apivoid v1.0.1

About the connector

apivoid provides several threat intelligence services ranging from IP, URL, and Domain reputation to domain age and website screenshots.

This document provides information about the apivoid connector, which facilitates automated interactions with apivoid using FortiSOAR™ playbooks. Add the apivoid connector as a step in FortiSOAR™ playbooks and perform automated operations, such as retrieving the reputation for specified email ID, IP addresses, domain names, etc, taking high-quality screenshots of the specified website, or retrieving the domain registration date and domain age, in days, for the specified domain.

Version information

Connector Version: 1.0.1

FortiSOAR™ Version Tested on: 7.2.1-1021

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.0.1

Following enhancements have been made to the apivoid Connector in version 1.0.1:

• Added the following pluggable enrichment playbooks that automatically enrich data when you install and configure the apivoid:
  • IP Address > API Void > Enrichment
  • Email Address > API Void > Enrichment
  • URL > API Void > Enrichment
  • Domain > API Void > Enrichment
    For more information, see the Pluggable Enrichment topic.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the following yum command as a root user to install connectors from an SSH session:
yum install cyops-connector-apivoid

Prerequisites to configuring the connector

• You must have the IP address or FQDN of apivoid cloud platform to which you will connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the apivoid server.

Minimum Permissions Required

• Not Applicable

Configuring the connector

For the procedure to configure a connector, click here.

Configuration parameters

In FortiSOAR™, on the Content Hub (or Connector Store) page, click the Manage tab, and then click the apivoid connector card. On the connector popup, click the Configurations tab to enter the required configuration details:

Actions supported by the connector

The following automated operations can be included in playbooks, and you can also use the annotations to access operations:

operation: Get ThreatLog Domain Reputation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get Domain Reputation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get IP Reputation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get URL Screenshot

Input parameters

Output

The output contains the following populated JSON schema:
{
"data": {
"id": "",
"@id": "",
"file": {
"id": "",
"@id": "",
"file": [],
"size": "",
"@type": "",
"@context": "",
"filename": "",
"metadata": [],
"mimeType": "",
"thumbnail": "",
"uploadDate": ""
},
"name": "",
"type": "",
"@type": "",
"@context": "",
"createDate": "",
"createUser": {
"id": "",
"@id": "",
"name": "",
"@type": "",
"avatar": "",
"userId": "",
"userType": "",
"@settings": "",
"createDate": "",
"createUser": "",
"modifyDate": "",
"modifyUser": ""
},
"modifyDate": "",
"modifyUser": {
"id": "",
"@id": "",
"name": "",
"@type": "",
"avatar": "",
"userId": "",
"userType": "",
"@settings": "",
"createDate": "",
"createUser": "",
"modifyDate": "",
"modifyUser": ""
},
"recordTags": "",
"description": ""
},
"status": "",
"_status": "",
"message": "",
"operation": "",
"request_id": ""
}

operation: Get URL Reputation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get Domain Age

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get Domain Trustworthiness

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get Domain Parked Status

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get URL Status

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get Email Reputation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get DNS Propagation

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get URL HTML

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

operation: Get SSL Info

Input parameters

Output

The output contains the following populated JSON schema:
{
"result": "",
"status": ""
}

Included playbooks

The Sample - apivoid - 1.0.1 playbook collection comes bundled with the apivoid connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the apivoid connector.

• Domain > API Void > Enrichment
• Email Address > API Void > Enrichment
• Get DNS Propagation
• Get Domain Age
• Get Domain Parked Status
• Get Domain Reputation
• Get Domain Trustworthiness
• Get Email Reputation
• Get IP Reputation
• Get SSL Info
• Get ThreatLog Domain Reputation
• Get URL HTML
• Get URL Reputation
• Get URL Screenshot
• Get URL Status
• IP Address > API Void > Enrichment
• URL > API Void > Enrichment

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during the connector upgrade and delete.

Pluggable Enrichment

The Sample - API Void - 1.0.1 playbook collection contains pluggable enrichment playbooks that are used to provide verdicts for various indicator types. The indicator can be of any of the following types: IP address, domain, URL, or Email address. The pluggable enrichment playbooks are in the format: '<indicator type> > API Void > Enrichment' format. For example, 'URL > API Void > Enrichment'.

The 'Configuration' step in all the pluggable enrichment playbooks contains variables that have default values for calculating the 'Verdict' for various indicator types.

Default variables for indicator type IP, Domain, and URL

The following table lists the variable names and their default values:

Based on the above default values, the API Void integration API response returns the verdict, cti_score, and enrichment_summary (all the other variables are common, which is listed in the Common Variable Table).

Default responses for verdict, cti_score, and enrichment_summary variables for indicator type IP, Domain, and URL

Variable Name	Description	Return Value
verdict for IP address, Domain, and URL	This connector returns a high-reliability value called 'verdict'. Use this verdict to find the reputation of the various types of indicators.	If the risk_score value returned is between the value specified in the malicious_score variable, then return the verdict as Malicious. If the risk_score value returned is between the value specified in the suspicious_score variable, then return the verdict as Suspicious. If the risk_score value returned is between the value specified in the good_score variable, then return the verdict as Good. For any other value, return the verdict as No Reputation Available
cti_score for IP address, Domain, and URL	The verdict value returned by the integration API.	risk_score
enrichment_summary for IP Address	The contents that are added, in the HTML format, in the 'Description' field of the specified FortiSOAR indicator record.	The following values are returned in the HTML format: Risk Score Proxy TOR Hosting Blacklisted Detection Engine Rate The following image displays a sample of the populated 'Description' field in a FortiSOAR indicator record:
enrichment_summary for Domain	The contents that are added, in the HTML format, in the 'Description' field of the specified FortiSOAR indicator record.	The following values are returned in the HTML format: Risk Score Domain Blacklisted Risky Category Blacklisted Detection Engine Rate The following image displays a sample of the populated 'Description' field in a FortiSOAR indicator record:
enrichment_summary for URL	The contents that are added, in the HTML format, in the 'Description' field of the specified FortiSOAR indicator record.	The following values are returned in the HTML format: Risk Score Domain Blacklisted Suspicious Domain Risky Geolocation Blacklisted Detection Engine Rate The following image displays a sample of the populated 'Description' field in a FortiSOAR indicator record:

Default variables for indicator type 'Email Address'

The following table lists the variable names and their default values:

Based on the above default values, the API Void integration API response returns the verdict, cti_score, and enrichment_summary (all the other variables are common, which is listed in the Common Variable Table).

Default responses for verdict, cti_score, and enrichment_summary variables for indicator type Email Address

Common Variables Table

This table lists the variables, returned by the API Void integration response API, common to all indicators.

Updating the value of the 'Verdict' parameter in the Pluggable Enrichment Playbooks

You can change the default values of the 'Verdict' parameter to suit your requirements as follows:

1. Navigate to Automation > Playbooks > Sample - API Void - 1.0.1.
2. Open the required playbook in the Playbook Designer.
   The pluggable enrichment playbooks are in the '<indicator type> > API Void > Enrichment' format. For example, URL > API Void > Enrichment.
3. To customize the 'verdict', open the Configuration step, and edit the default values of any or all of the following variables:
   good_score
suspicious_score
malicious_score
   For example, you can change the value of the good_score from 0 to 10.