Intel

IntelASN

Get ASN Overview.

client.intel.asn.get(, , ?): ASN

GET/accounts/{account_id}/intel/asn/{asn}

IntelASNSubnets

Get ASN Subnets

client.intel.asn.subnets.get(, , ?): SubnetGetResponse { asn, count, ip_count_total, 3 more }

GET/accounts/{account_id}/intel/asn/{asn}/subnets

ModelsExpand Collapse

SubnetGetResponse { asn, count, ip_count_total, 3 more }

asn?: ASN

count?: number

Total results returned based on your search parameters.

ip_count_total?: number

page?: number

Current page within paginated list of results.

per_page?: number

Number of results per page of results.

subnets?: Array<string>

IntelDNS

Get Passive DNS by IP

client.intel.dns.list(, ?): V4PagePagination<DNS { count, page, per_page, reverse_records } >

GET/accounts/{account_id}/intel/dns

ModelsExpand Collapse

DNS { count, page, per_page, reverse_records }

count?: number

Total results returned based on your search parameters.

page?: number

Current page within paginated list of results.

per_page?: number

Number of results per page of results.

reverse_records?: Array<ReverseRecord>

Reverse DNS look-ups observed during the time period.

first_seen?: string

First seen date of the DNS record during the time period.

formatdate

hostname?: string

Hostname that the IP was observed resolving to.

last_seen?: string

Last seen date of the DNS record during the time period.

formatdate

IntelDomains

Get Domain Details

client.intel.domains.get(, ?): Domain { additional_information, application, content_categories, 8 more }

GET/accounts/{account_id}/intel/domain

ModelsExpand Collapse

Domain { additional_information, application, content_categories, 8 more }

additional_information?: AdditionalInformation { suspected_malware_family }

Additional information related to the host name.

suspected_malware_family?: string

Suspected DGA malware family.

application?: Application { id, name }

Application that the hostname belongs to.

id?: number

name?: string

content_categories?: Array<ContentCategory>

id?: number

name?: string

super_category_id?: number

domain?: string

inherited_content_categories?: Array<InheritedContentCategory>

id?: number

name?: string

super_category_id?: number

inherited_from?: string

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types?: Array<InheritedRiskType>

id?: number

name?: string

super_category_id?: number

popularity_rank?: number

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

resolves_to_refs?: Array<ResolvesToRef>

Specifies a list of references to one or more IP addresses or domain names that the domain name currently resolves to.

id?: string

STIX 2.1 identifier: https://docs.oasis-open.org/cti/stix/v2.1/cs02/stix-v2.1-cs02.html#_64yvzeku5a5c.

value?: string

IP address or domain name.

risk_score?: number

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types?: Array<RiskType>

id?: number

name?: string

super_category_id?: number

IntelDomainsBulks

Get Multiple Domain Details

client.intel.domains.bulks.get(, ?): BulkGetResponse | null

GET/accounts/{account_id}/intel/domain/bulk

ModelsExpand Collapse

BulkGetResponse = Array<BulkGetResponseItem> | null

additional_information?: AdditionalInformation { suspected_malware_family }

Additional information related to the host name.

suspected_malware_family?: string

Suspected DGA malware family.

application?: Application { id, name }

Application that the hostname belongs to.

id?: number

name?: string

content_categories?: Array<ContentCategory>

id?: number

name?: string

super_category_id?: number

domain?: string

inherited_content_categories?: Array<InheritedContentCategory>

id?: number

name?: string

super_category_id?: number

inherited_from?: string

Domain from which inherited_content_categories and inherited_risk_types are inherited, if applicable.

inherited_risk_types?: Array<InheritedRiskType>

id?: number

name?: string

super_category_id?: number

popularity_rank?: number

Global Cloudflare 100k ranking for the last 30 days, if available for the hostname. The top ranked domain is 1, the lowest ranked domain is 100,000.

risk_score?: number

Hostname risk score, which is a value between 0 (lowest risk) to 1 (highest risk).

risk_types?: Array<RiskType>

id?: number

name?: string

super_category_id?: number

IntelDomain History

Get Domain History

client.intel.domainHistory.get(, ?): DomainHistoryGetResponse | null

GET/accounts/{account_id}/intel/domain-history

ModelsExpand Collapse

DomainHistory { categorizations, domain }

categorizations?: Array<Categorization>

categories?: Array<Category>

id?: number

name?: string

end?: string

formatdate

start?: string

formatdate

domain?: string

DomainHistoryGetResponse = Array<DomainHistory { categorizations, domain } > | null

categorizations?: Array<Categorization>

categories?: Array<Category>

id?: number

name?: string

end?: string

formatdate

start?: string

formatdate

domain?: string

IntelIPs

Get IP Overview

client.intel.ips.get(, ?): IPGetResponse | null

GET/accounts/{account_id}/intel/ip

ModelsExpand Collapse

IP { belongs_to_ref, ip, risk_types }

belongs_to_ref?: BelongsToRef { id, country, description, 2 more }

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id?: string

country?: string

description?: string

type?: "hosting_provider" | "isp" | "organization"

Infrastructure type of this ASN.

One of the following:

"hosting_provider"

"isp"

"organization"

value?: string

ip?: string

formatipv4

risk_types?: Array<RiskType>

id?: number

name?: string

super_category_id?: number

IPGetResponse = Array<IP { belongs_to_ref, ip, risk_types } > | null

belongs_to_ref?: BelongsToRef { id, country, description, 2 more }

Specifies a reference to the autonomous systems (AS) that the IP address belongs to.

id?: string

country?: string

description?: string

type?: "hosting_provider" | "isp" | "organization"

Infrastructure type of this ASN.

One of the following:

"hosting_provider"

"isp"

"organization"

value?: string

ip?: string

formatipv4

risk_types?: Array<RiskType>

id?: number

name?: string

super_category_id?: number

IntelIP Lists

ModelsExpand Collapse

IPList { id, description, name }

id?: number

description?: string

name?: string

IntelMiscategorizations

Create Miscategorization

client.intel.miscategorizations.create(, ?): MiscategorizationCreateResponse { errors, messages, success }

POST/accounts/{account_id}/intel/miscategorization

ModelsExpand Collapse

MiscategorizationCreateResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

IntelWhois

Get WHOIS Record

client.intel.whois.get(, ?): WhoisGetResponse { dnssec, domain, extension, 84 more }

GET/accounts/{account_id}/intel/whois

ModelsExpand Collapse

Whois { created_date, domain, nameservers, 6 more }

created_date?: string

formatdate

domain?: string

nameservers?: Array<string>

registrant?: string

registrant_country?: string

registrant_email?: string

registrant_org?: string

registrar?: string

updated_date?: string

formatdate

WhoisGetResponse { dnssec, domain, extension, 84 more }

dnssec: boolean

domain: string

extension: string

found: boolean

nameservers: Array<string>

punycode: string

registrant: string

registrar: string

id?: string

administrative_city?: string

administrative_country?: string

administrative_email?: string

administrative_fax?: string

administrative_fax_ext?: string

administrative_id?: string

administrative_name?: string

administrative_org?: string

administrative_phone?: string

administrative_phone_ext?: string

administrative_postal_code?: string

administrative_province?: string

administrative_referral_url?: string

administrative_street?: string

billing_city?: string

billing_country?: string

billing_email?: string

billing_fax?: string

billing_fax_ext?: string

billing_id?: string

billing_name?: string

billing_org?: string

billing_phone?: string

billing_phone_ext?: string

billing_postal_code?: string

billing_province?: string

billing_referral_url?: string

billing_street?: string

created_date?: string

formatdate-time

created_date_raw?: string

expiration_date?: string

formatdate-time

expiration_date_raw?: string

registrant_city?: string

registrant_country?: string

registrant_email?: string

registrant_fax?: string

registrant_fax_ext?: string

registrant_id?: string

registrant_name?: string

registrant_org?: string

registrant_phone?: string

registrant_phone_ext?: string

registrant_postal_code?: string

registrant_province?: string

registrant_referral_url?: string

registrant_street?: string

registrar_city?: string

registrar_country?: string

registrar_email?: string

registrar_fax?: string

registrar_fax_ext?: string

registrar_id?: string

registrar_name?: string

registrar_org?: string

registrar_phone?: string

registrar_phone_ext?: string

registrar_postal_code?: string

registrar_province?: string

registrar_referral_url?: string

registrar_street?: string

status?: Array<string>

technical_city?: string

technical_country?: string

technical_email?: string

technical_fax?: string

technical_fax_ext?: string

technical_id?: string

technical_name?: string

technical_org?: string

technical_phone?: string

technical_phone_ext?: string

technical_postal_code?: string

technical_province?: string

technical_referral_url?: string

technical_street?: string

updated_date?: string

formatdate-time

updated_date_raw?: string

whois_server?: string

IntelURLs

Get URL Intelligence

client.intel.urls.get(, ?): URL { content_categories, full_url, hostname, 2 more }

GET/accounts/{account_id}/intel/url

ModelsExpand Collapse

URL { content_categories, full_url, hostname, 2 more }

content_categories: Array<ContentCategory>

Content categories associated with this URL.

id?: number

name?: string

source_id?: number

super_category_id?: number

full_url: string

The full URL that was looked up.

hostname: string

The hostname of the URL.

risk_type: Array<RiskType>

Security risk types associated with this URL.

id?: number

name?: string

source_id?: number

super_category_id?: number

url_path: string

The path component of the URL.

