Send Observable Analysis Playbook Request

Submit an observable for security analysis using a specific playbook.

External Documentation

To learn more, visit the Intel Owl documentation.

​

Basic Parameters

Parameter	Description
Observables	An array of observables. Each Observable should be formatted as an array containing the observable classification (url, domain, hash, ip, generic) and its name. For Example: [ [“url”, “http://google.com/”], [“domain”, “example.com”], [“ip”, “8.8.8.8”], [“hash”, “d41d8cd98f00b204e9800998ecf8427e”] ]
Playbook	The name of the playbook to execute for the analysis.
TLP	Traffic Light Protocol classification level to control information sharing.
Tags Labels	A comma-separated list of tag labels to assign to the analysis.

​

Advanced Parameters

Parameter	Description
Analyzers Runtime Configuration	A configuration object to override default analyzers configuration. For example: { “Doc_Info”: { “additional_passwords_to_check”: [“passwd”, “2020”] } } For more information about the Runtime Configuration, refer to Intel Owl API documentation.

​

Example Output

{
	"results": [
		{
			"job_id": 69,
			"analyzers_running": [
				"AdGuard",
				"Classic_DNS",
				"CloudFlare_DNS",
				"CloudFlare_Malicious_Detector",
				"DNS0_EU",
				"DNS0_EU_Malicious_Detector",
				"DNStwist",
				"Google_DNS",
				"Phishstats",
				"Quad9_DNS",
				"Quad9_Malicious_Detector",
				"Robtex",
				"Thug_URL_Info",
				"Tranco",
				"TweetFeed",
				"UltraDNS_DNS",
				"UltraDNS_Malicious_Detector"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 70,
			"analyzers_running": [
				"AdGuard",
				"CheckDMARC",
				"Classic_DNS",
				"CloudFlare_DNS",
				"CloudFlare_Malicious_Detector",
				"Crt_sh",
				"DNS0_EU",
				"DNS0_EU_Malicious_Detector",
				"DNStwist",
				"Google_DNS",
				"Mnemonic_PassiveDNS",
				"Onionscan",
				"Phishstats",
				"Quad9_DNS",
				"Quad9_Malicious_Detector",
				"Robtex",
				"Thug_URL_Info",
				"Tranco",
				"TweetFeed",
				"UltraDNS_DNS",
				"UltraDNS_Malicious_Detector"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 71,
			"analyzers_running": [
				"BGP_Ranking",
				"Classic_DNS",
				"FireHol_IPList",
				"IPApi",
				"IPQuery",
				"Mmdb_server",
				"Mnemonic_PassiveDNS",
				"Phishstats",
				"Robtex",
				"Stratosphere_Blacklist",
				"TalosReputation",
				"TorProject",
				"Tor_Nodes_DanMeUk",
				"TweetFeed",
				"WhoIs_RipeDB_Search"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		},
		{
			"job_id": 72,
			"analyzers_running": [
				"Cymru_Hash_Registry_Get_Observable",
				"HashLookupServer_Get_Observable",
				"OrklSearch",
				"TweetFeed"
			],
			"connectors_running": [],
			"visualizers_running": [
				"Data_Model"
			],
			"playbook_running": "FREE_TO_USE_ANALYZERS",
			"investigation": 4,
			"status": "accepted",
			"already_exists": false
		}
	],
	"count": 4
}