About the ThreatFox Integration
ThreatFox is a threat intelligence platform operated by abuse.ch in partnership with Spamhaus, dedicated to sharing indicators of compromise (IOCs) tied to malware and botnet activity with the infosec community. Analysts use ThreatFox’s crowd-sourced database to look up file hashes, URLs, domains, and IP addresses and surface emerging threats. As Synqly’s Threat Intelligence provider, the ThreatFox integration enables security platforms to enrich file hashes, URLs, domains, and IP addresses with normalized reputation data through a standardized connector, without custom API development.
Integration Use Cases
Lookup Domain
Looks up a domain name against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up domain is disclosed to the third-party intelligence provider, which can reveal internal hostnames. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup Hash
Looks up a file hash against the token-linked threat intelligence source and returns normalized reputation and context. MD5, SHA-1, and SHA-256 hashes are supported; the hash type is detected from the value. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup IP
Looks up an IPv4 or IPv6 address against the token-linked threat intelligence source and returns normalized reputation and context. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup URL
Looks up a URL against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up URL is disclosed to the third-party intelligence provider; avoid looking up URLs that embed secrets (for example, signed URLs) unless that disclosure is acceptable. A lookup that finds no intel records is a successful response with an empty `osint` array.
