## Get Malware Report For File Hash Returns a malware report for the given file hash, For example, md5, sha1 and sha256. ### Endpoint - **URL:** `/malware/{{filehash}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------- | | `path_parameters.filehash` | string | Required | Parameters for the Get Malware Report For File Hash action | ### Input Example `{"path_parameters":{"filehash":"474B9CCF5AB9D72CA8A333889BBB34F0"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | ------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `malware` | object | Output field: malware | | `malware.created` | string | Output field: malware.created | | `malware.type` | string | Type of the resource | | `malware.family` | array | Output field: malware.family | | `malware.familyMembers` | object | Output field: malware.familyMembers | | `malware.md5` | string | Output field: malware.md5 | | `malware.mimetype` | string | Type of the resource | | `malware.origins` | object | Output field: malware.origins | | `malware.origins.CnCServers` | object | Output field: malware.origins.CnCServers | | `malware.origins.CnCServers.rows` | array | Output field: malware.origins.CnCServers.rows | | `malware.origins.CnCServers.rows.count` | number | Count value | | `malware.origins.CnCServers.rows.domain` | string | Output field: malware.origins.CnCServers.rows.domain | | `malware.origins.CnCServers.rows.filepath` | string | Output field: malware.origins.CnCServers.rows.filepath | | `malware.origins.CnCServers.rows.firstseen` | string | Output field: malware.origins.CnCServers.rows.firstseen | | `malware.origins.CnCServers.rows.host` | string | Output field: malware.origins.CnCServers.rows.host | | `malware.origins.CnCServers.rows.ip` | string | Output field: malware.origins.CnCServers.rows.ip | | `malware.origins.CnCServers.rows.lastseen` | string | Output field: malware.origins.CnCServers.rows.lastseen | | `malware.origins.CnCServers.rows.md5` | string | Output field: malware.origins.CnCServers.rows.md5 | | `malware.origins.CnCServers.rows.origin` | string | Output field: malware.origins.CnCServers.rows.origin | | `malware.origins.CnCServers.rows.schema` | string | Output field: malware.origins.CnCServers.rows.schema | | `malware.origins.CnCServers.rows.type` | string | Type of the resource | | `malware.origins.CnCServers.rows.uri` | string | Output field: malware.origins.CnCServers.rows.uri | | `malware.origins.downloadServers` | object | Output field: malware.origins.downloadServers | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"malware":{"created":"2023-10-05T06:48:26.902Z","type":"md5","family":[],"familyMembers":{},"md5":"string","mimetype":"string","origins":{},"risk":"string"},"tags":[{}]}}` ## Get Malware For Family Returns the malware associated with the entered family using wildcard search. ### Endpoint - **URL:** `/malware/family/{{family}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------ | | `path_parameters.family` | string | Required | Parameters for the Get Malware For Family action | ### Input Example `{"path_parameters":{"family":"tsunami"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `family` | array | Output field: family | | `firstseen` | string | Output field: firstseen | | `lastseen` | string | Output field: lastseen | | `malware` | array | Output field: malware | | `malware.created` | string | Output field: malware.created | | `malware.family` | array | Output field: malware.family | | `malware.md5` | string | Output field: malware.md5 | | `malware.type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"family":["string"],"firstseen":"2023-10-05T06:52:16.276Z","lastseen":"2023-10-05T06:52:16.276Z","malware":[{}]}}` ## Get Malware for IP Returns the malware associated with the entered IP. ### Endpoint - **URL:** `/ipr/malware/{{ip}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Get Malware for IP action | ### Input Example `{"path_parameters":{"ip":"0270.0254.0153.0362"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `malware` | array | Output field: malware | | `malware.family` | array | Output field: malware.family | | `malware.first` | string | Output field: malware.first | | `malware.last` | string | Output field: malware.last | | `malware.md5` | string | Output field: malware.md5 | | `malware.origin` | string | Output field: malware.origin | | `malware.uri` | string | Output field: malware.uri | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"malware":[{}]}}` ## Get Malware For URL Returns the malware associated with the entered URL. ### Endpoint - **URL:** `/url/malware/{{url}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.url` | string | Required | Parameters for the Get Malware For URL action | ### Input Example `{"path_parameters":{"url":"www.mediaget.