ThreatBook CTI

https://docs.threatbook.io/
Admin
ThreatBook CTI is an intelligence analysis platform built specifically for security professionals,...
Tokens:84,613
Snippets:448
Trust Score:9.1
Update:3 months ago
Show doc for...
Tokens:
Raw
### API Response for System Error (500)

Source: https://docs.threatbook.io/api-reference/enrichment/file-upload-v2

This example illustrates the JSON response structure for a general system error encountered during processing.

```json
{
  "msg": "System error",
  "response_code": 500
}
```

--------------------------------

### API Response for URL Download Failure (500)

Source: https://docs.threatbook.io/api-reference/enrichment/file-upload-v2

This example demonstrates the JSON response when the API fails to download a URL provided in the request.

```json
{
  "msg": "URL Download Fail",
  "response_code": 500
}
```

--------------------------------

### API Response for Rate Limiting (429)

Source: https://docs.threatbook.io/api-reference/enrichment/file-upload-v2

This example shows the expected JSON response when a request exceeds the API's rate limits.

```json
{
  "msg": "Request rate limitation",
  "response_code": 429
}
```

--------------------------------

### OpenAPI Specification for URL Feed

Source: https://docs.threatbook.io/api-reference/feeds/url

This OpenAPI specification defines the structure and endpoints for the URL feed API. It details the GET request for retrieving malicious URLs, including parameters like 'time' for date filtering and example responses for successful retrieval and error conditions.

```yaml
openapi: 3.1.0
info:
  title: URL
  description: This API provides malicious URLs.
  version: 1.0.0
servers:
  - url: https://api.threatbook.io
security: []
paths:
  /v2/feeds/stix/url:
    get:
      tags: []
      summary: URL
      description: This API provides malicious URLs.
      parameters:
        - name: time
          in: query
          description: |-
            Precise time in UTC, format: YYYYMMDD. 
            For example, 20210122 returns data from 2021-01-22 (UTC).
            Default: returns the most recent data (t-1 day).
            Feed packages can be retrieved for up to 90 days in the past.
          required: false
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties: {}              example: "PK\x03\x04\x14\0\b\0\b\0Nz7\\\0\0\0\0\0\0\0\0W\x04\0\0\x11\0 \0url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0�R�n�0\x10肩+\x04\n]r墒\x14)J�ü™As\t�K\x03绵cY车DGぼ\x1AA™�\x92�H@\x90额�\x17�\x99\x9DYr�t\x95$i<\x1F1m\x92T\n\x9D9`z3�\x9CY+\0Z[\x9B\x97\x95\x05�\x95ü\x13\x01u!\x15\b+\x99FQ\x95\\�\x97�pD�;a\x1F\x9C�&\x05\x9A�/üW_Q�0�\x1E�c\x92<碗怃:愦\x8C�\a\_FsΩ\x01Zk\x02\\�\x86谪\x1A\x04W\x91*�\x881虫荥:�"�B\x9Dlg�V\x1E\x9Cv~\b骚�\x8F+�c\x17�=狮�…6\x8D<銮\x89蘧�W�"�\x9B熘K锑�\a�;�xN\x7F�E�4r涛鼍\x9D\x1F\N�\x12H\x0EぜТ�ES�\x19!潴jx\x941b?