Swimlane Utilities

Swimlane Utilities provides a set of core tools for file analysis, data extraction, and network diagnostics to support security automation workflows.

Swimlane Utilities is a collection of essential tools designed to streamline and enhance security automation workflows within the Swimlane Turbine platform. This connector provides core utility functions such as file decryption, hash generation, MIME type identification, IOC extraction, DNS lookups, and barcode/QR code data extraction. By integrating these capabilities, security teams can automate routine data processing, accelerate threat analysis, and enrich playbooks without writing code. The Swimlane Utilities connector empowers users to efficiently handle diverse data types, improve detection accuracy, and reduce manual effort in security operations.

Capabilities

The Swimlane Util connector has the following capabilities:

Decrypt Files

IOC Parser: Parse IOCs from a Text Field or a List of IOC(s)

Perform NSLookup

Get Mime Type

Hash Files and Strings

Extract QR/Barcodes from HTML content

IOC Parse/Typer:

If you find edge case IOCs that you don't want the IOC Parser to return, add a Whitelist Regex input to exclude them.

Domains will only be found if they are in a URL or use a public suffix found in this list.

Actions

Decrypt File

Decrypt a PDF, ZIP, or MS Office file from attachments to enable secure content analysis.

Input

Argument Name	Type	Required	Description
attachments	object	Required	File to be uploaded
attachments.file	string	Required	Parameter for Decrypt File
attachments.file_name	string	Required	Name of the resource
password	string	Optional	Parameter for Decrypt File

Input Example

{"attachments":{"file":"string","file_name":"Example Name"},"password":"string"}

Output

Parameter	Type	Description
file	array	Output field: file

Output Example

{"file":{"filename":"Example Name","file":"string"}}

Extract QR and Barcode Data

Analyze HTML content to extract and return data from embedded QR codes and barcodes using the provided html_body input.

Input

Argument Name	Type	Required	Description
html_body	string	Required	Request body data

Input Example

{"html_body":"<html><body>hi swimlane</body></html>"}

Output

Parameter	Type	Description
result	array	Result of the operation

Output Example

{"result":[]}

Get MIME Type

Identify the MIME type of a provided file to ensure accurate content handling and processing within Swimlane Utilities.

Input

Argument Name	Type	Required	Description
file	object	Required	File to be uploaded
file.file	string	Required	Parameter for Get MIME Type
file.file_name	string	Required	Name of the resource

Input Example

{"file":{"file":"string","file_name":"Example Name"}}

Output

Parameter	Type	Description
mime_type	string	Type of the resource
description	string	Description

Output Example

{"mime_type":"string","description":"string"}

Hash Files and Strings

Generate MD5, SHA1, and SHA256 hashes for provided files or strings using Swimlane Utilities.

Input

Argument Name	Type	Required	Description
attachments	array	Required	File to be uploaded
attachments.file	string	Optional	Parameter for Hash Files and Strings
attachments.file_name	string	Optional	Name of the resource
attachments.description	string	Optional	Parameter for Hash Files and Strings

Input Example

{"attachments":[{"file":"string","file_name":"Example Name","description":"string"}]}

IOC Parser

Extract Indicators of Compromise (IOCs) from text or CSV files for streamlined analysis using Swimlane Utilities.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
parameters.http_proxy	string	Optional	The HTTP proxy to use for the request.
parameters.rtf_body	string	Optional	Parameters for the IOC Parser action
parameters.text_body	string	Optional	Parameters for the IOC Parser action
parameters.html_body	string	Optional	Parameters for the IOC Parser action
parameters.other	string	Optional	Parameters for the IOC Parser action
parameters.body_regex	string	Optional	Parameters for the IOC Parser action
parameters.whitelist_regex	string	Optional	Parameters for the IOC Parser action
parameters.defang	boolean	Optional	Parameters for the IOC Parser action
parameters.to_lower	boolean	Optional	Parameters for the IOC Parser action
parameters.list_iocs	array	Optional	Parameters for the IOC Parser action
parameters.iocs_to_parse	array	Optional	Parameters for the IOC Parser action
parameters.whitelist_domains	string	Optional	Parameters for the IOC Parser action
parameters.whitelist_ip_cidr_ranges	string	Optional	Parameters for the IOC Parser action
parameters.additional_file_extensions	string	Optional	Additional file extensions which needs to be parsed in addition to existing common file extensions which are being detected.
parameters.use_ml_model	boolean	Optional	Parameters for the IOC Parser action

