Intel

intel

Intel

ASN

intel.asn

Methods

Get ASN Overview -> Envelope<

ASN

get/accounts/{account_id}/intel/asn/{asn}

Gets an overview of the Autonomous System Number (ASN) and a list of subnets for it.

Intel ASN

Subnets

intel.asn.subnets

Methods

Get ASN Subnets -> { asn, count, ip_count_total, 3 more... }

get/accounts/{account_id}/intel/asn/{asn}/subnets

Get ASN Subnets.

Intel

Attack Surface Report

intel.attack_surface_report

Intel Attack Surface Report

Issue Types

intel.attack_surface_report.issue_types

Methods

Retrieves Security Center Issues Types -> SinglePage<string>

get/accounts/{account_id}/intel/attack-surface-report/issue-types

Lists all available issue types in Security Center, describing categories of security issues.

Intel Attack Surface Report

Issues

intel.attack_surface_report.issues

Methods

Retrieves Security Center Issues -> V4PagePagination<{ count, issues, page, 1 more... }>

Deprecated

get/accounts/{account_id}/intel/attack-surface-report/issues

Lists all Security Center issues for the account, showing active security problems requiring attention.

Retrieves Security Center Issue Counts By Class -> Envelope<Array<{ count, value }>>

Deprecated

get/accounts/{account_id}/intel/attack-surface-report/issues/class

Retrieves Security Center issue counts aggregated by classification class.

Retrieves Security Center Issue Counts By Severity -> Envelope<Array<{ count, value }>>

Deprecated

get/accounts/{account_id}/intel/attack-surface-report/issues/severity

Retrieves Security Center issue counts aggregated by severity level.

Retrieves Security Center Issue Counts By Type -> Envelope<Array<{ count, value }>>

Deprecated

get/accounts/{account_id}/intel/attack-surface-report/issues/type

Retrieves Security Center issue counts aggregated by issue type.

Archives Security Center Insight -> { errors, messages, success }

Deprecated

put/accounts/{account_id}/intel/attack-surface-report/{issue_id}/dismiss

Deprecated endpoint for archiving Security Center insights. Use the newer archive-security-center-insight endpoint instead.

Domain types

IssueType = "compliance_violation" | "email_security" | "exposed_infrastructure" | 3 more...

SeverityQueryParam = "low" | "moderate" | "critical"

Intel

DNS

intel.dns

Methods

Get Passive DNS By IP -> V4PagePagination<

DNS

get/accounts/{account_id}/intel/dns

Gets a list of all the domains that have resolved to a specific IP address.

Domain types

DNS = { count, page, per_page, 1 more... }

Intel

Domain History

intel.domain_history

Methods

Get Domain History -> Envelope<Array<

DomainHistory

get/accounts/{account_id}/intel/domain-history

Gets historical security threat and content categories currently and previously assigned to a domain.

Domain types

DomainHistory = { categorizations, domain }

Intel

Domains

intel.domains

Methods

Get Domain Details -> Envelope<

Domain

get/accounts/{account_id}/intel/domain

Gets security details and statistics about a domain.

Domain types

Domain = { additional_information, application, content_categories, 8 more... }

Intel Domains

Bulks

intel.domains.bulks

Methods

Get Multiple Domain Details -> Envelope<Array<{ additional_information, application, content_categories, 7 more... }>>

get/accounts/{account_id}/intel/domain/bulk

Same as summary.

Intel

Indicator Feeds

intel.indicator_feeds

Methods

Get Indicator Feeds Owned By This Account -> SinglePage<{ id, created_on, description, 5 more... }>

get/accounts/{account_id}/intel/indicator-feeds

Retrieves details for all accessible custom threat indicator feeds.

Get Indicator Feed Metadata -> Envelope<{ id, created_on, description, 8 more... }>

get/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Retrieves details for a specific custom threat indicator feed.

Create New Indicator Feed -> Envelope<{ id, created_on, description, 5 more... }>

post/accounts/{account_id}/intel/indicator-feeds

Creates a new custom threat indicator feed for sharing threat intelligence data.

Update Indicator Feed Metadata -> Envelope<{ id, created_on, description, 5 more... }>

put/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Revises details for a specific custom threat indicator feed.

Get Indicator Feed Data -> string

get/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data

Retrieves the raw data entries in a custom threat indicator feed.

Intel Indicator Feeds

Downloads

intel.indicator_feeds.downloads

Intel Indicator Feeds

Permissions

intel.indicator_feeds.permissions

Methods

List Indicator Feed Permissions -> Envelope<Array<{ id, description, is_attributable, 3 more... }>>

get/accounts/{account_id}/intel/indicator-feeds/permissions/view

Lists current access permissions for custom threat indicator feeds.

Grant Permission To Indicator Feed -> Envelope<{ success }>

put/accounts/{account_id}/intel/indicator-feeds/permissions/add

Grants access permissions for a custom threat indicator feed to other accounts.

Revoke Permission To Indicator Feed -> Envelope<{ success }>

put/accounts/{account_id}/intel/indicator-feeds/permissions/remove

Revokes access permissions for a custom threat indicator feed.

Intel Indicator Feeds

Snapshots

intel.indicator_feeds.snapshots

Methods

Update Indicator Feed Data -> Envelope<{ file_id, filename, status }>

put/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot

Revises the raw data entries in a custom threat indicator feed.

Intel

IP Lists

intel.ip_lists

Domain types

IPList = { id, description, name }

Intel

IPs

intel.ips

Methods

Get IP Overview -> Envelope<Array<

get/accounts/{account_id}/intel/ip

Gets the geolocation, ASN, infrastructure type of the ASN, and any security threat categories of an IP address. Must provide ip query parameters. For example, /intel/ip?ipv4=1.1.1.1 or /intel/ip?ipv6=2001:db8::1.

Domain types

IP = { belongs_to_ref, ip, risk_types }

Intel

Miscategorizations

intel.miscategorizations

Methods

Create Miscategorization -> { errors, messages, success }

post/accounts/{account_id}/intel/miscategorization

Allows you to submit requests to change a domain’s category.

Intel

Sinkholes

intel.sinkholes

Methods

List Sinkholes Owned By This Account -> SinglePage<

Sinkhole

get/accounts/{account_id}/intel/sinkholes

List sinkholes owned by this account

Domain types

Sinkhole = { id, account_tag, created_on, 4 more... }

Intel

Whois

intel.whois

Methods

Get Whois Record -> Envelope<{ dnssec, domain, extension, 84 more... }>

get/accounts/{account_id}/intel/whois

Get WHOIS Record

Domain types

Whois = { created_date, domain, nameservers, 6 more... }