EclecticIQ Platform API

MITRE Attacks
- Get a list of MITRE Attacks.get
- Get MITRE Attack by ID.get
Datasets
Enrichers
Entities
Files
Groups
Incoming feeds
Knowledge Packs
Observables
Outgoing feeds
Permissions
- Returns a list of permissions on the platform.get
- Get a user permission by ID.get
Relationships
Roles
Discovery Rules
Enrichment Rules
Entity Rules
Observable Rules
Sources
- Get a list of all sources.get
- Get an source by ID.get
Tasks
Taxonomies
Tickets
Ticket Comments
- Get a ticket comment by ID.get
- Create a comment on a ticket.post
Users
Workspaces
Workspace Comments
Relation

Modify an enricher.

patch http://localhost/api/v1/enrichers/{id}

Required permissions

modify enrichers

Optional permissions

read tasks Required to access the task associated to an enricher

URL Expired

The URL for this request expired after 30 days.

Path Params

int32

required

≥ 1

Enricher ID

Query Params

overwrite_source_urls

boolean

If true (default) then overwrite the existing source_urls with the new mapping, otherwise extend them.

overwrite_parameters

boolean

If true (default) then overwrite the existing parameters with the new mapping, otherwise extend them.

attributes

string

Comma-separated list of attributes to be returned. Nested attributes are separated by dots - e.g. data.title

Responses

Response body

object

data

object

cache_validity

int32

Cache the enriched observables for the specified amount of seconds.

created_at

string

Timestamp in UTC ISO-8601 format

description

string

enricher

string

required

Fully qualified name of the module that contains the enrichment function. An enrichment function must be a Python function that takes at least two arguments (observable type and value) as input parameters. Example enricher function name: eiq.extensions.my_module.my_function

execution_cap

int32

Maximum number of executions per month.

int32

is_active

boolean

required

name

string

It must be unique and only include alphanumeric characters and underscores. By default the name of the enricher will be used.

parameters

string

Enrichment task parameters.

rate_limit

int32

The maximum allowed number of executions per second.

source

string

Source associated to the enricher

source_reliability

string

Source reliability assigned to the entities created by the enricher.

A B C D E F

source_urls

string

observable_type -> url mapping. You can refer to the observable value in the URL as ${input}.

supported_observable_types

array of strings

required

List of observable types this enricher applies to.

supported_observable_types*

task

string

URL of the task associated to this enricher

tlp_color

string | null

TLP color for the processed entities

NONE WHITE GREEN AMBER RED

Response body

object

detail

string

status

integer

title

string

Response body

object

detail

string

status

integer

title

string

Response body

object

detail

string

status

integer

title

string

Updated 2 months ago

Get an enricher by ID.

Entities

Language

Credentials

Bearer

JWT


xxxxxxxxxx
1
curl --request PATCH \
2
     --url http://localhost/api/v1/enrichers/id \
3
     --header 'accept: application/json'

Click Try It! to start a request and see the response here! Or choose an example:

application/json

Updated 2 months ago

Get an enricher by ID.

Entities

EclecticIQ Platform API
MITRE Attacks
Get MITRE Attack by ID.get
Get a list of MITRE Attacks.get
Datasets
Update a dataset.patch
Get a dataset by ID.get
Delete a dataset.delete
Create (or update if the name already exists) one or more datasets.put
Create a dataset.post
Get a list of datasets.get
Delete a set of datasets referenced by IDs.delete
Enrichers
Modify an enricher.patch
Get an enricher by ID.get
Enriches all given extracts and/or entities with a list of enrichers or with all available enrichers (if `enricher_tasks` is empty). If a list entities is provided, all entity extracts are enriched.post
Create (or modify if the name already exists) one or more enrichers.put
Create a new enricher.post
Get a list of enrichers.get
Entities
Update an entity by ID.patch
Get an entity by ID.get
Delete an entity by ID.delete
Create (or update/create a new version if the STIX ID already exists) one or more entities.put
Create an entity.post
Get a list of entities.get
Delete a set of entities referenced by internal or STIX IDs.delete
Files
Download a file by ID.get
Get a workspace file by ID.get
Delete a workspace file by ID.delete
Create a new file in a workspace.post
Get a list of workspace files.get
Delete a set of files referenced by IDs.delete
Download an entity attachment by ID.get
Get an entity attachment by ID.get
Delete an entity attachment by ID.delete
Create a new entity.post
Get a list of entity attachments.get
Delete a set of attachments referenced by IDs.delete
Groups
Update a group.patch
Get a group by ID.get
Delete a group by ID.delete
Create (or modify if the name already exists) one or more groups.put
Create a group.post
Returns a list of the groups on the platform.get
Delete a set of groups referenced by IDs.delete
Incoming feeds
Edit an incoming feed configuration by ID.patch
Get an incoming feed by ID.get
Delete an incoming feed configuration by ID.delete
Create (or update if the name already exists) an incoming feed.put
Configure a new incoming feed. Depending on the content type it will be required to provide additional transport configuration fields. For more details see the documentationpost
Get a list of incoming feeds.get
Delete a set of incoming feeds referenced by IDs.delete
Knowledge Packs
Update a knowledge pack.patch
Get a Knowledge Pack by ID.get
Delete a knowledge pack as publisher.delete
Create (or modify if already exists) one or more knowledge packs.put
Create a new knowledge pack.post
Returns a list of knowledge packs.get
Observables
Edit an observable by ID.patch
Get an observable by ID.get
Delete an observable by ID.delete
Create (or update if the (`type`, `value`) pair already exists) one or more observables.put
Create a new observable.post
Get a list of observables.get
Delete a set of observables referenced by IDs.delete
Outgoing feeds
Edit an outgoing feed configuration by ID.patch
Get an outgoing feed by ID.get
Delete an outgoing feed configuration by ID.delete
Create (or update if the name already exists) one or more outgoing feeds.put
Configure a new outgoing feed. Depending on the content type it will be required to provide additional transport configuration fields. For more details see the documentationpost
Get a list of outgoing feeds.get
Delete a set of outgoing feeds referenced by IDs.delete
Permissions
Get a user permission by ID.get
Returns a list of permissions on the platform.get
Relationships
Get a relationship by ID.get
Delete a relationship by ID.delete
Create a relationship.post
Get a list of relationships.get
Delete relationships based on source and/or target.delete
Roles
Update a role.patch
Get a role by ID.get
Delete a role by ID.delete
Create (or modify if the name already exists) one or more roles.put
Create a role.post
Returns a list of roles on the platform.get
Delete a set of roles referenced by IDs.delete
Discovery Rules
Edit an discovery rule by ID.patch
Get an discovery rule by ID.get
Delete an discovery rule by ID.delete
Create (or update if the name already exists) one or more discovery rules.put
Create a new discovery rule.post
Get a list of discovery rules.get
Delete a set of discovery_rules referenced by IDs.delete
Enrichment Rules
Edit an enrichment rule by ID.patch
Get an enrichment rule by ID.get
Delete an enrichment rule by ID.delete
Create (or update if the name already exists) one or more enrichment rules.put
Create a new enrichment rule.post
Get a list of enrichment rules.get
Delete a set of enrichment rules referenced by IDs.delete
Entity Rules
Edit an entity rule by ID.patch
Get an entity rule by ID.get
Delete an entity rule by ID.delete
Create (or update if the name already exists) one or more entity rules.put
Create a new entity rule.post
Get a list of entity rules.get
Delete a set of entity rules referenced by IDs.delete
Observable Rules
Edit an observable rule by ID.patch
Get an observable rule by ID.get
Delete an observable rule by ID.delete
Create (or update if the name already exists) one or more observable rules.put
Create a new observable rule.post
Get a list of observable rules.get
Delete a set of observable rules referenced by IDs.delete
Sources
Get an source by ID.get
Get a list of all sources.get
Tasks
Edit a task by ID.patch
Get a task by ID.get
Get a task run by ID.get
Stop a task execution by task run ID.delete
Run a task.post
Get a list of task runs.get
Get a list of tasks.get
Taxonomies
Update a taxonomy node.patch
Get a taxonomy node by ID.get
Delete a taxonomy node or a sub-tree.delete
Create taxonomy nodes by specifying a single node or a node path.put
Create taxonomy nodes by specifying a single node or a node path.post
Get a list of taxonomies.get
Delete a set of taxonomies nodes referenced by IDs.delete
Tickets
Update a ticket by ID.patch
Get a ticket by ID.get
Delete a ticket by ID.delete
Create a ticket.post
Get a list of all tickets.get
Delete a set of tickets referenced by IDs.delete
Ticket Comments
Create a comment on a ticket.post
Get a ticket comment by ID.get
Users
Update a user.patch
Get a user by ID.get
Create (or update if the name already exists) one or more users.put
Create a user.post
Returns a list of users on the platform.get
Workspaces
Edit a workspace by ID.patch
Get a workspace by ID.get
Delete a workspace by ID.delete
Create (or update if the name already exists) one or more workspaces.put
Create a new workspace.post
Get a list of workspaces.get
Delete a set of workspaces referenced by IDs.delete
Workspace Comments
Create a new workspace comment.post
Get the content of the comments of a workspace.get
Modify a workspace comment by ID.patch
Get a workspace comment by ID.get
Delete a workspace comment by ID.delete
Delete a set of workspace comments referenced by IDs.delete
Relation
Generic endpoint for adding a relation based on "main object" type and id and related object type and id.put
Generic endpoint for deleting a relation based on "main object" type and id and related object type and id.delete
Generic endpoint for bulk adding relations based on "main object" type and id and related objects type and ids (provided in request body).put
Generic endpoint for bulk deleting relations based on "main object" type and id and related objects type and ids (provided in request body).delete

200The updated object

401Unauthorized request

403Missing permissions

404Element not found