Query Data for a Specific Threat Indicator

You can query the platform to retrieve all data for a single threat indicator, such as a specific IP address, host name, or URL.

Query for a Specific IP Address

If you wanted to search for all instances of IP address 1.2.3.4 in csv format, you could submit the following curl request:

If you wanted to search for all instances of IP address 1.2.3.4 detected in the last day in csv format, you could submit the following curl request:

If you wanted to search for all instances of IP address 1.2.3.4 which were reported as Zero Access Bots in csv format, you could submit the following curl request:

(A list of valid properties can be found at the API /api/data/properties.)

Query for a Specific Host Name

If you wanted to search for all instances of host example.com in csv format, you could submit the following curl request:

If you wanted to search for all instances of host example.com imported in the last hour in csv format, you could submit the following curl request:

If you wanted to search for all instances of host example.com for threat class Malware C2 in csv format, you could submit the following curl request:

(A list of valid threat classes can be found at the API /api/data/threat_classes.)

Query for a Specific URL

If you wanted to search for all instances of URL http://www.example.com, you could submit the following curl request:

If you wanted to search for all instances of URL http://www.example.com detected since August 1, 2017 UTC, you could submit the following curl request:

If you wanted to search for all instances of URL http://www.example.com detected since August 1, 2017 UTC and targeting your company, you could submit the following curl request: