External DocumentationTo learn more, visit the Intel Owl documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Observables | An array of observables. Each Observable should be formatted as an array containing the observable classification (url, domain, hash, ip, generic) and its name. For Example: |
| Playbook | The name of the playbook to execute for the analysis. |
| TLP | Traffic Light Protocol classification level to control information sharing. |
| Tags Labels | A comma-separated list of tag labels to assign to the analysis. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Analyzers Runtime Configuration | A configuration object to override default analyzers configuration. For example: Runtime Configuration, refer to Intel Owl API documentation. |
Example Output
{
"results": [
{
"job_id": 69,
"analyzers_running": [
"AdGuard",
"Classic_DNS",
"CloudFlare_DNS",
"CloudFlare_Malicious_Detector",
"DNS0_EU",
"DNS0_EU_Malicious_Detector",
"DNStwist",
"Google_DNS",
"Phishstats",
"Quad9_DNS",
"Quad9_Malicious_Detector",
"Robtex",
"Thug_URL_Info",
"Tranco",
"TweetFeed",
"UltraDNS_DNS",
"UltraDNS_Malicious_Detector"
],
"connectors_running": [],
"visualizers_running": [
"Data_Model"
],
"playbook_running": "FREE_TO_USE_ANALYZERS",
"investigation": 4,
"status": "accepted",
"already_exists": false
},
{
"job_id": 70,
"analyzers_running": [
"AdGuard",
"CheckDMARC",
"Classic_DNS",
"CloudFlare_DNS",
"CloudFlare_Malicious_Detector",
"Crt_sh",
"DNS0_EU",
"DNS0_EU_Malicious_Detector",
"DNStwist",
"Google_DNS",
"Mnemonic_PassiveDNS",
"Onionscan",
"Phishstats",
"Quad9_DNS",
"Quad9_Malicious_Detector",
"Robtex",
"Thug_URL_Info",
"Tranco",
"TweetFeed",
"UltraDNS_DNS",
"UltraDNS_Malicious_Detector"
],
"connectors_running": [],
"visualizers_running": [
"Data_Model"
],
"playbook_running": "FREE_TO_USE_ANALYZERS",
"investigation": 4,
"status": "accepted",
"already_exists": false
},
{
"job_id": 71,
"analyzers_running": [
"BGP_Ranking",
"Classic_DNS",
"FireHol_IPList",
"IPApi",
"IPQuery",
"Mmdb_server",
"Mnemonic_PassiveDNS",
"Phishstats",
"Robtex",
"Stratosphere_Blacklist",
"TalosReputation",
"TorProject",
"Tor_Nodes_DanMeUk",
"TweetFeed",
"WhoIs_RipeDB_Search"
],
"connectors_running": [],
"visualizers_running": [
"Data_Model"
],
"playbook_running": "FREE_TO_USE_ANALYZERS",
"investigation": 4,
"status": "accepted",
"already_exists": false
},
{
"job_id": 72,
"analyzers_running": [
"Cymru_Hash_Registry_Get_Observable",
"HashLookupServer_Get_Observable",
"OrklSearch",
"TweetFeed"
],
"connectors_running": [],
"visualizers_running": [
"Data_Model"
],
"playbook_running": "FREE_TO_USE_ANALYZERS",
"investigation": 4,
"status": "accepted",
"already_exists": false
}
],
"count": 4
}
Workflow Library Example
Send Observable Analysis Playbook Request with Intel Owl and Send Results Via Email