苦眯\x1F\x9A�\x7F冷Cr�\x8F�\x18\x9A推�\x03\x06\b�\x83�\x14\x84\x14U�rVq\x90�99活\x8Br�\t俎酚\x1Eヶ\n]�a�\\oW\x17=\n]\x1F�e#缔8�.e亏\x0Ff禊�/褡X\x10Ss\x06\x9A�r\x8C�\x14\_ㄉ\x01+i\x98�\x88\x10�…-™�_�\x97*"�\x99}涿�\x06抨�{�}{y�o\x1D…\x9C�[鲲�\x1D醉阵OPK\a\b�++Q\x91\x01\0\0W\x04\0\0PK\x03\x04\x14\0\b\0\b\0Nz7\\\0\0\0\0\0\0\0\0�\0\0\0\x1C\0 \0__MACOSX/._url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0c`\x15cg`b`�MLV�\x0FV\x88Pü\x02\x90\x18\x03'\x10\e\x01q!\x10\x83�\x8B\x19\x88\x02\x8E!!AP&H�\f �FS�\x88\x10\x17M蜗�K,(�I�+(�/K�K�KN\x05)赝w�:t�^s\0PK\a\by�m\x1AT\0\0\0�\0\0\0PK\x01\x02\x14\x03\x14\0\b\0\b\0Nz7\\�++Q\x91\x01\0\0W\x04\0\0\x11\0 \0\0\0\0\0\0\0\0\0�\0\0\0\0url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0PK\x01\x02\x14\x03\x14\0\b\0\b\0Nz7\\y�m\x1AT\0\0\0�\0\0\0\x1C\0 \0\0\0\0\0\0\0\0\0��\x01\0\0__MACOSX/._url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0PK\x05\x06\0\0\0\0\x02\0\x02\0�\0\0\0�\x02\0\0\0\0"
          headers: {}
        '400':
          $ref: '#/components/responses/400'
          description: ''
        '401':
          $ref: '#/components/responses/401'
          description: ''
        '405':
          $ref: '#/components/responses/405'
          description: ''
        '429':
          $ref: '#/components/responses/429'
          description: ''
        '500':
          $ref: '#/components/responses/500'
          description: ''
      deprecated: false
      security:
        - bearer: []
components:
  responses:
    '400':
      description: ''
      content:
        application/json:
          schema:
            type: object
            properties:
              msg:
                type: string
                enum:
                  - Required:{resource/apikey}
                  - Invalid parameter:{parameter}
              response_code:
                type: integer
                const: 400
            required:
              - msg
              - response_code
          examples:
            Example 1:
              summary: Example 1
              value:
                msg: Required:{resource/apikey}
                response_code: 400
    '401':
      description: ''
      content:
        application/json:
          schema:
            type: object
            properties:
              msg:
                type: string
                enum:
                  - Invalid account status
                  - 'Invalid access IP: {actual IP address}'
                  - Invalid API key
                  - Invalid key status
                  - No access to the API
                  - Expired API key
                  - No access to the requested resource
                  - 'No access to: {parameter}'
              response_code:
                type: integer
                const: 401
            required:
              - msg
              - response_code
          examples:
            Example 1:
              summary: Example 1
              value:
                msg: Invalid account status
                response_code: 401
    '405':
      description: ''
      content:
        application/json:
          schema:
            type: object
            properties:
              msg:

```

--------------------------------

### POST /v2/file/upload

Source: https://docs.threatbook.io/api-reference/enrichment/file-upload-v2

Uploads a file for analysis by 22 antivirus engines and selects an appropriate sandbox environment for dynamic analysis based on the file type.

```APIDOC
## POST /v2/file/upload

### Description
Uploads a file for analysis by 22 antivirus engines and selects an appropriate sandbox environment for dynamic analysis based on the file type. This is useful for potentially malicious files from office endpoints, Web/FTP/email attachments, or suspicious files on endpoints/servers.

### Method
POST

### Endpoint
https://api.threatbook.io/v2/file/upload

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your API key. For details on how to obtain and manage your API key, please refer to the [Authentication](https://docs.threatbook.io/api-reference/authentication) page. Kindly note: Please check if you have bound your access IP to the key and have the authority quotas to access this API before you interact with it.
- **sandbox_type** (string) - Optional - Specifies the sandbox environment for file execution. Available environments include:
  - **Windows**:
    - win7_sp1_enx64_office2013
    - win7_sp1_enx86_office2013
    - win7_sp1_enx86_office2010
    - win7_sp1_enx86_office2007
    - win7_sp1_enx86_office2003
    - win10_1903_enx64_office2016
  - **Linux**:
    - ubuntu_1704_x64
    - centos_7_x64
  - **Kylin**:
    - kylin_desktop_v10
- **run_time** (integer) - Optional - The sandbox execution time in seconds. Defaults to 60s, with a maximum of 300s.

#### Request Body
- **file** (binary) - Required - The file to be analyzed. Files must be no larger than 100 MB. Supported file types include PE executables (EXE, DLL, COM, etc.), Office documents (DOC, XLS, PPT, etc.), PDF, HTML, script files, MSI, SWF, JAR, LNK, ELF, and various archive formats (ZIP, RAR, 7Z, etc.).

### Request Example
```json
{
  "example": "multipart/form-data upload with file field"
}
```

### Response
#### Success Response (200)
- **data** (object) - Contains analysis results.
  - **sha256** (string) - The SHA256 hash of the file.
  - **permalink** (string) - A URL to the ATI File Details Page for the analysis.
- **response_code** (integer) - The response code.
- **msg** (string) - A message describing the response.

#### Response Example
```json
{
  "data": {
    "sha256": "d79c9643d76062f553f76bb20b07da88fdbf5ddf3428ffc0223bb7bf90e36deb",
    "permalink": "[ATI File Details Page URL]"
  },
  "response_code": 200,
  "msg": "success"
}
```
```

