Page tree

Contents

GET /api/services/intel/lookup/targets

Returns a list of indicator types.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/targets

Response:

[
"ip",
"host",
"url",
"hash",
"email"
]

GET /api/services/intel/lookup/sources

Returns a list of Dossier sources.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/sources

Response:

{
 "alexa": true,
 "atp": true,
 "atp_ps": false,
 "dns": true,
 "gcs": true,
 "geo": true,
 "gsb": true,
 "isight": true,
 "malware_analysis": true,
 "pdns": true,
 "ptr": true,
 "rlabs": true,
 "rwhois": true,
 "whois": true
} 

GET /api/services/intel/lookup/sources/target/{target_type}

Returns sources that support queries for an indicator type.

Ex: curl –u :”https://api.activetrust.net:8000/api/services/intel/lookup/sources/target/ip

Response:

{
"atp": true, 
"atp_ps": true, 
"gcs": true,
"geo": true,
"gsb": true, 
"isight": true,
"malware_analysis": true, 
"pdns": true,
"ptr": true,
"whois": true
}

GET /api/services/intel/lookup/source/{source}/targets

Returns a list of indicator types supported by a given source. Ex: curl –u <api_key>:

https://api.activetrust.net:8000/api/services/intel/lookup/source/atp/targets

Response:

[
“ip”,
“host”,
“url”
]

GET /api/services/intel/lookup/indicator/{target_type}

Required parameters:

Value: indicator to search for, Source: source to search.

Optional parameters:

Wait: whether to wait for the lookup to complete – true or false [defaults to false] Start a new Dossier lookup job for a specified indicator and source(s).

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/indicator/host?value=google.com&sour ce=alexa&source=dns&wait=false”

Response:

{
 "status": "pending",
 "job_id": "aef7e05a-42c6-45f2-9be4-02139caf31a4", "job": {
  "id": "aef7e05a-42c6-45f2-9be4-02139caf31a4", "state": "created",
  "status": "pending", "create_ts": 1501802999664,
  "create_time": "2017-08-03T23:29:59.664186262Z",
  "pending_tasks": [
   "8e4d8ac5-9772-42f6-8644-0a23fb509870", 
"6c19c40f-c5c6-4d89-b099-e92b036e92d5" ], "org": "org", "user": "user@test.com" }, "tasks": { "6c19c40f-c5c6-4d89-b099-e92b036e92d5": {
"id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5", "state": "created", "status": "pending",
"create_ts": 1501802999664, "create_time": "2017-08-03T23:29:59.664186262Z", "params": {
"type": "host", "target": "google.com", "source": "dns" } }, "8e4d8ac5-9772-42f6-8644-0a23fb509870": { <status> } } }

GET /api/services/intel/lookup/jobs/{job_id}

Returns status of a Dossier lookup job.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/jobs/aef7e05a- 42c6-45f2-9be4-02139caf31a4”

Response:

{
 "status": "success",
 "job_id": "aef7e05a-42c6-45f2-9be4-02139caf31a4", 
"job": { "id": "aef7e05a-42c6-45f2-9be4-02139caf31a4",
"state": "completed", "status": "success",
"create_ts": 1501802999664, "create_time": "2017-08-03T23:29:59.664Z", "completed_tasks": [ "8e4d8ac5-9772-42f6-8644-0a23fb509870",
"6c19c40f-c5c6-4d89-b099-e92b036e92d5" ], "org": "org", "user": "user@test.com" }, "tasks": { "6c19c40f-c5c6-4d89-b099-e92b036e92d5": {
"id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5", "state": "completed",
"status": "success",
"create_ts": 1501802999664, "create_time": "2017-08-03T23:29:59.664Z", "start_ts": 1501802999908, "start_time": "2017-08-03T23:29:59.908Z", "end_ts": 1501802999960, "end_time": "2017-08-03T23:29:59.96Z", "params": { "type": "host", "target": "google.com", "source": "dns" } }, "8e4d8ac5-9772-42f6-8644-0a23fb509870": { <status> } } }
}

GET /api/services/intel/lookup/jobs/{job_id}/results

Returns results of a Dossier lookup job.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/jobs/aef7e05a- 42c6-45f2-9be4-02139caf31a4/results”

Response:

