--- title: Splunk Trustar slug: connectors/splunk-trustar docTags: createdAt: 2026-06-09T16:30:18.359Z --- The TruSTAR connector for Turbine provides an integration with TruSTAR's intelligence platform. TruSTAR is a threat intelligence platform that allows for collection, enrichment, and operationalization of threat data. The integration with Turbine allows for automated and streamlined workflows, making it easier for security teams to prioritize and respond to threats. With the Turbine-TruSTAR integration, you can automate the process of ingesting threat intelligence data, enriching alerts with this data, and taking actions based on the intelligence provided. This can greatly enhance the speed and effectiveness of threat detection and response. ## Prerequisites Before you can use the TruSTAR connector for Turbine, you'll need access to the TruSTAR API. This requires an API key and OAuth2 authorization. Additionally, you'll need to understand the specific request parameters and schemas for the various API endpoints, as well as the responses that they return. ## Limitations The TruSTAR API has certain limitations. For example, when searching for indicators, the time range values for the start and end of the time window must not exceed a maximum size of 1 year. Additionally, the query term for searching must be at least 3 characters in length. Please refer to the TruSTAR API documentation for detailed information about these limitations. ## References [TruSTAR API Documentation](https://docs.trustar.co/api/v20/index.html#https://) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The API Key | string | Required | | client\_secret | The API secret. | string | Required | | scope | Permission scopes for this action. | array | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create Workflow Create a new workflow. A company cannot create more than 5 workflows. There cannot be more than 10 source enclaves per workflow. ### Endpoint - **URL:** `/api/2.0/workflows` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------ | -------- | ------------ | ----------------------------- | | `name` | string | Optional | Name of the resource | | `workflowConfig` | object | Optional | Parameter for Create Workflow | | `workflowConfig.type` | string | Optional | Type of the resource | | `workflowConfig.WorkflowConfigIndicatorPrioritization` | object | Optional | Parameter for Create Workflow | | `workflowConfig.workflowSource` | object | Optional | Parameter for Create Workflow | | `workflowConfig.workflowDestination` | object | Optional | Parameter for Create Workflow | | `workflowConfig.observableTypes` | array | Optional | Type of the resource | | `workflowConfig.priorityScores` | array | Optional | Parameter for Create Workflow | | `safelistGuids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"name":"string_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":["string_value_1"],"priorityScores":["string_value_2"]},"safelistGuids":["string_value_3"]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | --------------------------------------------------------- | | `response` | object | Output field: response | | `response.guid` | string | Unique identifier | | `response.name` | string | Name of the resource | | `response.created` | number | Output field: response.created | | `response.updated` | number | Output field: response.updated | | `response.workflowConfig` | object | Output field: response.workflowConfig | | `response.workflowConfig.type` | string | Type of the resource | | `response.workflowConfig.workflowSource` | object | Output field: response.workflowConfig.workflowSource | | `response.workflowConfig.workflowDestination` | object | Output field: response.workflowConfig.workflowDestination | | `response.safelistGuids` | array | Unique identifier | ### Output Example `{"response":{"guid":"string","name":"string","created":0,"updated":0,"workflowConfig":{"type":"INDICATOR_PRIORITIZATION","workflowSource":{},"workflowDestination":{}},"safelistGuids":["string"]}}` ## Delete Workflow Delete an existing workflow ### Endpoint - **URL:** `/api/2.0/workflows/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.id` | string | Optional | Parameters for the Delete Workflow action | ### Input Example `{"path_parameters":{"id":"The unique guid for the workflow"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ---------------------- | | `response` | object | Output field: response | ### Output Example `{"response":{}}` ## Get Enclaves Get the list of all enclaves that the user has access to ### Endpoint - **URL:** `/api/2.0/enclaves` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ---------------------------------------- | | `response` | array | Output field: response | | `response.name` | string | Name of the resource | | `response.templateName` | string | Name of the resource | | `response.workflowSupported` | boolean | Output field: response.workflowSupported | | `response.read` | boolean | Output field: response.read | | `response.create` | boolean | Output field: response.create | | `response.update` | boolean | Date value | | `response.id` | string | Unique identifier | | `response.type` | string | Type of the resource | ### Output Example `{"response":[{"name":"string","templateName":"string","workflowSupported":true,"read":true,"create":true,"update":true,"id":"string","type":"OPEN"}]}` ## Get Observables for submission Find all observables contained in a submission ### Endpoint - **URL:** `/api/2.0/observables` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------------------- | | `parameters.submissionId` | string | Required | Parameters for the Get Observables for submission action | | `parameters.idType` | string | Optional | Parameters for the Get Observables for submission action | | `parameters.enclaveGuid` | string | Optional | Parameters for the Get Observables for submission action | | `parameters.pageSize` | number | Optional | Parameters for the Get Observables for submission action | | `parameters.pageNumber` | number | Optional | Parameters for the Get Observables for submission action | ### Input Example `{"parameters":{"submissionId":"abc123","idType":"INTERNAL","enclaveGuid":"guid123","pageSize":100,"pageNumber":0}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | --------------------------------------------- | | `response` | object | Output field: response | | `response.content` | array | Response content | | `response.content.value` | string | Value for the parameter | | `response.content.type` | string | Type of the resource | | `response.pageable` | object | Output field: response.pageable | | `response.pageable.unpaged` | boolean | Output field: response.pageable.unpaged | | `response.pageable.pageNumber` | number | Output field: response.pageable.pageNumber | | `response.pageable.pageSize` | number | Output field: response.pageable.pageSize | | `response.pageable.paged` | boolean | Output field: response.pageable.paged | | `response.pageable.sort` | object | Output field: response.pageable.sort | | `response.pageable.sort.unsorted` | boolean | Output field: response.pageable.sort.unsorted | | `response.pageable.sort.sorted` | boolean | Output field: response.pageable.sort.sorted | | `response.pageable.sort.empty` | boolean | Output field: response.pageable.sort.empty | | `response.pageable.offset` | number | Output field: response.pageable.offset | | `response.numberOfElements` | number | Output field: response.numberOfElements | | `response.first` | boolean | Output field: response.first | | `response.sort` | object | Output field: response.sort | | `response.sort.unsorted` | boolean | Output field: response.sort.unsorted | | `response.sort.sorted` | boolean | Output field: response.sort.sorted | | `response.sort.empty` | boolean | Output field: response.sort.empty | | `response.last` | boolean | Output field: response.last | | `response.size` | number | Output field: response.size | | `response.number` | number | Output field: response.number | | `response.empty` | boolean | Output field: response.empty | ### Output Example `{"response":{"content":[{}],"pageable":{"unpaged":true,"pageNumber":0,"pageSize":0,"paged":true,"sort":{},"offset":0},"numberOfElements":0,"first":true,"sort":{"unsorted":true,"sorted":true,"empty":true},"last":true,"size":0,"number":0,"empty":true}}` ## Get Submission Status Find and return the processing status of the submission ### Endpoint - **URL:** `/api/2.0/submissions/{{id}}/status` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Submission Status action | ### Input Example `{"path_parameters":{"id":"The unique guid for the workflow"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ---------------------- | | `response` | object | Output field: response | | `response.id` | string | Unique identifier | | `response.status` | string | Status value | | `response.errorMessage` | string | Response message | ### Output Example `{"response":{"id":"string","status":"SUBMISSION_PROCESSING","errorMessage":"string"}}` ## Get Workflow Retrieve the workflow for the GUID ### Endpoint - **URL:** `/api/2.0/workflows/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Workflow action | ### Input Example `{"path_parameters":{"id":"The unique guid for the workflow"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | --------------------------------------------------------------------------- | | `response` | object | Output field: response | | `response.guid` | string | Unique identifier | | `response.name` | string | Name of the resource | | `response.created` | string | Output field: response.created | | `response.updated` | string | Output field: response.updated | | `response.workflowConfig` | object | Output field: response.workflowConfig | | `response.workflowConfig.type` | string | Type of the resource | | `response.workflowConfig.WorkflowConfigIndicatorPrioritization` | object | Output field: response.workflowConfig.WorkflowConfigIndicatorPrioritization | | `response.workflowConfig.workflowSource` | object | Output field: response.workflowConfig.workflowSource | | `response.workflowConfig.workflowDestination` | object | Output field: response.workflowConfig.workflowDestination | | `response.workflowConfig.observableTypes` | array | Type of the resource | | `response.workflowConfig.priorityScores` | array | Output field: response.workflowConfig.priorityScores | | `response.safelistGuids` | array | Unique identifier | ### Output Example `{"response":{"guid":"string_value","name":"string_value","created":"int64_value","updated":"int64_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":[],"priorityScores":[]},"safelistGuids":["string_value_2"]}}` ## Get Workflows Get the workflows for this company ### Endpoint - **URL:** `/api/2.0/workflows` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------- | | `parameters.type` | string | Optional | Parameters for the Get Workflows action | | `parameters.name` | string | Optional | Parameters for the Get Workflows action | | `parameters.createdFrom` | string | Optional | Parameters for the Get Workflows action | | `parameters.createdTo` | string | Optional | Parameters for the Get Workflows action | | `parameters.updatedFrom` | string | Optional | Parameters for the Get Workflows action | | `parameters.updatedTo` | string | Optional | Parameters for the Get Workflows action | ### Input Example `{"parameters":{"type":"string_value","name":"string_value","createdFrom":"int64_value","createdTo":"int64_value","updatedFrom":"int64_value","updatedTo":"int64_value"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | --------------------------------------------- | | `response` | object | Output field: response | | `response.content` | array | Response content | | `response.content.guid` | string | Unique identifier | | `response.content.name` | string | Name of the resource | | `response.content.created` | number | Response content | | `response.content.updated` | number | Response content | | `response.content.workflowConfig` | object | Response content | | `response.content.workflowConfig.type` | string | Type of the resource | | `response.content.workflowConfig.workflowSource` | object | Response content | | `response.content.workflowConfig.workflowDestination` | object | Response content | | `response.content.safelistGuids` | array | Unique identifier | | `response.pageable` | object | Output field: response.pageable | | `response.pageable.unpaged` | boolean | Output field: response.pageable.unpaged | | `response.pageable.pageNumber` | number | Output field: response.pageable.pageNumber | | `response.pageable.pageSize` | number | Output field: response.pageable.pageSize | | `response.pageable.paged` | boolean | Output field: response.pageable.paged | | `response.pageable.sort` | object | Output field: response.pageable.sort | | `response.pageable.sort.unsorted` | boolean | Output field: response.pageable.sort.unsorted | | `response.pageable.sort.sorted` | boolean | Output field: response.pageable.sort.sorted | | `response.pageable.sort.empty` | boolean | Output field: response.pageable.sort.empty | | `response.pageable.offset` | number | Output field: response.pageable.offset | | `response.totalPages` | number | Output field: response.totalPages | | `response.totalElements` | number | Output field: response.totalElements | | `response.numberOfElements` | number | Output field: response.numberOfElements | | `response.first` | boolean | Output field: response.first | ### Output Example `{"response":{"content":[{}],"pageable":{"unpaged":true,"pageNumber":0,"pageSize":0,"paged":true,"sort":{},"offset":0},"totalPages":0,"totalElements":0,"numberOfElements":0,"first":true,"sort":{"unsorted":true,"sorted":true,"empty":true},"last":true,"empty":true,"size":0,"number":0}}` ## Redact Submission Redact a submission using your company’s redaction library. All terms from your current redaction library will be applied to the title and body of your submission. ### Endpoint - **URL:** `/api/2.0/submissions/redact` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------- | | `title` | string | Optional | Parameter for Redact Submission | | `content` | string | Optional | Response content | ### Input Example `{"json_body":{"title":"string_value","content":"string_value_3"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | ---------------------------- | | `response` | object | Output field: response | | `response.title` | string | Output field: response.title | | `response.content` | string | Response content | ### Output Example `{"response":{"title":"string","content":"string"}}` ## Search Indicators Search for indicators and return a cursor page ### Endpoint - **URL:** `/api/2.0/indicators/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.pageSize` | number | Optional | Parameters for the Search Indicators action | | `queryTerm` | string | Optional | Parameter for Search Indicators | | `from` | number | Optional | Parameter for Search Indicators | | `to` | number | Optional | Parameter for Search Indicators | | `sortColumn` | string | Optional | Parameter for Search Indicators | | `sortOrder` | string | Optional | Parameter for Search Indicators | | `priorityScores` | array | Optional | Parameter for Search Indicators | | `enclaveGuids` | array | Optional | Unique identifier | | `types` | array | Optional | Type of the resource | | `attributes` | array | Optional | Parameter for Search Indicators | | `attributes.value` | string | Optional | Value for the parameter | | `attributes.type` | string | Optional | Type of the resource | | `includedTags` | array | Optional | Parameter for Search Indicators | | `excludedTags` | array | Optional | Parameter for Search Indicators | | `cursor` | string | Optional | Parameter for Search Indicators | | `includeSafelisted` | boolean | Optional | Parameter for Search Indicators | ### Input Example `{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string","from":0,"to":0,"sortColumn":"CREATED","sortOrder":"ASC","priorityScores":[0],"enclaveGuids":["string"],"types":["IP4"],"attributes":[{"value":"string","type":"THREAT_ACTOR"}],"includedTags":["string"],"excludedTags":["string"],"cursor":"string","includeSafelisted":true}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | --------------------------------------------------------------- | | `response` | object | Output field: response | | `response.items` | array | Output field: response.items | | `response.items.guid` | string | Unique identifier | | `response.items.enclaveGuid` | string | Unique identifier | | `response.items.workflowGuid` | string | Unique identifier | | `response.items.observable` | object | Output field: response.items.observable | | `response.items.observable.value` | string | Value for the parameter | | `response.items.observable.type` | string | Type of the resource | | `response.items.priorityScore` | string | Score value | | `response.items.attributes` | array | Output field: response.items.attributes | | `response.items.attributes.value` | string | Value for the parameter | | `response.items.attributes.type` | string | Type of the resource | | `response.items.userTags` | array | Output field: response.items.userTags | | `response.items.submissionTags` | array | Output field: response.items.submissionTags | | `response.items.scoreContexts` | array | Output field: response.items.scoreContexts | | `response.items.scoreContexts.enclaveGuid` | string | Unique identifier | | `response.items.scoreContexts.sourceName` | string | Name of the resource | | `response.items.scoreContexts.normalizedScore` | number | Score value | | `response.items.scoreContexts.weight` | number | Output field: response.items.scoreContexts.weight | | `response.items.scoreContexts.properties` | object | Output field: response.items.scoreContexts.properties | | `response.items.scoreContexts.properties.property1` | array | Output field: response.items.scoreContexts.properties.property1 | | `response.items.scoreContexts.properties.property2` | array | Output field: response.items.scoreContexts.properties.property2 | | `response.items.created` | number | Output field: response.items.created | | `response.items.updated` | number | Output field: response.items.updated | | `response.items.processedAt` | number | Output field: response.items.processedAt | ### Output Example `{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}` ## Search Observables Search observables according to specified criteria ### Endpoint - **URL:** `/api/2.0/observables/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.pageSize` | number | Optional | Parameters for the Search Observables action | | `queryTerm` | string | Optional | Parameter for Search Observables | | `from` | number | Optional | Parameter for Search Observables | | `to` | number | Optional | Parameter for Search Observables | | `sortColumn` | string | Optional | Parameter for Search Observables | | `sortOrder` | string | Optional | Parameter for Search Observables | | `enclaveGuids` | array | Optional | Unique identifier | | `types` | array | Optional | Type of the resource | | `includedTags` | array | Optional | Parameter for Search Observables | | `excludedTags` | array | Optional | Parameter for Search Observables | | `cursor` | string | Optional | Parameter for Search Observables | ### Input Example `{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string","from":0,"to":0,"sortColumn":"FIRST_SEEN","sortOrder":"ASC","enclaveGuids":["string"],"types":["IP4"],"includedTags":["string"],"excludedTags":["string"],"cursor":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------------- | | `response` | object | Output field: response | | `response.items` | array | Output field: response.items | | `response.items.type` | string | Type of the resource | | `response.items.value` | string | Value for the parameter | | `response.items.firstSeen` | number | Output field: response.items.firstSeen | | `response.items.lastSeen` | number | Output field: response.items.lastSeen | | `response.items.enclaveGuids` | array | Unique identifier | | `response.items.tags` | array | Output field: response.items.tags | | `response.responseMetadata` | object | Response data | | `response.responseMetadata.nextCursor` | string | Response data | | `response.responseMetadata.totalItems` | number | Response data | ### Output Example `{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}` ## Search Submission Search for submissions (intel, events and indicators) and return a cursor page ### Endpoint - **URL:** `/api/2.0/submissions/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.pageSize` | number | Optional | Parameters for the Search Submission action | | `queryTerm` | string | Optional | Parameter for Search Submission | | `from` | string | Optional | Parameter for Search Submission | | `to` | string | Optional | Parameter for Search Submission | | `enclaveGuids` | array | Optional | Unique identifier | | `includedTags` | array | Optional | Parameter for Search Submission | | `excludedTags` | array | Optional | Parameter for Search Submission | | `cursor` | string | Optional | Parameter for Search Submission | | `sortColumn` | string | Optional | Parameter for Search Submission | ### Input Example `{"parameters":{"pageSize":999},"json_body":{"queryTerm":"string_value","from":"int64_value","to":"int64_value","enclaveGuids":["string_value_1"],"includedTags":["string_value_2"],"excludedTags":["string_value_3"],"cursor":"string_value_4","sortColumn":"SORT_ENUM"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ------------------------------------ | | `response` | object | Output field: response | | `response.items` | array | Output field: response.items | | `response.items.guid` | string | Unique identifier | | `response.items.enclaveGuid` | string | Unique identifier | | `response.items.title` | string | Output field: response.items.title | | `response.items.created` | number | Output field: response.items.created | | `response.items.updated` | number | Output field: response.items.updated | | `response.items.tags` | array | Output field: response.items.tags | | `response.responseMetadata` | object | Response data | | `response.responseMetadata.nextCursor` | string | Response data | | `response.responseMetadata.totalItems` | number | Response data | ### Output Example `{"response":{"items":[{}],"responseMetadata":{"nextCursor":"string","totalItems":0}}}` ## Update Workflow Update an existing workflow. A company cannot create more than 5 workflows. There cannot be more than 10 source enclaves per workflow. ### Endpoint - **URL:** `/api/2.0/workflows/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------ | -------- | ------------ | ----------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Update Workflow action | | `name` | string | Optional | Name of the resource | | `workflowConfig` | object | Optional | Parameter for Update Workflow | | `workflowConfig.type` | string | Optional | Type of the resource | | `workflowConfig.WorkflowConfigIndicatorPrioritization` | object | Optional | Parameter for Update Workflow | | `workflowConfig.workflowSource` | object | Optional | Parameter for Update Workflow | | `workflowConfig.workflowDestination` | object | Optional | Parameter for Update Workflow | | `workflowConfig.observableTypes` | array | Optional | Type of the resource | | `workflowConfig.priorityScores` | array | Optional | Parameter for Update Workflow | | `safelistGuids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"name":"string_value","workflowConfig":{"type":"string_value","WorkflowConfigIndicatorPrioritization":{},"workflowSource":{},"workflowDestination":{},"observableTypes":["string_value_1"],"priorityScores":["string_value_2"]},"safelistGuids":["string_value_3"]},"path_parameters":{"id":"The unique guid for the workflow"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | --------------------------------------------------------- | | `response` | object | Output field: response | | `response.guid` | string | Unique identifier | | `response.name` | string | Name of the resource | | `response.created` | number | Output field: response.created | | `response.updated` | number | Output field: response.updated | | `response.workflowConfig` | object | Output field: response.workflowConfig | | `response.workflowConfig.type` | string | Type of the resource | | `response.workflowConfig.workflowSource` | object | Output field: response.workflowConfig.workflowSource | | `response.workflowConfig.workflowDestination` | object | Output field: response.workflowConfig.workflowDestination | | `response.safelistGuids` | array | Unique identifier | ### Output Example `{"response":{"guid":"string","name":"string","created":0,"updated":0,"workflowConfig":{"type":"INDICATOR_PRIORITIZATION","workflowSource":{},"workflowDestination":{}},"safelistGuids":["string"]}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |