b1td Class — Bloxone API Wrapper 0.6.1 documentation

# b1td Class

class `bloxone.` `b1td`(cfg_file='config.ini')

  BloxOne ThreatDefence API Wrapper Covers TIDE and Dossier

  `dossier_sources`()

    Get Sources for Dossier

    Returns

      Requests response object

    Return type

      response object

  `dossierquery`(query, type='host', sources='all')

    Simple Dossier Query

    Parameters

      - query (str) – query data

      - type (str) – “host”, “ip” or “url”

      - sources (str) – set of sources or “all”

    Returns

      Requests response object

    Return type

      response object

  `expand_mitre_vector`(mitre)

    Expand MITRE Vector details

    Parameters

      mitre (str) – MITRE Vector

    Returns

      Requests response object

    Return type

      response object

  `get`(objpath, action='', **params)

    Generic get object wrapper for TIDE data objects

    Parameters

      - objpath (str) – Swagger object path

      - action (str) – Optional object action

    Returns

      Requests response object

    Return type

      response object

  `post`(objpath, body='')

    Generic create object wrapper for ddi objects

    Parameters

      - objpath (str) – Swagger object path

      - body (str) – JSON formatted data payload

    Returns

      Requests response object

    Return type

      response object

  `querytide`(datatype, query, **params)

    Query Infoblox TIDE for all avaialble threat data related to query.

    Parameters

      - datatype (str) – “host”, “ip” or “url”

      - query (str) – query data

    Returns

      Requests response object

    Return type

      response object

  `querytideactive`(datatype, query, **params)

    Query Infoblox TIDE for “active” threat data i.e. threat data that has not expired at time of call

    Parameters

      - datatype (str) – “host”, “ip” or “url”

      - query (str) – query data

    Returns

      Requests response object

    Return type

      response object

  `querytidestate`(datatype, query, **params)

    Query Infoblox TIDE State Tables for specific query

    Parameters

      - datatype (str) – “host”, “ip” or “url”

      - query (str) – query data

    Returns

      Requests response object

    Return type

      response object

  `threat_actor`(name)

    Get Threat Actor details

    Parameters

      name (str) – Name of Threat Actor

    Returns

      Requests response object

    Return type

      response object

  `threat_classes`(**params)

    Get list of threat classes

    Parameters:

    Returns

      Requests response object

    Return type

      response object

  `threat_properties`(threatclass='', **params)

    Get list of threat properties

    Parameters

      threatclass (str) – Threat Class

    Returns

      Requests response object

    Return type

      response object

  `tideactivefeed`(datatype, profile='', threatclass='', threatproperty='', **params)

    Bulk “active” threat intel download from Infoblox TIDE state tables for specified datatype.

    Parameters

      - datatype (str) – “host”, “ip” or “url”

      - profile (str, optional) – Data provider

      - threatclass (str, optional) – tide data class

      - threatproperty (str, optional) – tide data property

    Returns

      Requests response object

    Return type

      response object