  {
   "state": "completed", 
"status": "success", "job_id": "aef7e05a-42c6-45f2-9be4-02139caf31a4",
"results": [ { "task_id": "8e4d8ac5-9772-42f6-8644-0a23fb509870", "params": { "type": "host", "target": "google.com", "source": "alexa" }, "v": "2.0.1", "status": "success",
"data": { <data> } }, { "task_id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5",
"params": { "type": "host", "target": "google.com", "source": "dns" }, "v": "2.0.0", "status": "success",
"time": 25, "data": { <data> } }
]
}

 

GET /api/services/intel/lookup/jobs/{job_id}/tasks/{task_id}

Returns status of a single task in a Dossier lookup job.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/jobs/aef7e05a- 42c6-45f2-9be4-02139caf31a4/tasks/6c19c40f-c5c6-4d89-b099-e92b036e92d5”

Response:

{
"state": "completed", "status": "success", "task": {
"id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5",
"state": "completed", "status": "success", "create_ts": 1501802999664,
"create_time": "2017-08-03T23:29:59.664Z",
"start_ts": 1501802999908,
"start_time": "2017-08-03T23:29:59.908Z", "end_ts": 1501802999960,
"end_time": "2017-08-03T23:29:59.96Z",
"params": { "type": "host",
"target": "google.com",
"source": "dns"
}
}
}

GET /api/services/intel/lookup/jobs/{job_id}/tasks/{task_id}/results

Returns results of a single task in a Dossier lookup job.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/jobs/aef7e05a- 42c6-45f2-9be4-02139caf31a4/tasks/6c19c40f-c5c6-4d89-b099-e92b036e92d5/results”

Response:

{
 "state": "completed", 
"status": "success",
"task": {
"id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5",
"state": "completed",
"status": "success",
"create_ts": 1501802999664,
"create_time": "2017-08-03T23:29:59.664Z",
"start_ts": 1501802999908,
"start_time": "2017-08-03T23:29:59.908Z",
"end_ts": 1501802999960,
"end_time": "2017-08-03T23:29:59.96Z",
"params": {
"type": "host",
"target": "google.com",
"source": "dns"
}
}
}

GET /api/services/intel/lookup/jobs/{job_id}/tasks/{task_id}/results

Returns results of a single task in a Dossier lookup job.

Ex: curl –u <api_key>: “https://api.activetrust.net:8000/api/services/intel/lookup/jobs/aef7e05a- 42c6-45f2-9be4-02139caf31a4/tasks/6c19c40f-c5c6-4d89-b099-e92b036e92d5/results”

Response:

 {
  "state": "completed", 
"status": "success",
"results": { "task_id": "6c19c40f-c5c6-4d89-b099-e92b036e92d5",
"params": { "type": "host", "target": "google.com", "source": "dns" }, "v": "2.0.0", "status": "success", "time": 25, "data": { <data> } } }

POST /api/services/intel/lookup/jobs

Optional: "wait" boolean parameter (ie /api/services/intel/lookup/jobs?wait=true)

The "list" call is essentially able to create many dossier calls in a single API call. All the target/source pairs will receive a unique task ID, but they will all fall under a single job ID.

 Ex: curl -u <api_key> -x POST "https://api.activetrust.net:8000/api/services/intel/lookup/jobs- d


'{
  "target":
  {
    "list":
    [
    { "type": "host",
      "target": "google.com",
      "sources":["dns", "alexa"]
    },
    { "type": "host",
      "target": "facebook.com",
      "sources":["alexa"]
    }
    ]
  }
}'


Response:

