# IBM X-Force Exchange integration

> IBM X-Force Threat Intelligence API: IP, URL, malware, vulnerability, DNS and WHOIS reports, indicator feeds, threat reports, collections and TAXII/STIX exports.

- Authentication: apiKey

## Tools (105)

- **Add Collection link**: Adds a Collection link to a Collection.
- **Anonymization Services - IPv4**: Returns a list of IPv4 addresses that are categorized as anonymization services.
- **Anonymization Services - IPv6**: Returns a list of IPv6 addresses that are categorized as anonymization services.
- **Anonymization Services - URL**: Returns a list of URL addresses that are categorized as anonymization service.
- **Benign - IPv4**: Returns a list of IPv4 addresses that are categorized as benign.
- **Benign - IPv6**: Returns a list of IPv6 addresses that are categorized as benign.
- **Benign - URL**: Returns a list of URLs that are categorized as benign.
- **Botnet CnC Servers - IPv4**: Returns a list of IPv4 addresses that are categorized as botnet command and control servers.
- **Botnet CnC Servers - IPv6**: Returns a list of IPv6 addresses that are categorized as botnet command and control servers.
- **Botnet CnC Servers - URL**: Returns a list of URLs that are categorized as botnet command and control server urls.
- **Bots - IPv4**: Returns a list of IPv4 addresses that are categorized as bots.
- **Bots - IPv6**: Returns a list of IPv4 addresses that are categorized as bots.
- **Collection metadata**: This is the TAXII 2 endpoint to get collection metadata.
- **Collection objects**: This is the TAXII 2 endpoint to get collection content objects in STIX 2.x format.
- **Cryptocurrency mining - IPv4**: Returns a list of IPv4 addresses that are categorized as Cryptocurrency mining.
- **Cryptocurrency mining - IPv6**: Returns a list of IPv6 addresses that are categorized as Cryptocurrency mining hosts.
- **Cryptocurrency mining - URL**: Returns a list of URLs that are categorized as Cryptocurrency mining.
- **Delete Linked Collection**: Removes the linked Collection from the specified Collection.
- **Early Warning - URL**: Returns a list of URLs that are categorized as early warning.
- **Generate API Key and Password**: Returns an API key and password pair, which are needed when accessing the API as an logged in user.
- **Get all App Profiles**: Returns list of all Internet Application Profiles (IAP).
- **Get an object in STIX format**: Return an Object in STIX format. Access to this information is restricted to paid users.
- **Get API Root Information**: This is the TAXII 2 root information endpoint.
- **Get API Root Information (TAXII2)**: Returns api root resource contains general information about the API Root. Returns information contains title, description, TAXII versions and maximum size of the content body.
- **Get API usage details**: Get API usage details per month for each subscription type.
- **Get App Profile by Name**: Returns the Internet Application Profiles (IAP) that needs to be fetched.
- **Get a TIS object in STIX format**: Return a TIS Object (Threat Group, Industry or Malware report) in STIX format. Access to this information is restricted to paid users.
- **Get Attachment by ID**: Get an attachment for a specified Collection by ID.
- **Get Attachments**: Get all attachments for a specified Collection.
- **Get botnets information in STIX format**: Return the full list of botnets in STIX format with their associated Command and Control server details. Access to this information is restricted to paid users.
- **Get by Microsoft Security Bulletin ID**: Returns the vulnerability associated with the entered Microsoft Security Bulletin ID.
- **Get by STDCODE**: Returns the vulnerability associated with the entered stdcode. Supported codes are CVE, BID, US-CERT VU# and RHSA.
- **Get by XFID**: Returns the vulnerability associated with the entered xfdbid.
- **Get by XPU**: Returns list of all signatures associated with the entered XPU.
- **Get Collection as STIX Markup**: Returns a STIX representation of a Collection with Attachments
- **Get Collection by ID**: Returns a JSON representation of a Collection Returns details for a given Collection.
- **Get Collection by ID (TAXII2)**: Returns information for a specific collection. Returns general information about the collection, such as id, title, description, can_read, can_write and media_types.
- **Get Collections**: This is the TAXII 2 getCollections endpoint.
- **Get Collections by Group ID**: Returns a list of Collections for a given Group ID. This endpoint returns a list of Collections for a given Group ID.
- **Get Collections (TAXII2)**: Returns general information about all accessiable collections. Returns a list of public/private/shared collection resources which users have the access.
- **Get Current Version**: Returns information on the current running API version.
- **Get DNS records**: Returns live and passive DNS records.
- **Get early warning feed**: Returns the list of domains in early warning feed. Access to this information is restricted to paid users.
- **Get file attachment**: Get a file attachment for a specified Collection by ID.
- **Get Industries**: Return a list of Industry Analysis Reports Access to this information is restricted to paid users.
- **Get Industry by ID**: Return a Industry Analysis Report Full access to this information is restricted to paid users. Freeium users will have access to a selected set of sample reports.
- **Get IPR category list**: Return a list of IP categories provided by XFE.
- **Get IP Report**: Returns the IP report for the entered IP.
- **Get IP Reputation**: Returns the IP reputation report for the entered IP.
- **Get IP Reputation updates (Deltas)**: The Delta API provides the data as a bulk download ("base content") for each category supported, followed by periodic downloads of content updates ("deltas") for the category.
- **Get IPs by Category**: Return a list of IPs according to the category and date range. Access to this information is restricted to paid users.
- **Get latest public Collections**: Gets latest public Collections that you are able to see. Returns a list of publicly accessible Collections.
- **Get linked Collections**: Gets all linked Collections that you are able to see for the specified Collection.
- **Get list of all XPU's**: Returns list of all XPU's
- **Get Malware Analysis**: Return a list of Malware Analysis Reports Access to this information is restricted to paid users.