Input Example

{"parameters":{"rtf_body":"{\rtf\\ansi\\deff0{\fonttbl{\f0\froman Tms Rmn;}{\f1\fdecor Symbol;}{\f2\fswiss Helv;}}{\\colortbl;\red0\\green0\blue0; \red0\\green0\blue255;\red0\\green255\blue255;\red0\\green255\\ blue0;\red255\\green0\blue255;\red255\\green0\blue0;\red255\\ green255\blue0;\red255\\green255\blue255;}{\\stylesheet{\fs20 \\snext0Normal;}}{\\info{\\author John Doe} {\\creatim\\yr1990\\mo7\\dy30\\hr10\\min48}{\\version1}{\\edmins0} {\nofpages1}{\nofwords0}{\nofchars0}{\\vern8351}}\\widoctrl\ftnbj \\sectd\\linex0\\endnhere \\pard\\plain \fs20 www.swimlane.com .\\par}","text_body":"http://115.61.111.229:33690/Moxi.m\nhttps://115.61.111.329:33690/Moxi.m","html_body":"<html><body>[email protected]</body></html>","other":"09:30Z 10.0.0.0, 4444:5555:6666:7777:8888. 2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF. 2001:0db8:85a3:0000:0000:8a2e:0370:7334 2345:0425:2CA1:0000:0000:0567:5673:23b5 0cc175b9c0f1b6a831c399e269772661 86f7e437faa5a7fce15d1ddcb9eaeaea377667b8 ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb filename.png 987:/path/to/file:another/path","body_regex":".","whitelist_regex":"","defang":true,"to_lower":false,"list_iocs":["ipv4_private","ipv4_public","ipv6_public","ipv6_private","filename","sha256","sha1","md5","email","domain","url","ssdeep","unknown"],"iocs_to_parse":["ipv4_private","ipv4_public","ipv6_public","ipv6_private","filename","sha256","sha1","md5","email","domain","url","ssdeep","unknown"],"whitelist_domains":"","whitelist_ip_cidr_ranges":""}}

Output

Parameter	Type	Description
ipv4_private	array	Output field: ipv4_private
ipv4_public	array	Output field: ipv4_public
ipv6_public	array	Output field: ipv6_public
ipv6_private	array	Output field: ipv6_private
filename	array	Name of the resource
sha256	array	Output field: sha256
sha1	array	Output field: sha1
md5	array	Output field: md5
email	array	Output field: email
domain	array	Output field: domain
subdomain	array	Output field: subdomain
root_domain	array	Output field: root_domain
ssdeep	array	Output field: ssdeep
body_regex_results	string	Request body data
url	array	URL endpoint for the request
unknown	array	Output field: unknown

Output Example

{"ipv4_private":["10[.]0[.]0[.]0"],"ipv4_public":["115[.]61[.]111[.]229"],"ipv6_public":["2345:0425:2CA1:0000:0000:0567:5673:23b5"],"ipv6_private":["2001:0db8:85a3:0000:0000:8a2e:0370:7334","2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF"],"filename":["filename.png"],"sha256":["ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"],"sha1":["86f7e437faa5a7fce15d1ddcb9eaeaea377667b8"],"md5":["0cc175b9c0f1b6a831c399e269772661"],"email":["[email protected]"],"domain":["swimlane[.]com"],"...

NSLookup

Perform a DNS lookup to retrieve IP address mappings and related DNS records for domain analysis.

Input

Argument Name	Type	Required	Description
domain	string	Optional	Parameter for NSLookup

Input Example

{"domain":"example.com"}

Output

Parameter	Type	Description
Name	string	Name of the resource
Addresses	array	Output field: Addresses

Output Example

{"Name":"example.com","Addresses":["93.184.216.34"]}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT