Perform a lookup for IOCs to retrieve the list of objects available in Intel Exchange. If some IOCs are not available in the platform, you can choose to create intel and ingest the missing IOCs. You can look up and ingest a maximum of 1000 IOCs in an API request.
You can perform a lookup for the following IOC types:
-
IPv4
-
IPv6
-
Email Address
-
MD5
-
SHA1
-
SHA256
-
SHA512
-
SSDEEP
-
URL
-
Domain
Query Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| enrichment | boolean | optional | Pass true to retrieve the last enriched details of the IOCs. |
| create | boolean | optional | Pass true to create valid IOCs in the payload as threat data objects in the Threat Data module in Intel Exchange. |
Body Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| ioc_values | array | required | Pass a list of up to 1000 IOC values to look up. |
| metadata | object | optional | Pass additional information to associate with the intel. |
| source | object | optional | Pass the details of the source, like the source name. |
| collection | object | optional | Pass the details of the collections, like the collection name. |
Run it
Use the Request parameters panel to enter path IDs, query values, JSON body, and credentials. Then run any snippet below — all languages use the same values. Base URL: https://cs-testv2.cyware.com/ctixapi (change in API Settings).
Playground
Request parameters
Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.
Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.
Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.
Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.
curl --request POST \
--url "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/bulk-lookup-and-create/?enrichment=true&create=true&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
--data '{
"ioc_values": [
"76.77.23.225"
],
"metadata": {},
"source": {},
"collection": {}
}'View-only example — running live API calls requires a role with snippet testing access.
const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/bulk-lookup-and-create/?enrichment=true&create=true&AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";
const response = await fetch(url, {
method: "POST",
headers: {},
body: JSON.stringify({
"ioc_values": [
"76.77.23.225"
],
"metadata": {},
"source": {},
"collection": {}
}),
});
const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);View-only example — running live API calls requires a role with snippet testing access.
import requests
url = "https://cs-testv2.cyware.com/ctixapi/ingestion/threat-data/bulk-lookup-and-create/"
params = {
"enrichment": "true",
"create": "true",
"AccessID": "<your access id>",
"Signature": "<your signature>",
"Expires": "<your expires>"
}
headers = {}
payload = {
"ioc_values": [
"76.77.23.225"
],
"metadata": {},
"source": {},
"collection": {}
}
response = requests.request("POST", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)View-only example — running live API calls requires a role with snippet testing access.
{
"ioc_values": [
"76.77.23.225"
],
"metadata": {},
"source": {},
"collection": {}
}View-only example — running live API calls requires a role with snippet testing access.
{
"found_iocs": {},
"message": "Intel creation successfully inititated for IOCs that were not found in the lookup",
"task_id": "41b9e377-cb6f-41df-9a14-1cc612c0d09a",
"values_not_found": {}
}View-only example — running live API calls requires a role with snippet testing access.