Splunk Trustar
The TruSTAR connector for Turbine provides an integration with TruSTAR's intelligence platform. TruSTAR is a threat intelligence platform that allows for collection, enrichment, and operationalization of threat data. The integration with Turbine allows for automated and streamlined workflows, making it easier for security teams to prioritize and respond to threats.
With the Turbine-TruSTAR integration, you can automate the process of ingesting threat intelligence data, enriching alerts with this data, and taking actions based on the intelligence provided. This can greatly enhance the speed and effectiveness of threat detection and response.
Prerequisites
Before you can use the TruSTAR connector for Turbine, you'll need access to the TruSTAR API. This requires an API key and OAuth2 authorization. Additionally, you'll need to understand the specific request parameters and schemas for the various API endpoints, as well as the responses that they return.
Limitations
The TruSTAR API has certain limitations. For example, when searching for indicators, the time range values for the start and end of the time window must not exceed a maximum size of 1 year. Additionally, the query term for searching must be at least 3 characters in length. Please refer to the TruSTAR API documentation for detailed information about these limitations.
References
Configurations
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | ο»Ώ | string | Required |
client_id | The API Key | string | Required |
client_secret | The API secret. | string | Required |
scope | Permission scopes for this action. | array | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Create Workflow
Create a new workflow. A company cannot create more than 5 workflows. There cannot be more than 10 source enclaves per workflow.
Endpoint
- URL: /api/2.0/workflows
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | Name of the resource |
workflowConfig | object | Optional | Parameter for Create Workflow |
workflowConfig.type | string | Optional | Type of the resource |
workflowConfig.WorkflowConfigIndicatorPrioritization | object | Optional | Parameter for Create Workflow |
workflowConfig.workflowSource | object | Optional | Parameter for Create Workflow |
workflowConfig.workflowDestination | object | Optional | Parameter for Create Workflow |
workflowConfig.observableTypes | array | Optional | Type of the resource |
workflowConfig.priorityScores | array | Optional | Parameter for Create Workflow |
safelistGuids | array | Optional | Unique identifier |
Input Example
{"json_body":{"name":"string_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":["string_value_1"],"priorityScores":["string_value_2"]},"safelistGuids":["string_value_3"]}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.guid | string | Unique identifier |
response.name | string | Name of the resource |
response.created | number | Output field: response.created |
response.updated | number | Output field: response.updated |
response.workflowConfig | object | Output field: response.workflowConfig |
response.workflowConfig.type | string | Type of the resource |
response.workflowConfig.workflowSource | object | Output field: response.workflowConfig.workflowSource |
response.workflowConfig.workflowDestination | object | Output field: response.workflowConfig.workflowDestination |
response.safelistGuids | array | Unique identifier |
Output Example
{"response":{"guid":"string","name":"string","created":0,"updated":0,"workflowConfig":{"type":"INDICATOR_PRIORITIZATION","workflowSource":{},"workflowDestination":{}},"safelistGuids":["string"]}}
Delete Workflow
Delete an existing workflow
Endpoint
- URL: /api/2.0/workflows/{{id}}
- Method: DELETE
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Optional | Parameters for the Delete Workflow action |
Input Example
{"path_parameters":{"id":"The unique guid for the workflow"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
Output Example
{"response":{}}
Get Enclaves
Get the list of all enclaves that the user has access to
Endpoint
- URL: /api/2.0/enclaves
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
response | array | Output field: response |
response.name | string | Name of the resource |
response.templateName | string | Name of the resource |
response.workflowSupported | boolean | Output field: response.workflowSupported |
response.read | boolean | Output field: response.read |
response.create | boolean | Output field: response.create |
response.update | boolean | Date value |
response.id | string | Unique identifier |
response.type | string | Type of the resource |
Output Example
{"response":[{"name":"string","templateName":"string","workflowSupported":true,"read":true,"create":true,"update":true,"id":"string","type":"OPEN"}]}
Get Observables for submission
Find all observables contained in a submission
Endpoint
- URL: /api/2.0/observables
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.submissionId | string | Required | Parameters for the Get Observables for submission action |
parameters.idType | string | Optional | Parameters for the Get Observables for submission action |
parameters.enclaveGuid | string | Optional | Parameters for the Get Observables for submission action |
parameters.pageSize | number | Optional | Parameters for the Get Observables for submission action |
parameters.pageNumber | number | Optional | Parameters for the Get Observables for submission action |
Input Example
{"parameters":{"submissionId":"abc123","idType":"INTERNAL","enclaveGuid":"guid123","pageSize":100,"pageNumber":0}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.content | array | Response content |
response.content.value | string | Value for the parameter |
response.content.type | string | Type of the resource |
response.pageable | object | Output field: response.pageable |
response.pageable.unpaged | boolean | Output field: response.pageable.unpaged |
response.pageable.pageNumber | number | Output field: response.pageable.pageNumber |
response.pageable.pageSize | number | Output field: response.pageable.pageSize |
response.pageable.paged | boolean | Output field: response.pageable.paged |
response.pageable.sort | object | Output field: response.pageable.sort |
response.pageable.sort.unsorted | boolean | Output field: response.pageable.sort.unsorted |
response.pageable.sort.sorted | boolean | Output field: response.pageable.sort.sorted |
response.pageable.sort.empty | boolean | Output field: response.pageable.sort.empty |
response.pageable.offset | number | Output field: response.pageable.offset |
response.numberOfElements | number | Output field: response.numberOfElements |
response.first | boolean | Output field: response.first |
response.sort | object | Output field: response.sort |
response.sort.unsorted | boolean | Output field: response.sort.unsorted |
response.sort.sorted | boolean | Output field: response.sort.sorted |
response.sort.empty | boolean | Output field: response.sort.empty |
response.last | boolean | Output field: response.last |
response.size | number | Output field: response.size |
response.number | number | Output field: response.number |
response.empty | boolean | Output field: response.empty |
Output Example
{"response":{"content":[{}],"pageable":{"unpaged":true,"pageNumber":0,"pageSize":0,"paged":true,"sort":{},"offset":0},"numberOfElements":0,"first":true,"sort":{"unsorted":true,"sorted":true,"empty":true},"last":true,"size":0,"number":0,"empty":true}}
Get Submission Status
Find and return the processing status of the submission
Endpoint
- URL: /api/2.0/submissions/{{id}}/status
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Submission Status action |
Input Example
{"path_parameters":{"id":"The unique guid for the workflow"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.id | string | Unique identifier |
response.status | string | Status value |
response.errorMessage | string | Response message |
Output Example
{"response":{"id":"string","status":"SUBMISSION_PROCESSING","errorMessage":"string"}}
Get Workflow
Retrieve the workflow for the GUID
Endpoint
- URL: /api/2.0/workflows/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Workflow action |
Input Example
{"path_parameters":{"id":"The unique guid for the workflow"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.guid | string | Unique identifier |
response.name | string | Name of the resource |
response.created | string | Output field: response.created |
response.updated | string | Output field: response.updated |
response.workflowConfig | object | Output field: response.workflowConfig |
response.workflowConfig.type | string | Type of the resource |
response.workflowConfig.WorkflowConfigIndicatorPrioritization | object | Output field: response.workflowConfig.WorkflowConfigIndicatorPrioritization |
response.workflowConfig.workflowSource | object | Output field: response.workflowConfig.workflowSource |
response.workflowConfig.workflowDestination | object | Output field: response.workflowConfig.workflowDestination |
response.workflowConfig.observableTypes | array | Type of the resource |
response.workflowConfig.priorityScores | array | Output field: response.workflowConfig.priorityScores |
response.safelistGuids | array | Unique identifier |
Output Example
{"response":{"guid":"string_value","name":"string_value","created":"int64_value","updated":"int64_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":[],"priorityScores":[]},"safelistGuids":["string_value_2"]}}
Get Workflows
Get the workflows for this company
Endpoint
- URL: /api/2.0/workflows
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.type | string | Optional | Parameters for the Get Workflows action |
parameters.name | string | Optional | Parameters for the Get Workflows action |
parameters.createdFrom | string | Optional | Parameters for the Get Workflows action |
parameters.createdTo | string | Optional | Parameters for the Get Workflows action |
parameters.updatedFrom | string | Optional | Parameters for the Get Workflows action |
parameters.updatedTo | string | Optional | Parameters for the Get Workflows action |
Input Example
{"parameters":{"type":"string_value","name":"string_value","createdFrom":"int64_value","createdTo":"int64_value","updatedFrom":"int64_value","updatedTo":"int64_value"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.content | array | Response content |
response.content.guid | string | Unique identifier |
response.content.name | string | Name of the resource |
response.content.created | number | Response content |
response.content.updated | number | Response content |
response.content.workflowConfig | object | Response content |
response.content.workflowConfig.type | string | Type of the resource |
response.content.workflowConfig.workflowSource | object | Response content |
response.content.workflowConfig.workflowDestination | object | Response content |
response.content.safelistGuids | array | Unique identifier |
response.pageable | object | Output field: response.pageable |
response.pageable.unpaged | boolean | Output field: response.pageable.unpaged |
response.pageable.pageNumber | number | Output field: response.pageable.pageNumber |
response.pageable.pageSize | number | Output field: response.pageable.pageSize |
response.pageable.paged | boolean | Output field: response.pageable.paged |
response.pageable.sort | object | Output field: response.pageable.sort |
response.pageable.sort.unsorted | boolean | Output field: response.pageable.sort.unsorted |
response.pageable.sort.sorted | boolean | Output field: response.pageable.sort.sorted |
response.pageable.sort.empty | boolean | Output field: response.pageable.sort.empty |
response.pageable.offset | number | Output field: response.pageable.offset |
response.totalPages | number | Output field: response.totalPages |
response.totalElements | number | Output field: response.totalElements |
response.numberOfElements | number | Output field: response.numberOfElements |
response.first | boolean | Output field: response.first |
Output Example
{"response":{"content":[{}],"pageable":{"unpaged":true,"pageNumber":0,"pageSize":0,"paged":true,"sort":{},"offset":0},"totalPages":0,"totalElements":0,"numberOfElements":0,"first":true,"sort":{"unsorted":true,"sorted":true,"empty":true},"last":true,"empty":true,"size":0,"number":0}}
Redact Submission
Redact a submission using your companyβs redaction library. All terms from your current redaction library will be applied to the title and body of your submission.