IntelIndicator Feeds

Get indicator feeds owned by this account

client.intel.indicatorFeeds.list(, ?): SinglePage<IndicatorFeedListResponse { id, created_on, description, 5 more } >

GET/accounts/{account_id}/intel/indicator-feeds

Get indicator feed metadata

client.intel.indicatorFeeds.get(, , ?): IndicatorFeedGetResponse { id, created_on, description, 10 more }

GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Create new indicator feed

client.intel.indicatorFeeds.create(, ?): IndicatorFeedCreateResponse { id, created_on, description, 5 more }

POST/accounts/{account_id}/intel/indicator-feeds

Update indicator feed metadata

client.intel.indicatorFeeds.update(, , ?): IndicatorFeedUpdateResponse { id, created_on, description, 5 more }

PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}

Get indicator feed data

client.intel.indicatorFeeds.data(, , ?): IndicatorFeedDataResponse

GET/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data

ModelsExpand Collapse

IndicatorFeedListResponse { id, created_on, description, 5 more }

id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time

name?: string

The name of the indicator feed

IndicatorFeedGetResponse { id, created_on, description, 10 more }

id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

last_upload_summary?: LastUploadSummary { persisted, skipped, uploaded }

Summary of indicator counts from the last successful upload to this feed. Populated by the custom-threat-feeds loader at the end of each successful load. Absent (omitted) when no upload has completed successfully or the upload errored before the summary write. Surfaces silent-failure paths so operators can see when their indicators were dropped (popularity allowlist, expired valid_until, etc.) without reading loader logs.

persisted?: Persisted { domains_added, domains_removed, ips_added, 3 more }

Net delta applied to feed indicators by this upload. Snapshot uploads emit both *_added and *_removed; delta-add emits only *_added; delta-remove emits only *_removed.

domains_added?: number

domains_removed?: number

ips_added?: number

ips_removed?: number

urls_added?: number

urls_removed?: number

skipped?: Skipped { allowlisted_domains, expired_indicators, invalid_indicators }

Counts of indicators that were uploaded but did not reach QuickSilver, broken down by reason.

allowlisted_domains?: number

Domains filtered by the global popularity allowlist at QS provisioning time. Popular domains (bing.com, naver.com, etc.) are protected from custom-threat-feed enforcement.

expired_indicators?: number

Indicators in the upload whose valid_until is already in the past. These are not added to QS; the expiration cron handles cleanup.

invalid_indicators?: number

Reserved for future use. Currently always 0 — the unifier aborts the entire upload on a single bad indicator.

uploaded?: Uploaded { domains, ips, urls }

Indicator counts from the unified file the loader received

domains?: number

Number of domain indicators in the upload

ips?: number

Number of IP indicators in the upload

urls?: number

Number of URL indicators in the upload

latest_upload_error?: string

Human-readable error message describing why the latest upload failed. Populated only when latest_upload_status is Error. Returns one of a small fixed set of category-level messages (invalid domain / IP / URL entries, malformed row or header, invalid valid_until timestamp, etc.) or the generic Upload failed for unknown or infrastructure-level errors. Never echoes raw error text from the underlying loader. Intel accounts receive the verbatim loader/API error text (including specific offending values) instead of these category-level messages.

latest_upload_status?: "Mirroring" | "Unifying" | "Loading" | 3 more

Status of the latest snapshot uploaded

One of the following:

"Mirroring"

"Unifying"

"Loading"

"Provisioning"

"Complete"

