--- title: Zerofox slug: connectors/zerofox docTags: createdAt: 2026-06-09T16:29:40.525Z --- ZeroFox is a digital risk protection platform that safeguards organizations from threats across social media and digital channels. ZeroFox is a leading digital risk protection platform that provides comprehensive threat detection and response across social media and digital channels. The ZeroFox connector for Swimlane Turbine enables users to automate the retrieval of real-time alerts, submit suspected phishing domains, and take automated actions on detected threats. By integrating ZeroFox with Swimlane Turbine, security teams can enhance their digital risk protection strategies, streamline threat response processes, and improve overall security posture with minimal manual intervention. ## Prerequisites Before you can use the ZeroFox connector for Turbine, you'll need access to the ZeroFox API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint for accessing ZeroFox services. - API Token: A unique token provided by ZeroFox for authenticating API requests. ## Capabilities The ZeroFox Connector has the following capabilities: - Get Alerts - Take Action on Alerts - Submit Phishing Domain ## API Documentation Link - [ZeroFox API Documentation Link](https://api.zerofox.com/1.0/docs/) ## Additional Documentation - [Zerofox Connector Documentation](https://docs.swimlane.com/connectors/zerofox) - [Zerofox API Documentation](https://api.zerofox.com/) - [Zerofox Authentication Guide](https://docs.swimlane.com/authentication-guides/zerofox) # Configurations ## ZeroFox API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api\_token | API Token | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Alerts Retrieve real-time notifications and alerts for potential threats and malicious activities detected across social media and digital channels. ### Endpoint - **URL:** `/1.0/alerts/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------- | | `parameters.account` | string | Optional | Social network account number (unique ID). | | `parameters.alert_type` | string | Optional | CSV of alert types. | | `parameters.assignee` | string | Optional | Name of user assigned to alert. | | `parameters.entity` | number | Optional | ZeroFox entity ID. | | `parameters.entity_term` | number | Optional | ZeroFox entity term ID. | | `parameters.last_modified` | number | Optional | Number of seconds since an alert has changed. | | `parameters.last_modified_min_date` | string | Optional | SO-8601 date-time string that filters out alerts with a last\_modified time before the given time. | | `parameters.last_modified_max_date` | string | Optional | ISO-8601 date-time string that filters out alerts with a last\_modified time after the given time. | | `parameters.limit` | number | Optional | Maximum number of alerts to retrieve (0 - 100). | | `parameters.max_timestamp` | string | Optional | ISO-8601 date-time string to filter for alerts before. | | `parameters.min_timestamp` | string | Optional | ISO-8601 date-time string to filter for alerts after. | | `parameters.network` | string | Optional | Network name csv. | | `parameters.offset` | number | Optional | Used for pagination. Start response with n-th alert matching filters. | | `parameters.page_id` | number | Optional | ZeroFox page ID CSV. | | `parameters.page_url` | string | Optional | URL to Web/Social Web content. | | `parameters.pages` | string | Optional | Encoded JSON array of strings to filter by alerts. | | `parameters.post` | string | Optional | Social network post number (unique ID). | | `parameters.rule_id` | number | Optional | ZeroFox rule ID CSV. | | `parameters.rule_name` | string | Optional | ZeroFox name CSV | | `parameters.entity_search` | string | Optional | Substring matching for the protected entity. | | `parameters.perpetrator_search` | string | Optional | Substring to filter alerts by perpetrator username or display name. | | `parameters.pro_social_obj_search` | string | Optional | Substring to filter alerts by protected social object username, display name, or entity term name. | | `parameters.alert_id` | string | Optional | CSV of alert IDs. | | `parameters.severity` | number | Optional | Severity level of alert. 