--- title: Sekoia Intelligence (CTI) slug: connectors/sekoia-intelligence-cti docTags: createdAt: 2026-06-09T16:30:08.353Z --- The Sekoia Intelligence (CTI) connector enables streamlined access to a vast array of threat intelligence data, facilitating enhanced security operations and decision-making. Sekoia Intelligence (CTI) is a cutting-edge cyber threat intelligence platform that provides actionable insights and detailed threat information. This connector enables Swimlane Turbine users to automate the retrieval of observables, contextual information, and indicators directly within their security workflows. By integrating with Sekoia Intelligence (CTI), users can enhance their threat detection and response capabilities, streamline investigations, and enrich their security data with minimal effort. Sekoia Intelligence (CTI) connector integrates with Sekoia Intelligence (CTI) API's to help organizations detect, analyze, and respond to cybersecurity threats. ## Prerequisites To effectively utilize the Sekoia Intelligence (CTI) connector within Swimlane Turbine, ensure you have the following prerequisites: - HTTP Bearer Token Authentication with the following parameters: - URL: Endpoint for the Sekoia Intelligence API. - The API key: Your personal access token for authentication. ## Capabilities This connector provides the following capabilities: - Get an Observable - Get Indicators - Get Indicator Context - List Observables ## API Documentation Link - [API Authentication Documentation Link](https://docs.sekoia.io/cti/features/integrations/api/) - [Sekoia Intelligence (CTI) API Documentation Link](https://docs.sekoia.io/cti/develop/rest_api/intelligence/) # Configurations ## Sekoia Intelligence CTI HTTP Bearer Authentication Authenticates using bearer token. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API key. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get an Observable Retrieves detailed information about an observable from Sekoia Intelligence (CTI) using the specified UUID. ### Endpoint - **URL:** `/v2/inthreat/observables/{{uuid}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.uuid` | string | Required | Parameters for the Get an Observable action | ### Input Example `{"path_parameters":{"uuid":"domain-name--56772755-db50-5ef6-96ec-5c8ea374c641"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | string | Response data | | `data.type` | string | Response data | | `data.spec_version` | string | Response data | | `data.x_inthreat_sources_refs` | array | Response data | | `data.x_inthreat_short_display` | string | Response data | | `data.created` | string | Response data | | `data.modified` | string | Response data | | `data.value` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Access-Control-Allow-Origin":"*","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Fri, 15 Mar 2024 11:00:31 GMT","Server":"nginx","Strict-Transport-Security":"max-age=63072000; includeSubdomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-Powered-By":"sekoia-webapi","X-Sekoia-Traceid":"73ac468ca1a661d76c9aba1f88ee1fc3","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"d...` ## Get Context by Object ID Retrieve contextual information for a specified object within Sekoia Intelligence using the object's unique ID. ### Endpoint - **URL:** `/v2/inthreat/objects/{{object_id}}/context` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.object_id` | string | Required | Parameters for the Get Context by Object ID action | ### Input Example `{"path_parameters":{"object_id":"indicator--b6ead917-f0f9-41ae-a908-5b9d187db362"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `type` | string | Type of the resource | | `objects` | array | Output field: objects | | `objects.id` | string | Unique identifier | | `objects.type` | string | Type of the resource | | `objects.created_by_ref` | string | Output field: objects.created\_by\_ref | | `objects.created` | string | Output field: objects.created | | `objects.modified` | string | Output field: objects.modified | | `objects.revoked` | boolean | Output field: objects.revoked | | `objects.external_references` | array | Output field: objects.external\_references | | `objects.external_references.source_name` | string | Name of the resource | | `objects.external_references.url` | string | URL endpoint for the request | | `objects.object_marking_refs` | array | Output field: objects.object\_marking\_refs | | `objects.confidence` | number | Unique identifier | | `objects.lang` | string | Output field: objects.lang | | `objects.spec_version` | string | Output field: objects.spec\_version | | `objects.x_inthreat_sources_refs` | array | Output field: objects.x\_inthreat\_sources\_refs | | `objects.x_ic_is_in_flint` | boolean | Output field: objects.x\_ic\_is\_in\_flint | | `objects.x_ic_deprecated` | boolean | Output field: objects.x\_ic\_deprecated | | `objects.name` | string | Name of the resource | | `objects.description` | string | Output field: objects.description | | `objects.identity_class` | string | Unique identifier | | `objects.sectors` | array | Output field: objects.sectors | ### Output Example `{"status_code":200,"response_headers":{"Access-Control-Allow-Origin":"*","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Sun, 17 Mar 2024 10:12:53 GMT","Server":"nginx","Strict-Transport-Security":"max-age=63072000; includeSubdomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-Powered-By":"sekoia-webapi","X-Sekoia-Traceid":"7c20c3e75a0271f0f7b68a4bb642556f","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"i...` ## Get Indicators by Value Retrieve indicators from Sekoia Intelligence (CTI) that match a specified value and type. Required parameters: 'value', 'type'. ### Endpoint - **URL:** `/v2/inthreat/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------- | | `parameters.value` | string | Required | Value of the indicator. | | `parameters.type` | string | Required | Type of the indicator. | ### Input Example `{"parameters":{"value":"outlook.com","type":"domain-name"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ---------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.type` | string | Type of the resource | | `items.created_by_ref` | string | Output field: items.created\_by\_ref | | `items.created` | string | Output field: items.created | | `items.modified` | string | Output field: items.modified | | `items.revoked` | boolean | Output field: items.revoked | | `items.external_references` | array | Output field: items.external\_references | | `items.external_references.source_name` | string | Name of the resource | | `items.external_references.description` | string | Output field: items.external\_references.description | | `items.object_marking_refs` | array | Output field: items.object\_marking\_refs | | `items.confidence` | number | Unique identifier | | `items.lang` | string | Output field: items.lang | | `items.spec_version` | string | Output field: items.spec\_version | | `items.x_inthreat_sources_refs` | array | Output field: items.x\_inthreat\_sources\_refs | | `items.x_ic_is_in_flint` | boolean | Output field: items.x\_ic\_is\_in\_flint | | `items.x_ic_impacted_sectors` | array | Output field: items.x\_ic\_impacted\_sectors | | `items.x_ic_impacted_locations` | array | Output field: items.x\_ic\_impacted\_locations | | `items.x_ic_deprecated` | boolean | Output field: items.x\_ic\_deprecated | | `items.name` | string | Name of the resource | | `items.description` | string | Output field: items.description | | `items.pattern` | string | Output field: items.pattern | | `items.valid_from` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Access-Control-Allow-Origin":"*","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Fri, 15 Mar 2024 11:44:19 GMT","Server":"nginx","Strict-Transport-Security":"max-age=63072000; includeSubdomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-Powered-By":"sekoia-webapi","X-Sekoia-Traceid":"748c93dbd1aaf8ce6962ac6e49d03225","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"i...` ## Get Indicators Context by Value Retrieve contextual information for indicators in Sekoia Intelligence (CTI) that match a specified value and type. ### Endpoint - **URL:** `/v2/inthreat/indicators/context` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------- | | `parameters.value` | string | Required | Value of the indicator. | | `parameters.type` | string | Required | Type of the indicator. | ### Input Example `{"parameters":{"value":"outlook.com","type":"domain-name"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.type` | string | Type of the resource | | `items.objects` | array | Output field: items.objects | | `items.objects.id` | string | Unique identifier | | `items.objects.type` | string | Type of the resource | | `items.objects.created_by_ref` | string | Output field: items.objects.created\_by\_ref | | `items.objects.created` | string | Output field: items.objects.created | | `items.objects.modified` | string | Output field: items.objects.modified | | `items.objects.revoked` | boolean | Output field: items.objects.revoked | | `items.objects.external_references` | array | Output field: items.objects.external\_references | | `items.objects.external_references.source_name` | string | Name of the resource | | `items.objects.external_references.description` | string | Output field: items.objects.external\_references.description | | `items.objects.object_marking_refs` | array | Output field: items.objects.object\_marking\_refs | | `items.objects.confidence` | number | Unique identifier | | `items.objects.lang` | string | Output field: items.objects.lang | | `items.objects.spec_version` | string | Output field: items.objects.spec\_version | | `items.objects.x_inthreat_sources_refs` | array | Output field: items.objects.x\_inthreat\_sources\_refs | | `items.objects.x_ic_is_in_flint` | boolean | Output field: items.objects.x\_ic\_is\_in\_flint | | `items.objects.x_ic_impacted_sectors` | array | Output field: items.objects.x\_ic\_impacted\_sectors | | `items.objects.x_ic_impacted_locations` | array | Output field: items.objects.x\_ic\_impacted\_locations | | `items.objects.x_ic_deprecated` | boolean | Output field: items.objects.x\_ic\_deprecated | | `items.objects.name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Access-Control-Allow-Origin":"*","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Fri, 15 Mar 2024 11:45:03 GMT","Server":"nginx","Strict-Transport-Security":"max-age=63072000; includeSubdomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-Powered-By":"sekoia-webapi","X-Sekoia-Traceid":"45db9f877383e464e359aef97f6e2230","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"i...` ## List Observables Retrieve a list of observables from Sekoia Intelligence CTI for further analysis or correlation. ### Endpoint - **URL:** `/v2/inthreat/observables` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.with_indicated_threats` | boolean | Optional | Parameters for the List Observables action | | `parameters.offset` | number | Optional | Parameters for the List Observables action | | `parameters.limit` | number | Optional | Parameters for the List Observables action | | `parameters.match[type]` | string | Optional | Parameters for the List Observables action | | `parameters.match[hash]` | string | Optional | Parameters for the List Observables action | | `parameters.match[name]` | string | Optional | Parameters for the List Observables action | | `parameters.match[value]` | string | Optional | Parameters for the List Observables action | | `parameters.match[tag]` | string | Optional | Parameters for the List Observables action | | `parameters.match[valid_tag]` | string | Optional | Parameters for the List Observables action | | `parameters.match[id]` | string | Optional | Parameters for the List Observables action | | `parameters.match[source]` | string | Optional | Parameters for the List Observables action | ### Input Example `{"parameters":{"with_indicated_threats":false,"offset":0,"limit":100}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `items` | array | Output field: items | | `items.id` | string | Unique identifier | | `items.type` | string | Type of the resource | | `items.spec_version` | string | Output field: items.spec\_version | | `items.x_inthreat_sources_refs` | array | Output field: items.x\_inthreat\_sources\_refs | | `items.x_inthreat_short_display` | string | Output field: items.x\_inthreat\_short\_display | | `items.created` | string | Output field: items.created | | `items.modified` | string | Output field: items.modified | | `items.value` | string | Value for the parameter | | `total` | number | Output field: total | | `has_more` | boolean | Output field: has\_more | ### Output Example `{"status_code":200,"response_headers":{"Access-Control-Allow-Origin":"*","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Fri, 15 Mar 2024 10:00:15 GMT","Server":"nginx","Strict-Transport-Security":"max-age=63072000; includeSubdomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","X-Powered-By":"sekoia-webapi","X-Sekoia-Traceid":"f716669725314229ae782fa76a6fbaab","Transfer-Encoding":"chunked"},"reason":"OK","json_body":{"i...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------- | -------------------------------------------------------- | -------------------------------------------- | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Fri, 15 Mar 2024 11:44:19 GMT | | Server | Information about the software used by the origin server | nginx | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=63072000; includeSubdomains; preload | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN | | X-Powered-By | HTTP response header: X-Powered-By | sekoia-webapi | | X-Sekoia-Traceid | HTTP response header: X-Sekoia-Traceid | 45db9f877383e464e359aef97f6e2230 |