"Error"

modified_on?: string

The date and time when the data entry was last modified

formatdate-time

name?: string

The name of the indicator feed

provider_id?: number

The unique identifier for the provider

provider_name?: string

The provider of the indicator feed

IndicatorFeedCreateResponse { id, created_on, description, 5 more }

id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time

name?: string

The name of the indicator feed

IndicatorFeedUpdateResponse { id, created_on, description, 5 more }

id?: number

The unique identifier for the indicator feed

created_on?: string

The date and time when the data entry was created

formatdate-time

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

modified_on?: string

The date and time when the data entry was last modified

formatdate-time

name?: string

The name of the indicator feed

IndicatorFeedDataResponse = string

IntelIndicator FeedsSnapshots

Update indicator feed data

client.intel.indicatorFeeds.snapshots.update(, , ?): SnapshotUpdateResponse { file_id, filename, poll_url, 2 more }

PUT/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot

ModelsExpand Collapse

SnapshotUpdateResponse { file_id, filename, poll_url, 2 more }

file_id?: number

Feed id

filename?: string

Name of the file unified in our system

poll_url?: string

Account-relative polling path. Prepend /accounts/{account_id} using the same account identifier and API host as the upload request. The path omits the account segment because the service does not have your account identifier in this context.

status?: string

Current status of the upload at the moment the request returned. This is NOT a terminal state: the file is unified inline, but the durable loader has only accepted it, so the upload is still Unifying. Poll poll_url until the status reaches a terminal value (Unified or Error).

upload_id?: number

Identifier of the upload row, for polling this upload to a terminal state via poll_url.

formatint64

IntelIndicator FeedsPermissions

List indicator feed permissions

client.intel.indicatorFeeds.permissions.list(, ?): PermissionListResponse { id, description, is_attributable, 3 more }

GET/accounts/{account_id}/intel/indicator-feeds/permissions/view

Grant permission to indicator feed

client.intel.indicatorFeeds.permissions.create(, ?): PermissionCreateResponse { success }

PUT/accounts/{account_id}/intel/indicator-feeds/permissions/add

Revoke permission to indicator feed

client.intel.indicatorFeeds.permissions.delete(, ?): PermissionDeleteResponse { success }

PUT/accounts/{account_id}/intel/indicator-feeds/permissions/remove

ModelsExpand Collapse

PermissionListResponse = Array<PermissionListResponseItem>

id?: number

The unique identifier for the indicator feed

description?: string

The description of the example test

is_attributable?: boolean

Whether the indicator feed can be attributed to a provider

is_downloadable?: boolean

Whether the indicator feed can be downloaded

is_public?: boolean

Whether the indicator feed is exposed to customers

name?: string

The name of the indicator feed

PermissionCreateResponse { success }

success?: boolean

Whether the update succeeded or not

PermissionDeleteResponse { success }

success?: boolean

Whether the update succeeded or not

IntelIndicator FeedsDownloads

IntelSinkholes

List sinkholes owned by this account

client.intel.sinkholes.list(, ?): SinglePage<Sinkhole { id, account_tag, created_on, 4 more } >

GET/accounts/{account_id}/intel/sinkholes

Get a sinkhole

client.intel.sinkholes.get(, , ?): Sinkhole { id, account_tag, created_on, 4 more }

GET/accounts/{account_id}/intel/sinkholes/{sinkhole_id}

Create a new sinkhole for your account

client.intel.sinkholes.create(, ?): Sinkhole { id, account_tag, created_on, 4 more }

POST/accounts/{account_id}/intel/sinkholes

Update a sinkhole

client.intel.sinkholes.update(, , ?): SinkholeUpdateResponse

PUT/accounts/{account_id}/intel/sinkholes/{sinkhole_id}

Delete a sinkhole

client.intel.sinkholes.delete(, , ?): SinkholeDeleteResponse

DELETE/accounts/{account_id}/intel/sinkholes/{sinkhole_id}

ModelsExpand Collapse

Sinkhole { id, account_tag, created_on, 4 more }

id?: string

The unique identifier for the sinkhole.

account_tag?: string

The account tag that owns this sinkhole.

created_on?: string

The date and time when the sinkhole was created.

formatdate-time

modified_on?: string

The date and time when the sinkhole was last modified.

formatdate-time

name?: string

The name of the sinkhole.

r2_bucket?: string

The name of the R2 bucket to store results.

r2_id?: string

The id of the R2 instance.

SinkholeUpdateResponse = unknown

SinkholeDeleteResponse = unknown

IntelSinkholesIngresses

Create an ingress rule

client.intel.sinkholes.ingresses.create(, , ?): IngressCreateResponse { id, cidr, created_on, 3 more }

POST/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses

Get an ingress rule

client.intel.sinkholes.ingresses.get(, , ?): IngressGetResponse { id, cidr, created_on, 3 more }

GET/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}

Update an ingress rule

client.intel.sinkholes.ingresses.update(, , ?): IngressUpdateResponse

PUT/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}

Delete an ingress rule

client.intel.sinkholes.ingresses.delete(, , ?): IngressDeleteResponse

DELETE/zones/{zone_id}/intel/sinkholes/{sinkhole_id}/ingresses/{ingress_id}

ModelsExpand Collapse

IngressCreateResponse { id, cidr, created_on, 3 more }

id?: string

The unique identifier for the ingress rule.

cidr?: string

The CIDR block for the ingress rule.

created_on?: string

The date and time when the ingress rule was created.

formatdate-time

modified_on?: string

The date and time when the ingress rule was last modified.

formatdate-time

sinkhole_id?: string

The sinkhole this ingress rule belongs to.

zone_tag?: string

The zone tag associated with this ingress rule.

IngressGetResponse { id, cidr, created_on, 3 more }

id?: string

The unique identifier for the ingress rule.

cidr?: string

The CIDR block for the ingress rule.

created_on?: string

The date and time when the ingress rule was created.

formatdate-time

modified_on?: string

The date and time when the ingress rule was last modified.

formatdate-time

sinkhole_id?: string

The sinkhole this ingress rule belongs to.

zone_tag?: string

The zone tag associated with this ingress rule.

IngressUpdateResponse = unknown

IngressDeleteResponse = unknown

IntelAttack Surface Report

IntelAttack Surface ReportIssue Types

Retrieves Security Center Issues Types

client.intel.attackSurfaceReport.issueTypes.get(, ?): SinglePage<IssueTypeGetResponse>

GET/accounts/{account_id}/intel/attack-surface-report/issue-types

ModelsExpand Collapse

IssueTypeGetResponse = string

IntelAttack Surface ReportIssues

Retrieves Security Center Issues

Deprecated

client.intel.attackSurfaceReport.issues.list(, ?): V4PagePagination<IssueListResponse { count, issues, page, per_page } >

GET/accounts/{account_id}/intel/attack-surface-report/issues

Retrieves Security Center Issue Counts by Class

Deprecated

client.intel.attackSurfaceReport.issues.class(, ?): IssueClassResponse { count, value }

GET/accounts/{account_id}/intel/attack-surface-report/issues/class

Retrieves Security Center Issue Counts by Severity

Deprecated

client.intel.attackSurfaceReport.issues.severity(, ?): IssueSeverityResponse { count, value }

GET/accounts/{account_id}/intel/attack-surface-report/issues/severity

Retrieves Security Center Issue Counts by Type

Deprecated

client.intel.attackSurfaceReport.issues.type(, ?): IssueTypeResponse { count, value }

GET/accounts/{account_id}/intel/attack-surface-report/issues/type

ModelsExpand Collapse

IssueType = "compliance_violation" | "email_security" | "exposed_infrastructure" | 3 more

One of the following:

"compliance_violation"

"email_security"

"exposed_infrastructure"

"insecure_configuration"

"weak_authentication"

"configuration_suggestion"

SeverityQueryParam = "low" | "moderate" | "critical"

One of the following:

"low"

"moderate"

"critical"

IssueListResponse { count, issues, page, per_page }

count?: number

Indicates the total number of results.

issues?: Array<Issue>

id?: string

dismissed?: boolean

has_extended_context?: boolean

Indicates whether the insight has a large payload that requires fetching via the context endpoint.

issue_class?: string

issue_type?: IssueType

payload?: Payload { detection_method, zone_tag }

detection_method?: string

Describes the method used to detect insight.

zone_tag?: string

resolve_link?: string

resolve_text?: string

severity?: "Low" | "Moderate" | "Critical"

One of the following:

"Low"

"Moderate"

"Critical"

since?: string

formatdate-time

status?: "active" | "resolved"

The current status of the insight.

One of the following:

"active"

"resolved"

subject?: string

timestamp?: string

formatdate-time

user_classification?: "false_positive" | "accept_risk" | "other" | null

User-defined classification for the insight. Can be ‘false_positive’, ‘accept_risk’, ‘other’, or null.

One of the following:

"false_positive"

"accept_risk"

"other"

page?: number

Specifies the current page within paginated list of results.

per_page?: number

Sets the number of results per page of results.

maximum1000

minimum1

IssueClassResponse = Array<IssueClassResponseItem>

count?: number

value?: string

IssueSeverityResponse = Array<IssueSeverityResponseItem>

count?: number

value?: string

IssueTypeResponse = Array<IssueTypeResponseItem>

count?: number

value?: string