> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ThreatFox

> Reference for the Tracecat ThreatFox integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Get IOC

Action ID: `tools.threatfox.get_ioc`

Get a ThreatFox indicator by IOC ID. Calls POST /api/v1/ directly with query ioc.

Reference: [https://threatfox.abuse.ch/api/#query-id](https://threatfox.abuse.ch/api/#query-id)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="ioc_id" type="string" required>
  ThreatFox IOC ID.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

## List IOC types

Action ID: `tools.threatfox.list_ioc_types`

List IOC and threat-type combinations. Calls POST /api/v1/ directly with query types.

Reference: [https://threatfox.abuse.ch/api/#types](https://threatfox.abuse.ch/api/#types)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

## List malware families

Action ID: `tools.threatfox.list_malware_families`

List malware families. Calls POST /api/v1/ directly with query malware\_list.

Reference: [https://threatfox.abuse.ch/api/#malware-list](https://threatfox.abuse.ch/api/#malware-list)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

## List recent IOCs

Action ID: `tools.threatfox.list_recent_iocs`

List recent ThreatFox indicators. Calls POST /api/v1/ directly with query get\_iocs.

Reference: [https://threatfox.abuse.ch/api/#recent-iocs](https://threatfox.abuse.ch/api/#recent-iocs)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

<ParamField path="days" type="integer | null">
  Number of days to filter IOCs by first\_seen. ThreatFox allows 1 through 7 and defaults to 3.

  Default: `3`.
</ParamField>

## List tags

Action ID: `tools.threatfox.list_tags`

List tags. Calls POST /api/v1/ directly with query tag\_list.

Reference: [https://threatfox.abuse.ch/api/#tag-list](https://threatfox.abuse.ch/api/#tag-list)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

## Lookup IOC

Action ID: `tools.threatfox.lookup_ioc`

Look up an indicator. Calls POST /api/v1/ directly with query search\_ioc.

Reference: [https://threatfox.abuse.ch/api/#search-ioc](https://threatfox.abuse.ch/api/#search-ioc)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="ioc" type="string" required>
  IOC value to search, such as a URL, domain, IP, IP:port, or hash.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

<ParamField path="exact_match" type="boolean | null">
  Search for the exact IOC instead of a wildcard search. Default: false (wildcard search).

  Default: `null`.
</ParamField>

## Query malware family

Action ID: `tools.threatfox.query_malware_family`

Query indicators by malware family. Calls POST /api/v1/ directly with query malwareinfo.

Reference: [https://threatfox.abuse.ch/api/#malware](https://threatfox.abuse.ch/api/#malware)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="malware" type="string" required>
  ThreatFox malware family or Malpedia family name.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of results. ThreatFox defaults to 100 and allows up to 1000.

  Default: `100`.
</ParamField>

## Query tag

Action ID: `tools.threatfox.query_tag`

Query indicators by tag. Calls POST /api/v1/ directly with query taginfo.

Reference: [https://threatfox.abuse.ch/api/#taginfo](https://threatfox.abuse.ch/api/#taginfo)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="tag" type="string" required>
  ThreatFox tag to query.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of results. ThreatFox defaults to 100 and allows up to 1000.

  Default: `100`.
</ParamField>

## Search file hash

Action ID: `tools.threatfox.search_file_hash`

Search indicators by file hash. Calls POST /api/v1/ directly with query search\_hash.

Reference: [https://threatfox.abuse.ch/api/#search-by-hash](https://threatfox.abuse.ch/api/#search-by-hash)

### Secrets

Required secrets:

* `abusech`: required values `ABUSECH_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>
  MD5 or SHA256 file hash.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the ThreatFox API.

  Default: `null`.
</ParamField>