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `malware` | array | Output field: malware | | `malware.count` | number | Count value | | `malware.domain` | string | Output field: malware.domain | | `malware.filepath` | string | Output field: malware.filepath | | `malware.firstseen` | string | Output field: malware.firstseen | | `malware.host` | string | Output field: malware.host | | `malware.ip` | string | Output field: malware.ip | | `malware.lastseen` | string | Output field: malware.lastseen | | `malware.md5` | string | Output field: malware.md5 | | `malware.origin` | string | Output field: malware.origin | | `malware.schema` | string | Output field: malware.schema | | `malware.type` | string | Type of the resource | | `malware.uri` | string | Output field: malware.uri | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"malware":[{}]}}` ## Get URL Category List Return a list of URL categories provided by XFE. ### Endpoint - **URL:** `/url/categories` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `description` | string | Output field: description | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"ibm","description":"xforce"}}` ## Get URL History Returns the URL history for the entered URL. ### Endpoint - **URL:** `/url/history/{{url}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.url` | string | Required | Parameters for the Get URL History action | ### Input Example `{"path_parameters":{"url":"www.ibm.com/smarterplanet"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `url` | string | URL endpoint for the request | | `created` | string | Output field: created | | `cats` | object | Output field: cats | | `cats.deleted` | boolean | Output field: cats.deleted | | `cats.categoryName` | object | Name of the resource | | `cats.categoryName.confidence` | number | Unique identifier | | `cats.categoryName.reasons` | array | Name of the resource | | `cats.categoryName.description` | string | Name of the resource | | `cats.categoryName.deleted` | boolean | Name of the resource | | `history` | array | Output field: history | | `history.url` | string | URL endpoint for the request | | `history.created` | string | Output field: history.created | | `history.expired` | string | Output field: history.expired | | `history.cats` | object | Output field: history.cats | | `history.cats.deleted` | boolean | Output field: history.cats.deleted | | `history.cats.categoryName` | object | Name of the resource | | `history.cats.categoryName.confidence` | number | Unique identifier | | `history.cats.categoryName.reasons` | array | Name of the resource | | `history.cats.categoryName.description` | string | Name of the resource | | `history.cats.categoryName.deleted` | boolean | Name of the resource | | `history.score` | number | Score value | | `score` | number | Score value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"url":"www.ibm.com/smarterplanet","created":"string","cats":{"deleted":true,"categoryName":{}},"history":[{}],"score":9}}` ## Get URL Report Returns the URL report for the entered URL. ### Endpoint - **URL:** `/url/{{url}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.url` | string | Required | Parameters for the Get URL Report action | ### Input Example `{"path_parameters":{"url":"ibm.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `result` | object | Result of the operation | | `result.url` | string | URL endpoint for the request | | `result.cats` | object | Result of the operation | | `result.cats.category` | boolean | Result of the operation | | `result.categoryDescriptions` | object | Result of the operation | | `result.categoryDescriptions.category` | string | Result of the operation | | `result.score` | number | Result of the operation | | `associated` | array | Output field: associated | | `associated.url` | string | URL endpoint for the request | | `associated.cats` | object | Output field: associated.cats | | `associated.cats.category` | boolean | Output field: associated.cats.category | | `associated.categoryDescriptions` | object | Output field: associated.categoryDescriptions | | `associated.categoryDescriptions.category` | string | Output field: associated.categoryDescriptions.category | | `associated.score` | number | Score value | | `tags` | array | Output field: tags | | `tags.type` | string | Type of the resource | | `tags.tag` | string | Output field: tags.tag | | `tags.entityType` | string | Type of the resource | | `tags.entityId` | string | Unique identifier | | `tags.commentId` | string | Unique identifier | | `tags.user` | string | Output field: tags.user | | `tags.date` | string | Date value | | `tags.displayName` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"result":{"url":"string","cats":{},"categoryDescriptions":{},"score":9},"associated":[{}],"tags":[{}]}}` ## Get URL Updates of Deltas The Delta API provides the data as a bulk download ("base content") for each category supported. ### Endpoint - **URL:** `/url/deltas` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.category` | string | Required | Parameters for the Get URL Updates of Deltas action | | `parameters.pull_id` | number | Optional | Parameters for the Get URL Updates of Deltas action | ### Input Example `{"parameters":{"category":"Illegal Activities","pull_id":5423}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.url` | string | Response data | | `data.created` | string | Response data | | `data.score` | string | Response data | | `pullID` | number | Unique identifier | | `createdAt` | string | Output field: createdAt | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}],"pullID":0,"createdAt":"string"}}` ## Get URLs by Category Return a list of URLs according to the category and date range. ### Endpoint - **URL:** `/url` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.category` | string | Required | Parameters for the Get URLs by Category action | | `parameters.startDate` | string | Optional | Parameters for the Get URLs by Category action | | `parameters.endDate` | string | Optional | Parameters for the Get URLs by Category action | | `parameters.descending` | string | Optional | Parameters for the Get URLs by Category action | | `parameters.limit` | number | Optional | Parameters for the Get URLs by Category action | | `parameters.skip` | number | Optional | Parameters for the Get URLs by Category action | ### Input Example `{"parameters":{"category":"Illegal Activities","startDate":"2016-01-01T00:00:00Z","endDate":"2016-01-01T00:00:00Z","descending":"string","limit":200,"skip":201}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `category` | string | Output field: category | | `rows` | array | Output field: rows | | `rows.url` | string | URL endpoint for the request | | `rows.created` | string | Output field: rows.created | | `nextPage` | string | Output field: nextPage | | `previousPage` | string | Output field: previousPage | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"category":"string","rows":[{}],"nextPage":"string","previousPage":"string"}}` ## Wildcard Search Malware Family Returns the malware associated with the entered family using wildcard search. ### Endpoint - **URL:** `/malware/familyext/{{family}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | -------------------------------------------------------- | | `path_parameters.family` | string | Required | Parameters for the Wildcard Search Malware Family action | ### Input Example `{"path_parameters":{"family":"Adw*"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `family` | array | Output field: family | | `firstseen` | string | Output field: firstseen | | `lastseen` | string | Output field: lastseen | | `malware` | array | Output field: malware | | `malware.created` | string | Output field: malware.created | | `malware.family` | array | Output field: malware.family | | `malware.md5` | string | Output field: malware.md5 | | `malware.type` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"family":["string"],"firstseen":"2023-10-05T06:57:16.299Z","lastseen":"2023-10-05T06:57:16.299Z","malware":[{}]}}` # Response Headers | **Header** | **Description** | **Example** | | -------------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | access-control-allow-credentials | HTTP response header: access-control-allow-credentials | true | | cache-control | Directives for caching mechanisms | private, no-cache, no-store, must-revalidate | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 849e01c5db251bd6-BOM | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | content-security-policy | HTTP response header: content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none' | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Tue, 23 Jan 2024 06:33:45 GMT | | etag | An identifier for a specific version of a resource | W/"6716-O1RiCWxfCSsRMo9LAIFjxTTpIGU" | | expires | The date/time after which the response is considered stale | -1 | | pragma | HTTP response header: pragma | no-cache | | Server | Information about the software used by the origin server | cloudflare | | server-timing | HTTP response header: server-timing | intid;desc=31fb7d7830c67ba0 | | set-cookie | HTTP response header: set-cookie | 1da94ed293a0cf87cb3996cfe5961f3d=e230bbaa856d049ddfdf51eff8f3d99a; path=/; HttpOnly; Secure; SameSite=None, \_\_cfruid=e11de639963482f7adf5d705ba132213b0f0cae0-1705991625; path=/; domain=.ibmcloud.com; HttpOnly; Secure; SameSite=None | | strict-transport-security | HTTP response header: strict-transport-security | max-age=15552000; includeSubDomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Origin, Accept-Encoding | | x-content-security-policy | HTTP response header: x-content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none' | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-webkit-csp | HTTP response header: x-webkit-csp | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'test.cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval' 'cloud.ibm.com/analytics/build/bluemix-analytics.min.js' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none' | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |