Flashpoint Deprecated

Deprecated. Use Flashpoint Ignite instead.

Data Enrichment & Threat Intelligence · Flashpoint

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • url — Server URL (required)
  • api_key — API Key (required)
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time interval
  • fetch_type — Fetch Type
  • is_fresh_compromised_credentials — Fetch fresh compromised credentials alerts
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • create_relationships — Create relationships
  • integrationReliability — Source Reliability
  • feedExpirationPolicy —
  • feedExpirationInterval —

Commands (20)

  • domain

    Lookup the "Domain" type indicator details. The reputation of Domain is considered Malicious if there's at least one IOC event in Flashpoint database matching the Domain indicator.

  • email

    Lookup the "Email" type indicator details. The reputation of Email is considered Malicious if there's at least one IOC event in Flashpoint database matching the Email indicator.

  • file

    Lookup the "File" type indicator details. The reputation of File-hash is considered Malicious if there's at least one IOC event in Flashpoint database matching the File-hash indicator.

  • filename

    Lookup the "Filename" type indicator details. The reputation of Filename is considered Malicious if there's at least one IOC event in Flashpoint database matching the Filename indicator.

  • flashpoint-alert-list

    Retrieves an alert or a list of alerts based on the filter values provided in the command arguments. Yields the alerts from Flashpoint collected sources and the alerts from data exposure.

  • flashpoint-common-lookup

    Lookup any type of indicator.

  • flashpoint-compromised-credentials-list

    Retrieves the compromised credentials based on the filter values provided in the command arguments.

  • flashpoint-get-events

    Searches for events within the specified time-period, the report fpid, or attack IDs.

  • flashpoint-get-forum-details

    Retrieves forum details using the forum ID. To retrieve the forum ID run the flashpoint-search-forum-posts command and see the value under the following context paths, Flashpoint.Forum.ForumId or Flashpoint.Forum.Post.Forum.id.

  • flashpoint-get-forum-post-details

    Retrieves post details using the post-id. To retrieve the post ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.PostId context path. command or some other investigation.

  • flashpoint-get-forum-room-details

    Retrieves forum room details using the room ID. To retrieve the room ID run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.Room.id context path.

  • flashpoint-get-forum-user-details

    Retrieves user details using the user-id. To retrieve the user ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.User.id context path.

  • flashpoint-get-related-reports

    Get related reports for a particular report using the report-id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation.

  • flashpoint-get-single-event

    Retrieves the details of a single event using event UUID or FPID. To retrieve the event id, run the get-events command and see the value under the Flashpoint.Event.EventId context path. or indicator reputation command response or some other investigation.

  • flashpoint-get-single-intelligence-report

    Get single report details using the report id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation.

  • flashpoint-search-forum-posts

    Search forum posts using a keyword.

  • flashpoint-search-forum-sites

    Searches forum sites using a keyword. it will search in site content like name, title, descripion etc.

  • flashpoint-search-intelligence-reports

    Search for the Intelligence Reports using a keyword.

  • ip

    Looks up details of an IP indicator. The reputation of the IP address is considered malicious if there's at least one IOC event in the Flashpoint database that matches the IP indicator. Alternatively, the IP address is considered suspicious if it matches any one of the Torrent's Peer IP Address or Forum Visit's Peer IP Address.

  • url

    Lookup the "URL" type indicator details. The reputation of Url is considered Malicious if there's at least one IOC event in Flashpoint database matching the Url indicator.