Endpoint
- URL: /api/2.0/submissions/redact
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
title | string | Optional | Parameter for Redact Submission |
content | string | Optional | Response content |
Input Example
{"json_body":{"title":"string_value","content":"string_value_3"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.title | string | Output field: response.title |
response.content | string | Response content |
Output Example
{"response":{"title":"string","content":"string"}}
Search Indicators
Search for indicators and return a cursor page
Endpoint
- URL: /api/2.0/indicators/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.pageSize | number | Optional | Parameters for the Search Indicators action |
queryTerm | string | Optional | Parameter for Search Indicators |
from | number | Optional | Parameter for Search Indicators |
to | number | Optional | Parameter for Search Indicators |
sortColumn | string | Optional | Parameter for Search Indicators |
sortOrder | string | Optional | Parameter for Search Indicators |
priorityScores | array | Optional | Parameter for Search Indicators |
enclaveGuids | array | Optional | Unique identifier |
types | array | Optional | Type of the resource |
attributes | array | Optional | Parameter for Search Indicators |
attributes.value | string | Optional | Value for the parameter |
attributes.type | string | Optional | Type of the resource |
includedTags | array | Optional | Parameter for Search Indicators |
excludedTags | array | Optional | Parameter for Search Indicators |
cursor | string | Optional | Parameter for Search Indicators |
includeSafelisted | boolean | Optional | Parameter for Search Indicators |
Input Example
{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string","from":0,"to":0,"sortColumn":"CREATED","sortOrder":"ASC","priorityScores":[0],"enclaveGuids":["string"],"types":["IP4"],"attributes":[{"value":"string","type":"THREAT_ACTOR"}],"includedTags":["string"],"excludedTags":["string"],"cursor":"string","includeSafelisted":true}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.items | array | Output field: response.items |
response.items.guid | string | Unique identifier |
response.items.enclaveGuid | string | Unique identifier |
response.items.workflowGuid | string | Unique identifier |
response.items.observable | object | Output field: response.items.observable |
response.items.observable.value | string | Value for the parameter |
response.items.observable.type | string | Type of the resource |
response.items.priorityScore | string | Score value |
response.items.attributes | array | Output field: response.items.attributes |
response.items.attributes.value | string | Value for the parameter |
response.items.attributes.type | string | Type of the resource |
response.items.userTags | array | Output field: response.items.userTags |
response.items.submissionTags | array | Output field: response.items.submissionTags |
response.items.scoreContexts | array | Output field: response.items.scoreContexts |
response.items.scoreContexts.enclaveGuid | string | Unique identifier |
response.items.scoreContexts.sourceName | string | Name of the resource |
response.items.scoreContexts.normalizedScore | number | Score value |
response.items.scoreContexts.weight | number | Output field: response.items.scoreContexts.weight |
response.items.scoreContexts.properties | object | Output field: response.items.scoreContexts.properties |
response.items.scoreContexts.properties.property1 | array | Output field: response.items.scoreContexts.properties.property1 |
response.items.scoreContexts.properties.property2 | array | Output field: response.items.scoreContexts.properties.property2 |
response.items.created | number | Output field: response.items.created |
response.items.updated | number | Output field: response.items.updated |
response.items.processedAt | number | Output field: response.items.processedAt |
Output Example
{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}
Search Observables
Search observables according to specified criteria
Endpoint
- URL: /api/2.0/observables/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.pageSize | number | Optional | Parameters for the Search Observables action |
queryTerm | string | Optional | Parameter for Search Observables |
from | number | Optional | Parameter for Search Observables |
to | number | Optional | Parameter for Search Observables |
sortColumn | string | Optional | Parameter for Search Observables |
sortOrder | string | Optional | Parameter for Search Observables |
enclaveGuids | array | Optional | Unique identifier |
types | array | Optional | Type of the resource |
includedTags | array | Optional | Parameter for Search Observables |
excludedTags | array | Optional | Parameter for Search Observables |
cursor | string | Optional | Parameter for Search Observables |
Input Example
