Skip to main content

​
Get IOC

Action ID: tools.threatfox.get_ioc Get a ThreatFox indicator by IOC ID. Calls POST /api/v1/ directly with query ioc. Reference: https://threatfox.abuse.ch/api/#query-id

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string
required
ThreatFox IOC ID.
​
string | null
Base URL of the ThreatFox API.Default: null.

​
List IOC types

Action ID: tools.threatfox.list_ioc_types List IOC and threat-type combinations. Calls POST /api/v1/ directly with query types. Reference: https://threatfox.abuse.ch/api/#types

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string | null
Base URL of the ThreatFox API.Default: null.

​
List malware families

Action ID: tools.threatfox.list_malware_families List malware families. Calls POST /api/v1/ directly with query malware_list. Reference: https://threatfox.abuse.ch/api/#malware-list

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string | null
Base URL of the ThreatFox API.Default: null.

​
List recent IOCs

Action ID: tools.threatfox.list_recent_iocs List recent ThreatFox indicators. Calls POST /api/v1/ directly with query get_iocs. Reference: https://threatfox.abuse.ch/api/#recent-iocs

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string | null
Base URL of the ThreatFox API.Default: null.
​
integer | null
Number of days to filter IOCs by first_seen. ThreatFox allows 1 through 7 and defaults to 3.Default: 3.

​
List tags

Action ID: tools.threatfox.list_tags List tags. Calls POST /api/v1/ directly with query tag_list. Reference: https://threatfox.abuse.ch/api/#tag-list

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string | null
Base URL of the ThreatFox API.Default: null.

​
Lookup IOC

Action ID: tools.threatfox.lookup_ioc Look up an indicator. Calls POST /api/v1/ directly with query search_ioc. Reference: https://threatfox.abuse.ch/api/#search-ioc

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string
required
IOC value to search, such as a URL, domain, IP, IP:port, or hash.
​
string | null
Base URL of the ThreatFox API.Default: null.
​
boolean | null
Search for the exact IOC instead of a wildcard search. Default: false (wildcard search).Default: null.

​
Query malware family

Action ID: tools.threatfox.query_malware_family Query indicators by malware family. Calls POST /api/v1/ directly with query malwareinfo. Reference: https://threatfox.abuse.ch/api/#malware

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string
required
ThreatFox malware family or Malpedia family name.
​
string | null
Base URL of the ThreatFox API.Default: null.
​
integer | null
Maximum number of results. ThreatFox defaults to 100 and allows up to 1000.Default: 100.

​
Query tag

Action ID: tools.threatfox.query_tag Query indicators by tag. Calls POST /api/v1/ directly with query taginfo. Reference: https://threatfox.abuse.ch/api/#taginfo

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string
required
ThreatFox tag to query.
​
string | null
Base URL of the ThreatFox API.Default: null.
​
integer | null
Maximum number of results. ThreatFox defaults to 100 and allows up to 1000.Default: 100.

​
Search file hash

Action ID: tools.threatfox.search_file_hash Search indicators by file hash. Calls POST /api/v1/ directly with query search_hash. Reference: https://threatfox.abuse.ch/api/#search-by-hash

​
Secrets

Required secrets:
  • abusech: required values ABUSECH_API_KEY.

​
Input fields

​
string
required
MD5 or SHA256 file hash.
​
string | null
Base URL of the ThreatFox API.Default: null.