--------------------------------

### Get Actors

Source: https://docs.threatbook.io/api-reference/feeds/actors

Retrieves threat actor profiles. You can specify a date to get historical data or omit it to get the most recent data (t-1 day). Data can be retrieved for up to 90 days in the past.

```APIDOC
## GET /v2/feeds/stix/actor

### Description
This API provides all threat actor profiles.

### Method
GET

### Endpoint
/v2/feeds/stix/actor

### Parameters
#### Query Parameters
- **time** (string) - Optional - Precise time in UTC, format: YYYYMMDD. For example, 20210122 returns data from 2021-01-22 (UTC). Default: returns the most recent data (t-1 day). Feed packages can be retrieved for up to 90 days in the past.

### Response
#### Success Response (200)
- The response contains threat actor profiles. The exact schema for the actor profiles is not detailed here, but it is expected to be in JSON format.

### Request Example
GET /v2/feeds/stix/actor?time=20210122

### Response Example
(Example response body is binary data representing a compressed JSON file, actual content would be JSON)
```

--------------------------------

### GET /v2/feeds/stix/url

Source: https://docs.threatbook.io/api-reference/feeds/url

Retrieves a feed of malicious URLs. You can specify a date to get historical data or omit the parameter to fetch the most recent feed. The feed is available for up to 90 days in the past.

```APIDOC
## GET /v2/feeds/stix/url

### Description
This API provides malicious URLs. It allows fetching data for a specific date or the most recent data available.

### Method
GET

### Endpoint
https://api.threatbook.io/v2/feeds/stix/url

### Parameters
#### Query Parameters
- **time** (string) - Optional - Precise time in UTC, format: YYYYMMDD. For example, 20210122 returns data from 2021-01-22 (UTC). Default: returns the most recent data (t-1 day). Feed packages can be retrieved for up to 90 days in the past.

### Response
#### Success Response (200)
- The response is a JSON object containing the malicious URL feed. The exact structure of the feed data is not detailed here but is expected to be in a machine-readable format.

#### Response Example
```json
{
  "example": "PK\x03\x04\x14\0\b\0\b\0Nz7\\\0\0\0\0\0\0\0\0W\x04\0\0\x11\0 \0url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0�R�n�0\x10肩+\x04\n]r墒\x14)J�ü™As\t�K\x03绵cY车DGぼ\x1AA™�\x92�H@\x90额�\x17�\x99\x9DYr�t\x95$i<\x1F1m\x92T\n\x9D9`z3�\x9CY+\0Z[\x9B\x97\x95\x05�\x95ü\x13\x01u!\x15\b+\x99FQ\x95\\�\x97�pD�;a\x1F\x9C�&\x05\x9A�/üW_Q�0�\x1E�c\x92<碗怃:愦\x8C�\a\_FsΩ\x01Zk\x02\\�\x86谪\x1A\x04W\x91*�\x881虫荥:�\"�B\x9Dlg�V\x1E\x9Cv~\b骚�\x8F+\x9Cc\x17�=狮�…6\x8D<銮\x89蘧�W�\"�\x9B熘K锑�\a�;�xN\x7F�E�4r涛鼍\x9D\x1F\N�\x12H\x0EぜТ�ES�\x19!潴jx\x941b?苦眯\x1F\x9A�\x7F冷Cr�\x8F�\x18\x9A推�\x03\x06\b�\x83�\x14\x84\x14U�rVq\x90�99活\x8Br�\t俎酚\x1Eヶ\n]�a�\\oW\x17=\n]\x1F�e#缔8�.e亏\x0Ff禊�/褡X\x10Ss\x06\x9A�r\x8C�\x14\_ㄉ\x01+i\x98�\x88\n�…-™�_�\x97*\"�\x99}涿�\x06抨�{�}{y�o\x1D…\x9C�[鲲�\x1D醉阵OPK\a\b�++Q\x91\x01\0\0W\x04\0\0PK\x03\x04\x14\0\b\0\b\0Nz7\\\[\0\0\0\0\0\0\0\0�\0\0\0\x1C\0 \0__MACOSX/._url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0c`\x15cg`b`�MLV�\x0FV\x88Pü\x02\x90\x18\x03'\x10\e\x01q!\x10\x83�\x8B\x19\x88\x02\x8E!!AP&H�\f �FS�\x88\x10\x17M蜗�K,(�I�+(�/K�K�KN\x05)赝w�:t�^s\0PK\a\by�m\x1AT\0\0\0�\0\0\0PK\x01\x02\x14\x03\x14\0\b\0\b\0Nz7\\�++Q\x91\x01\0\0W\x04\0\0\x11\0 \0\0\0\0\0\0\0\0\0�\0\0\0\0url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0PK\x01\x02\x14\x03\x14\0\b\0\b\0Nz7\\y�m\x1AT\0\0\0�\0\0\0\x1C\0 \0\0\0\0\0\0\0\0\0��\x01\0\0__MACOSX/._url_20260109.jsonUT\n\0\a� si� si� siux\v\0\x01\x04�\x01\0\0\x04\x14\0\0\0PK\x05\x06\0\0\0\0\x02\0\x02\0�\0\0\0�\x02\0\0\0\0"
}
```

#### Error Responses
- **400 Bad Request**: Returned for invalid parameters or missing required resources.
- **401 Unauthorized**: Returned for authentication issues, such as invalid API keys, expired keys, or insufficient permissions.
- **405 Method Not Allowed**: Returned if the HTTP method used is not supported for this endpoint.
- **429 Too Many Requests**: Returned if the rate limit has been exceeded.
- **500 Internal Server Error**: Returned for unexpected server errors.
```

--------------------------------

### Get Report Detail

Source: https://docs.threatbook.io/api-reference/reports/report-detail

Retrieves detailed information for a specific report using its ID.

```APIDOC
## GET /reports/{report_id}

### Description
Retrieves detailed information for a specific report, including its title, summary, category, targets, impacts, associated threat intelligence, and more.

### Endpoint
/reports/{report_id}

### Parameters
#### Path Parameters
- **report_id** (string) - Required - The unique identifier of the report.

### Response
#### Success Response (200)
- **data** (object) - Contains the detailed information of the report.
  - **id** (string) - The unique identifier of the report.
  - **title** (string) - The title of the report.
  - **summary** (string) - A brief summary of the report's content.
  - **category** (string) - The category the report belongs to.
  - **targets** (array) - List of targets associated with the report.
  - **impacts** (array) - List of impacts described in the report.
  - **ttps** (array) - Tactics, Techniques, and Procedures (TTPs) associated with the report.
  - **mitigations** (array) - Recommended mitigations for the threats described.
  - **source** (string) - The source of the report.
  - **published_time** (string) - The time the report was published.
  - **update_time** (string) - The time the report was last updated.
  - **event_time** (string) - The time the event described in the report occurred.
  - **severity** (string) - The severity level of the threat.
  - **malicious_commands** (array) - List of malicious commands mentioned.
  - **malicious_scripts** (array) - List of malicious scripts mentioned.
  - **malicious_file** (array) - List of malicious files mentioned.
  - **iocs** (object) - Indicators of Compromise (IOCs).
    - **domain** (array) - List of malicious domains.
    - **ip** (array) - List of malicious IP addresses.
    - **md5** (array) - List of MD5 hashes.
    - **sha1** (array) - List of SHA1 hashes.
    - **sha256** (array) - List of SHA256 hashes.
  - **rules** (array) - Associated rules.
    - **description** (string) - Description of the rule.
    - **type** (string) - Type of the rule.
    - **code** (string) - Code of the rule.
  - **threat_type** (array) - One or more threat event types associated with the report.
  - **tags** (object) - Set of extracted intelligence tags.
    - **virus_family** (array) - List of virus families.
    - **attack_tools** (array) - List of attack tools.
    - **threat_actors** (array) - List of threat actors.
  - **reference_link** (array) - One or more external source URLs related to the report.
  - **cves** (array) - CVE identifiers associated with the report.

#### Response Example
{
  "data": {
    "id": "303012",
    "title": "Qilin Ransomware Targets Italian Automotive Leader Pieffe Auto Group",
    "summary": "In 2025, the activities of the ransomware group Qilin significantly increased, launching a series of cyberattacks against enterprises and mid-sized organizations across multiple industries. Qilin employs a double extortion strategy, not only encrypting victims' data but also threatening to publicly disclose sensitive information to exert pressure, resulting in severe financial and reputational losses for businesses. The attack targets span various sectors, including automotive manufacturing, beverage production, medical devices, food industry, and legal services, demonstrating its broad attack range and increasingly sophisticated tactics. Victims include well-known companies such as Pieffe Auto Group in Italy, Asahi Group in Japan, Beta Dyne in the United States, and Volkswagen in France. Security experts recommend that affected organizations strengthen their cybersecurity defenses, including continuous monitoring, incident response plans, backup validation, and employee defense training, to mitigate the risk of future attacks. Qilin's attacks not only disrupt business operations but may also trigger a",
    "category": "Ransomware",
    "targets": [
      "Automotive Manufacturing",
      "Beverage Production",
      "Medical Devices",
      "Food Industry",
      "Legal Services"
    ],
    "impacts": [
      "Financial Losses",
      "Reputational Damage",
      "Operational Disruption"
    ],
    "ttps": [
      "Double Extortion",
      "Data Encryption",
      "Data Disclosure"
    ],
    "mitigations": [
      "Strengthen Cybersecurity Defenses",
      "Continuous Monitoring",
      "Incident Response Plans",
      "Backup Validation",
      "Employee Defense Training"
    ],
    "source": "ThreatBook",
    "published_time": "2025-10-26T10:00:00Z",
    "update_time": "2025-10-26T12:30:00Z",
    "event_time": "2025-09-15T00:00:00Z",
    "severity": "High",
    "malicious_commands": [],
    "malicious_scripts": [],
    "malicious_file": [],
    "iocs": {
      "domain": [],
      "ip": [],
      "md5": [],
      "sha1": [],
      "sha256": []
    },
    "rules": [],
    "threat_type": [
      "Ransomware"
    ],
    "tags": {
      "virus_family": [
        "Qilin"
      ],
      "attack_tools": [],
      "threat_actors": [
        "Qilin Group"
      ]
    },
    "reference_link": [],
    "cves": []
  },
  "response_code": 200,
  "msg": "Success"
}
```

--------------------------------

### File Intelligence (V2) - POST /v2/file/query

Source: https://docs.threatbook.io/api-reference/enrichment/file-intelligence-v2

Retrieves detailed static and dynamic analysis reports for a given file hash. Users can specify the sandbox environment and the types of data to query.

```APIDOC
## POST /v2/file/query

### Description
Retrieve detailed static and dynamic analysis reports of a file, including file summary information, network behavior, behavioral signatures, static information, dropped behavior, process behavior, and multi-engines detection results.

### Method
POST

### Endpoint
https://api.threatbook.io/v2/file/query

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your API key. For details on how to obtain and manage your API key, please refer to the [Authentication](https://docs.threatbook.io/api-reference/authentication) page. Kindly note: Please check if you have bound your API key to your access IP and have the authority quotas to access this API before you interact with it.
- **resource** (string) - Required - The file hash value used to retrieve the analysis report. Supports sha256 / sha1 / md5.
- **sandbox_type** (string) - Optional - Sandbox Runtime Environment. Users can specify the sandbox runtime environment for the file to view dynamic analysis data in that specific environment (including behavioral signatures, process behavior, network behavior, dropped behavior, etc.). The optional environments include: Windows: win7_sp1_enx64_office2013, win7_sp1_enx86_office2013, win7_sp1_enx86_office2010, win7_sp1_enx86_office2007, win7_sp1_enx86_office2003, win10_1903_enx64_office2016. Linux: ubuntu_1704_x64, centos_7_x64. Kylin: kylin_desktop_v10.
- **query_fields** (string) - Optional - Optional data includes: summary, network, signature, static, dropped, pstree, multiengines, strings.

### Response
#### Success Response (200)
- **msg** (string) - Description of the response message.
- **response_code** (integer) - The code indicating the response status.
- **data** (object) - Contains the analysis results.
  - **multiengines** (object) - Detection status from each antivirus engine. Includes 'result', 'safe', 'malware_label', and 'scan_time'.
  - **summary** (object) - Summary Information about the file.
```

--------------------------------

### Get Vulnerability Details

Source: https://docs.threatbook.io/api-reference/vulnerabilities/vulnerability-intelligence-v2

Retrieve detailed information for a specific vulnerability using its CVE ID.

```APIDOC
## GET /v1/vulnerabilities/{cve_id}

### Description
Retrieves detailed information about a specific vulnerability, identified by its CVE ID.

### Method
GET

### Endpoint
/v1/vulnerabilities/{cve_id}

### Parameters
#### Path Parameters
- **cve_id** (string) - Required - The Common Vulnerabilities and Exposures (CVE) ID of the vulnerability to retrieve.

### Response
#### Success Response (200)
- **xve_id** (string) - The internal XVE ID for the vulnerability.
- **cve_id** (string) - The CVE ID of the vulnerability.
- **cnnvd_id** (array) - A list of CNNVD IDs associated with the vulnerability.
- **vuln_name** (string) - The name or title of the vulnerability.
- **vuln_category** (string) - The category of the vulnerability (e.g., Remote Code Execution).
- **publish_time** (integer) - The Unix timestamp when the vulnerability was published.
- **update_time** (integer) - The Unix timestamp when the vulnerability information was last updated.
- **threatbook_create_time** (integer) - The Unix timestamp when the vulnerability was created in the Threatbook system.
- **temporary_mitigation** (object) - Information about temporary mitigation strategies.
  - **public_temporary_mitigations** (object) - Publicly available temporary mitigation details.
    - **source** (string) - The source of the mitigation information.
    - **text** (string) - The detailed text of the temporary mitigation.
  - **configuration_level_mitigation** (object) - Mitigation strategies that require configuration changes.
    - **source** (string) - The source of the mitigation information.
    - **text** (string) - The detailed text of the configuration-level mitigation.
  - **network_level_mitigation** (object) - Mitigation strategies related to network security.
    - **source** (string) - The source of the mitigation information.
    - **text** (string) - The detailed text of the network-level mitigation.

#### Response Example (200)
{
  "xve_id": "XVE-2025-36247",
  "cve_id": "CVE-2025-61882",
  "cnnvd_id": [
    "CNNVD-202510-745"
  ],
  "vuln_name": "Oracle E-Business Suite Remote Code Execution Vulnerability",
  "vuln_category": "Remote Code Execution",
  "publish_time": 1759593600,
  "update_time": 1768040795,
  "threatbook_create_time": 1759635007,
  "temporary_mitigation": {
    "public_temporary_mitigations": {
      "source": "AI",
      "text": "Interim mitigation measures for the CVE-2025-61882 vulnerability include: 1. Investigate outbound connections from Oracle EBS instances to known malicious infrastructure [1] 2. Search for malicious templates in `xdo_templates_vl` that match URL references in `TemplateCode` [1] 3. Collaborate with relevant Oracle database administrators to review potentially affected systems [1] 4. Examine suspicious sessions in `icx_sessions` involving `UserID 0` (sysadmin) and `UserID 6` (guest) [1] 5. Consider temporarily disabling internet access for exposed Oracle EBS services [1] 6. Protect EBS instances using a Web Application Firewall (WAF) [1]"
    },
    "configuration_level_mitigation": {
      "source": "Threatbook Lab",
      "text": "Implement protective measures by utilizing security equipment to restrict access to the following paths: /OA_HTML/configurator/UiServlet and /OA_HTML/help/../ieshostedsurvey.jsp."
    },
    "network_level_mitigation": {
      "source": "Threatbook Lab",
      "text": "Unless absolutely necessary, avoid exposing assets to the internet."
    }
  }
}
```

--------------------------------

### Get IP Reputation

Source: https://docs.threatbook.io/api-reference/feeds/ip-reputation

Retrieves the reputation details for a given IP address. This includes risk assessment and associated threat intelligence.

```APIDOC
## GET /v1/ip_reputation/{ip}

### Description
Retrieves the reputation details for a given IP address. This includes risk assessment and associated threat intelligence.

### Method
GET

### Endpoint
/v1/ip_reputation/{ip}

### Parameters
#### Path Parameters
- **ip** (string) - Required - The IP address to query.

### Response
#### Success Response (200)
- **risk_level** (string) - The assessed risk level of the IP address (e.g., "high", "medium", "low").
- **threat_categories** (array) - A list of threat categories associated with the IP address (e.g., "malware", "phishing", "botnet").
- **last_seen** (string) - The timestamp when the IP address was last observed in threat activity.
- **details** (object) - Additional details about the IP reputation.
  - **country** (string) - The country of origin for the IP address.
  - **asn** (string) - The Autonomous System Number associated with the IP address.
  - **isp** (string) - The Internet Service Provider for the IP address.

#### Response Example
```json
{
  "risk_level": "high",
  "threat_categories": ["malware", "command_and_control"],
  "last_seen": "2023-10-27T10:30:00Z",
  "details": {
    "country": "US",
    "asn": "AS15169",
    "isp": "Google LLC"
  }
}
```
```

--------------------------------

### File Upload (v2)

Source: https://docs.threatbook.io/llms.txt

Performs rapid detection of potentially malicious files using 22 antivirus scanning engines and sandbox analysis.

```APIDOC
## POST /enrichment/file-upload-v2

### Description
For potentially malicious files from office endpoints, Web/FTP/email attachments, or suspicious files on endpoints/servers, the system performs rapid detection using **22 antivirus scanning engines**. Based on the file type, the system automatically selects an appropriate sandbox environment for dyn…

### Method
POST

### Endpoint
/enrichment/file-upload-v2
```

--------------------------------

### Get File Intelligence Report

Source: https://docs.threatbook.io/api-reference/enrichment/file-intelligence-v2

Retrieves a report containing intelligence about a specific file. This is useful for security analysis and threat hunting.

```APIDOC
## GET /intelligence/file/v2

### Description
Retrieves a report containing intelligence about a specific file. This is useful for security analysis and threat hunting.

### Method
GET

### Endpoint
/intelligence/file/v2

### Parameters
#### Query Parameters
- **resource** (string) - Required - The file hash or identifier to query.
- **apikey** (string) - Required - Your API key for authentication.

### Response
#### Success Response (200)
- **data** (object) - Contains the file intelligence report.
  - **sha256** (string) - The SHA256 hash of the file.
  - **md5** (string) - The MD5 hash of the file.
  - **sha1** (string) - The SHA1 hash of the file.
  - **file_type** (string) - The detected type of the file (e.g., 'PE32 executable (GUI) Intel 80386, for MS Windows').
  - **file_size** (integer) - The size of the file in bytes.
  - **first_seen** (string) - The date and time when the file was first seen.
  - **last_seen** (string) - The date and time when the file was last seen.
  - **tags** (array) - A list of tags associated with the file (e.g., 'malware', 'trojan').
  - **threat_score** (integer) - A score indicating the threat level of the file.
  - **imphash** (string) - The import hash of the file.
  - **sig** (string) - Digital signature information.
  - **ver** (string) - File version information.
  - **company** (string) - The company associated with the file.
  - **product** (string) - The product name associated with the file.
  - **description** (string) - A description of the file.
  - **original_filename** (string) - The original filename.
  - **internal_name** (string) - The internal name of the file.
  - **copyright** (string) - Copyright information.
  - **trid** (array) - An array of file type identification results.
    - **id** (integer) - The ID of the file type.
    - **name** (string) - The name of the file type.
    - **confidence** (integer) - The confidence level of the identification.
  - **yara_rules** (array) - A list of YARA rules that matched the file.
    - **rule_name** (string) - The name of the YARA rule.
    - **meta** (object) - Metadata associated with the YARA rule.
    - **strings** (array) - Strings found by the YARA rule.
  - **intelligence** (object) - Threat intelligence details.
    - **avclass** (string) - Classification by AV engines.
    - **family** (string) - The malware family name.
    - **malware_type** (string) - The type of malware.
    - **threat_name** (string) - The specific threat name.
    - **threat_category** (string) - The category of the threat.
    - **threat_alias** (string) - Aliases for the threat.
    - **threat_status** (string) - The current status of the threat.
    - **threat_severity** (string) - The severity of the threat.
    - **threat_origin** (string) - The origin of the threat.
    - **threat_target** (string) - The target of the threat.
    - **threat_campaign** (string) - The campaign associated with the threat.
    - **threat_actors** (array) - A list of threat actors involved.
    - **mitre_attack** (array) - MITRE ATT&CK framework tactics and techniques.
      - **tactic** (string) - The ATT&CK tactic.
      - **technique_id** (string) - The ATT&CK technique ID.
      - **technique_name** (string) - The ATT&CK technique name.

#### Response Example
```json
{
  "data": {
    "sha256": "a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890",
    "md5": "d41d8cd98f00b204e9800998ecf8427e",
    "sha1": "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
    "file_type": "PE32 executable (GUI) Intel 80386, for MS Windows",
    "file_size": 102400,
    "first_seen": "2023-01-15T10:30:00Z",
    "last_seen": "2023-10-26T14:45:00Z",
    "tags": ["malware", "ransomware"],
    "threat_score": 85,
    "imphash": "1234567890abcdef1234567890abcdef",
    "sig": "Verified",
    "ver": "1.0.0.0",
    "company": "Example Corp",
    "product": "Example Product",
    "description": "A sample executable file.",
    "original_filename": "setup.exe",
    "internal_name": "setup",
    "copyright": "© 2023 Example Corp",
    "trid": [
      {
        "id": 48261,
        "name": "Microsoft Visual C++ 2015-2022 runtime",
        "confidence": 90
      }
    ],
    "yara_rules": [
      {
        "rule_name": "SuspiciousPE",
        "meta": {"author": "Threat Intel Team"},
        "strings": ["$s1 = \"evil_string\""]
      }
    ],
    "intelligence": {
      "avclass": "Trojan.Generic",
      "family": "WannaCry",
      "malware_type": "Ransomware",
      "threat_name": "WannaCry Ransomware",
      "threat_category": "Destructive",
      "threat_alias": "WCry",
      "threat_status": "Active",
      "threat_severity": "High",
      "threat_origin": "North Korea",
      "threat_target": "Global",
      "threat_campaign": "2017 Ransomware Attacks",
      "threat_actors": ["Lazarus Group"],
      "mitre_attack": [
        {"tactic": "Initial Access", "technique_id": "T1566", "technique_name": "Phishing"},
        {"tactic": "Execution", "technique_id": "T1059", "technique_name": "Command and Scripting Interpreter"}
      ]
    }
  }
}
```

#### Error Responses
- **400 Bad Request**: Returned if the `resource` or `apikey` parameter is missing or invalid.
- **401 Unauthorized**: Returned if the API key is invalid or the account status is not active.
- **404 Not Found**: Returned if no report is found for the specified file.
- **405 Method Not Allowed**: Returned if an invalid HTTP method is used.
- **429 Too Many Requests**: Returned if the rate limit has been exceeded.
```
Tokens:
Raw