1 - 5 (Critical). | | `parameters.sort_direction` | string | Optional | Sort results in ascending (asc) or descending (desc) order. | ### Input Example `{"parameters":{"account":"","alert_type":"search_query","assignee":"","entity":123,"entity_term":124,"last_modified":345,"last_modified_min_date":"2021-10-01+00%3A00%3A00","last_modified_max_date":"2022-10-01+00%3A00%3A00","limit":50,"max_timestamp":"2021-11-01+00%3A00%3A00","min_timestamp":"2021-11-01+00%3A00%3A00","network":"","offset":768,"page_id":23455,"page_url":"","pages":"","post":"","rule_id":3214,"rule_name":"","entity_search":"","perpetrator_search":"","pro_social_obj_search":"","alert_id":"","severity":3,"sort_direction":"asc","sort_field":"severity","status":"closed","escalated":"true","tags":"","entity_type":7895}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | object | Output field: next | | `previous` | object | Output field: previous | | `page_size` | number | Output field: page\_size | | `num_pages` | number | Output field: num\_pages | | `alerts` | array | Output field: alerts | | `alerts.file_name` | string | Name of the resource | | `alerts.file` | string | Output field: alerts.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 01 Jul 2024 10:09:54 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","allow":"GET, POST, HEAD, OPTIONS","content-language":"en-us","referrer-policy":"same-origin","vary":"Accept, Accept-Language, Origin","x-content-type-options":"nosniff","x-frame-options":"DENY","x-xss-protection":"1; mode=block, 1; mode=block","CF-Cache-Status":"DYNAMIC","Strict-Transport-Security":"max-age=15552000; includeSubDo...` ## Submit Phishing Domain Submit a suspected phishing domain to ZeroFox with details such as source, alert type, violation, and entity ID. ### Endpoint - **URL:** `/2.0/threat_submit/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | `source` | string | Optional | The source of the alert, its value depends on the value of the alert\_type field, so it could be an URL, a phone number, a domain, an email, etc. | | `alert_type` | string | Optional | Alert typing. | | `violation` | string | Optional | Threat posed by user. | | `entity_id` | number | Optional | Entity ID for which the URL is associated with. | | `notes` | string | Optional | Notes made on the alert. | | `request_takedown` | boolean | Optional | Whether or not the content should be requested for automatic takedown after alerting. | ### Input Example `{"json_body":{"source":"test.mytestdomain.com","alert_type":"domain","violation":"trademark","entity_id":560628,"notes":"some notes","request_takedown":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alert_id` | number | Unique identifier | ### Output Example `{"status_code":201,"response_headers":{"Date":"Fri, 10 May 2024 12:43:09 GMT","Content-Type":"application/json","Content-Length":"22","Connection":"keep-alive","allow":"POST, OPTIONS","content-language":"en-us","referrer-policy":"same-origin","vary":"Accept, Accept-Language, Origin","x-content-type-options":"nosniff","x-frame-options":"DENY","x-xss-protection":"1; mode=block, 1; mode=block","CF-Cache-Status":"DYNAMIC","Strict-Transport-Security":"max-age=15552000; includeSubDomains","Server":"cl...` ## Take Action on Alerts Automates responses and remediation for threats detected on social media and digital channels using alert ID and action parameters. ### Endpoint - **URL:** `/1.0/alerts/{{alert_id}}/{{action}}/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------- | | `path_parameters.alert_id` | number | Required | The ZeroFox alert ID. | | `path_parameters.action` | string | Required | Action to take on the alert. | ### Input Example `{"path_parameters":{"alert_id":1234,"action":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | -------------------------------------------------------- | ----------------------------------- | | allow | HTTP response header: allow | GET, POST, HEAD, OPTIONS | | CF-Cache-Status | HTTP response header: CF-Cache-Status | DYNAMIC | | CF-RAY | HTTP response header: CF-RAY | 881a035dbc364ae1-HYD | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | content-language | HTTP response header: content-language | en-us | | content-length | The length of the response body in bytes | 140 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 01 Jul 2024 10:09:54 GMT | | referrer-policy | HTTP response header: referrer-policy | same-origin | | Server | Information about the software used by the origin server | cloudflare | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15552000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Accept, Accept-Language, Origin | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-frame-options | HTTP response header: x-frame-options | DENY | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block, 1; mode=block |