- **Get Malware Analysis by ID**: Return a Malware Analysis Report Full access to this information is restricted to paid users. Freemium users will have access to selected set of reports.
- **Get Malware for Family**: Returns the malware associated with the entered family.
- **Get Malware for File Hash**: Returns a malware report for the given file hash, For example, md5, sha1 and sha256.
- **Get Malware for IP**: Returns the malware associated with the entered IP.
- **Get Malware for URL**: Returns the malware associated with the entered URL.
- **Get manifest by Collection ID**: Returns manifest about objects from a Collection. Returns manifest information about all available objects. The information contains id, date_added and media_types.
- **Get networks for ASN**: Returns all networks that are assigned to an Autonomous System Number
- **Get Object by Object ID**: Returns an object from a Collection by object id. Returns general information for the specific object in one collection.
- **Get Objects by Collection ID**: Returns objects information from a collection. Retrive all avaiable objects in a Collection. {collectionID} must be in UUID format. For example: d4ff8286-b4ed-38f7-0520-4cbfcf8216fa.
- **Get Object's version by Object ID**: Returns an object's version from a Collection by object id. Returns version information for the specific object in one collection.
- **Get OSINT advisories**: Return a list of OSINT Advisory Reports Access to this information is restricted to paid users.
- **Get PAM Signature**: Returns the signature details associated with the entered pamID or pamName.
- **Get Premier Threat Intelligence Reports by ID**: Return a detailed Threat Intelligence Report for a provided ID Full access to this information is restricted to paid users. Freemium users will have access to selected set of reports.
- **Get premier threat intelligence reports by selected report type**: Return premium threat intelligence reports Full access to this information is restricted to paid users. Freemium users will have access to selected set of reports.
- **Get private Collections**: Gets all of your Collections This endpoint returns all the Collections that you have created, whether they are shared or not.
- **Get public Collections using pagination**: Gets all public Collections that you are able to see using pagination. Returns a list of all publicly accessible Collections using pagination.
- **Get Recent Vulnerabilities**: Returns recent vulnerabilities.
- **Get Server Discovery Resource**: Returns a discovery resource contains information about a TAXII Server. Returns a list of available api roots.
- **Get shared Collections**: Gets all shared Collections that you are able to see. Returns a list of all Collections that have been shared with you.
- **Get Threat analysis**: Return a list of Threat Analysis Reports Access to this information is restricted to paid users.
- **Get Threat Group by ID**: Return a Threat Group Profile Full access to this information is restricted to paid users. Freemium users will have access to selected set of reports.
- **Get Threat Groups**: Return a list of Threat Group Profiles Access to this information is restricted to paid users.
- **Get Updated Vulnerabilities**: Returns a list of vulnerabilities that were updated
- **Get URL category list**: Return a list of URL categories provided by XFE.
- **Get URL History**: Returns the URL history for the entered URL.
- **Get URL Report**: Returns the URL report for the entered URL.
- **Get URLs by Category**: Return a list of URLs according to the category and date range. Access to this information is restricted to paid users.
- **Get URL updates (Deltas)**: The Delta API provides the data as a bulk download ("base content") for each category supported, followed by periodic downloads of content updates ("deltas") for the category.
- **Get User Information**: Returns information about the user's profile
- **Get Vulnerabilities in bulk**: Returns vulnerabilities in bulk.
- **Get WHOIS information**: Returns a JSON object containing information about the given host address.
- **Import Reports**: Endpoint to add reports to a casefile.
- **Malware - IPv4**: Returns a list of IPv4 addresses that are categorized as malware.
- **Malware - IPv6**: Returns a list of IPv6 addresses that are categorized as malware.
- **Malware - URL**: Returns a list of URLs that are categorized as malware.
- **Phishing - URL**: Returns a list of URLs that are categorized as phishing.
- **Read TAXII Data**: Trusted Automated eXchange of Indicator Information version 1.1 This is the endpoint for TAXII services for X-Force Threat Intelligence - Protection Feed.
- **Read/Write TAXII Data**: Trusted Automated eXchange of Indicator Information version 1.1 This is the single endpoint for TAXII services. TAXII message must be transmitted via this endpoint over HTTPS.
- **Revoke API Key**: Revoke specific API Key
- **Scanning IPs - IPv4**: Returns a list of IPv4 addresses that are categorized as scanning IPs.
- **Scanning IPs - IPv6**: Returns a list of IPv6 addresses that are categorized as scanning IPs.
- **Search App Profiles**: Returns list of all Internet Application Profiles (IAP) associated with the search term.
- **Search private Collections**: Returns a list of private Collections that were found This endpoint searches the title and wiki content of private collections that were created by owner, shared with me, or shared with a group of which I am a member and returns the result
- **Search public Collections**: Returns a list of public Collections that were found This endpoint searches the title and wiki content of public Collections and returns the result.
- **Search Signatures**: Returns list of all signatures associated with the search term.
- **Search Vulnerabilities**: Returns list of all vulnerabilities associated with the search term.
- **Tag Search**: Returns a list of tagged collections and reports. The tags will be parsed out from the query parameter. A tag has the structure '#example'.
- **Top Activity - URL / 10K**: Returns the top ten thousand URLs rated by activity as known by X-Force Exchange.
- **Upload Collection File Attachment**: Endpoint to initiate the upload of a file.
- **Wildcard search Malware family**: Returns the malware associated with the entered family using wildcard search.

Connect IBM X-Force Exchange in General Input: https://www.generalinput.com/apps/ibm-x-force-exchange