{
  "status": "pending",
  "job_id": "f910c608-f82f-4942-8cd1-c38f8f2e71ae",
  "job": {
    "id": "f910c608-f82f-4942-8cd1-c38f8f2e71ae",
    "state": "created",
    "status": "pending",
    "create_ts": 1549494579199,
    "create_time": "2019-02-06T23:09:39.199492581Z",
    "start_ts": 1549494579199,
    "start_time": "2019-02-06T23:09:39.199492581Z",
    "request_ttl": 0,
    "result_ttl": 3600,
    "pending_tasks": [
      "b8cfcfee-37e2-44df-9bc1-cd8cfe261ac7",
      "4af000e6-4b32-439d-8aa5-a0f39c924c4b",
      "71c90b83-8056-4e8d-979b-dfafc9ff4441"
    ],
    "org": "org",
    "user": "user@test.com",
    "tasks_tbc": 0
  },
  "tasks": {
    "4af000e6-4b32-439d-8aa5-a0f39c924c4b": {
      "id": "4af000e6-4b32-439d-8aa5-a0f39c924c4b",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494579199,
      "create_time": "2019-02-06T23:09:39.199492581Z",
      "params": {
        "type": "host",
        "target": "google.com",
        "source": "alexa"
      },
      "results": null
    },
    "71c90b83-8056-4e8d-979b-dfafc9ff4441": {
      "id": "71c90b83-8056-4e8d-979b-dfafc9ff4441",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494579199,
      "create_time": "2019-02-06T23:09:39.199492581Z",
      "params": {
        "type": "host",
        "target": "facebook.com",
        "source": "alexa"
      },
      "results": null
    },
    "b8cfcfee-37e2-44df-9bc1-cd8cfe261ac7": {
      "id": "b8cfcfee-37e2-44df-9bc1-cd8cfe261ac7",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494579199,
      "create_time": "2019-02-06T23:09:39.199492581Z",
      "params": {
        "type": "host",
        "target": "google.com",
        "source": "dns"
      },
      "results": null
    }
  }
}

POST /api/services/intel/lookup/jobs

Optional:  "wait" boolean parameter (ie /api/services/intel/lookup/jobs?wait=true)

The "group" call is used to specify an array of targets in a single API call with a single source list. Each target/source pair will receive its own task ID (the same as how a single target with many sources will create a list of tasks) but it will still fall under a single job ID.

 Ex: curl -u <api_key> -x POST "https://api.activetrust.net:8000/api/services/intel/lookup/jobs -d

'{
  "target":
  { "group":
    { "type": "host",
      "targets": [
        "youtube.com",
        "reddit.com"
      ],
      "sources":["alexa", "dns"]
    }
  }
}'


Response:

{
  "status": "pending",
  "job_id": "98333283-db35-4e3d-b1d3-a5f389afdca2",
  "job": {
    "id": "98333283-db35-4e3d-b1d3-a5f389afdca2",
    "state": "created",
    "status": "pending",
    "create_ts": 1549494557426,
    "create_time": "2019-02-06T23:09:17.426577405Z",
    "start_ts": 1549494557426,
    "start_time": "2019-02-06T23:09:17.426577405Z",
    "request_ttl": 0,
    "result_ttl": 3600,
    "pending_tasks": [
      "41e2207e-8965-4e8f-9489-b318f2cdbc89",
      "b062fa5d-8b90-4b6e-bb85-d6dd14c64a3a",
      "9ed07d83-e929-4088-97e5-91d2c6e9cd0c",
      "866e95e6-f0a9-4bf7-8740-868c13ae7b6a"
    ],
    "org": "org",
    "user": "user@test.com",
    "tasks_tbc": 0
  },
  "tasks": {
    "41e2207e-8965-4e8f-9489-b318f2cdbc89": {
      "id": "41e2207e-8965-4e8f-9489-b318f2cdbc89",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494557426,
      "create_time": "2019-02-06T23:09:17.426577405Z",
      "params": {
        "type": "host",
        "target": "youtube.com",
        "source": "alexa"
      },
      "results": null
    },
    "866e95e6-f0a9-4bf7-8740-868c13ae7b6a": {
      "id": "866e95e6-f0a9-4bf7-8740-868c13ae7b6a",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494557426,
      "create_time": "2019-02-06T23:09:17.426577405Z",
      "params": {
        "type": "host",
        "target": "reddit.com",
        "source": "gcs"
      },
      "results": null
    },
    "9ed07d83-e929-4088-97e5-91d2c6e9cd0c": {
      "id": "9ed07d83-e929-4088-97e5-91d2c6e9cd0c",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494557426,
      "create_time": "2019-02-06T23:09:17.426577405Z",
      "params": {
        "type": "host",
        "target": "reddit.com",
        "source": "alexa"
      },
      "results": null
    },
    "b062fa5d-8b90-4b6e-bb85-d6dd14c64a3a": {
      "id": "b062fa5d-8b90-4b6e-bb85-d6dd14c64a3a",
      "state": "created",
      "status": "pending",
      "create_ts": 1549494557426,
      "create_time": "2019-02-06T23:09:17.426577405Z",
      "params": {
        "type": "host",
        "target": "youtube.com",
        "source": "gcs"
      },
      "results": null
    }
  }
}



  • No labels

This page has no comments.