{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string","from":0,"to":0,"sortColumn":"FIRST_SEEN","sortOrder":"ASC","enclaveGuids":["string"],"types":["IP4"],"includedTags":["string"],"excludedTags":["string"],"cursor":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.items | array | Output field: response.items |
response.items.type | string | Type of the resource |
response.items.value | string | Value for the parameter |
response.items.firstSeen | number | Output field: response.items.firstSeen |
response.items.lastSeen | number | Output field: response.items.lastSeen |
response.items.enclaveGuids | array | Unique identifier |
response.items.tags | array | Output field: response.items.tags |
response.responseMetadata | object | Response data |
response.responseMetadata.nextCursor | string | Response data |
response.responseMetadata.totalItems | number | Response data |
Output Example
{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}
Search Submission
Search for submissions (intel, events and indicators) and return a cursor page
Endpoint
- URL: /api/2.0/submissions/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.pageSize | number | Optional | Parameters for the Search Submission action |
queryTerm | string | Optional | Parameter for Search Submission |
from | string | Optional | Parameter for Search Submission |
to | string | Optional | Parameter for Search Submission |
enclaveGuids | array | Optional | Unique identifier |
includedTags | array | Optional | Parameter for Search Submission |
excludedTags | array | Optional | Parameter for Search Submission |
cursor | string | Optional | Parameter for Search Submission |
sortColumn | string | Optional | Parameter for Search Submission |
Input Example
{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string_value","from":"int64_value","to":"int64_value","enclaveGuids":["string_value_1"],"includedTags":["string_value_2"],"excludedTags":["string_value_3"],"cursor":"string_value_4","sortColumn":"SORT_ENUM"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.items | array | Output field: response.items |
response.items.guid | string | Unique identifier |
response.items.enclaveGuid | string | Unique identifier |
response.items.title | string | Output field: response.items.title |
response.items.created | number | Output field: response.items.created |
response.items.updated | number | Output field: response.items.updated |
response.items.tags | array | Output field: response.items.tags |
response.responseMetadata | object | Response data |
response.responseMetadata.nextCursor | string | Response data |
response.responseMetadata.totalItems | number | Response data |
Output Example
{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}
Update Workflow
Update an existing workflow. A company cannot create more than 5 workflows. There cannot be more than 10 source enclaves per workflow.
Endpoint
- URL: /api/2.0/workflows/{{id}}
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Update Workflow action |
name | string | Optional | Name of the resource |
workflowConfig | object | Optional | Parameter for Update Workflow |
workflowConfig.type | string | Optional | Type of the resource |
workflowConfig.WorkflowConfigIndicatorPrioritization | object | Optional | Parameter for Update Workflow |
workflowConfig.workflowSource | object | Optional | Parameter for Update Workflow |
workflowConfig.workflowDestination | object | Optional | Parameter for Update Workflow |
workflowConfig.observableTypes | array | Optional | Type of the resource |
workflowConfig.priorityScores | array | Optional | Parameter for Update Workflow |
safelistGuids | array | Optional | Unique identifier |
Input Example
{"json_body":{"name":"string_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":["string_value_1"],"priorityScores":["string_value_2"]},"safelistGuids":["string_value_3"]},"path_parameters":{"id":"The unique guid for the workflow"}}
Output
Parameter | Type | Description |
|---|---|---|
response | object | Output field: response |
response.guid | string | Unique identifier |
response.name | string | Name of the resource |
response.created | number | Output field: response.created |
response.updated | number | Output field: response.updated |
response.workflowConfig | object | Output field: response.workflowConfig |
response.workflowConfig.type | string | Type of the resource |
response.workflowConfig.workflowSource | object | Output field: response.workflowConfig.workflowSource |
response.workflowConfig.workflowDestination | object | Output field: response.workflowConfig.workflowDestination |
response.safelistGuids | array | Unique identifier |
Output Example
{"response":{"guid":"string","name":"string","created":0,"updated":0,"workflowConfig":{"type":"INDICATOR_PRIORITIZATION","workflowSource":{},"workflowDestination":{}},"safelistGuids":["string"]}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |