Cofense Triage V2
LAST UPDATED: NOVEMBER 10, 2025
Overview
With Cofense Triage Phishing Detection and Response Center, clients can defend against phishing attacks while alleviating the burden on overwhelmed security teams. Integration with the Cofense Triage API Version 2 can help to programmatically create, extract, update, and delete data from Cofense Triage.
D3 SOAR is providing REST operations to function with Cofense Triage V2.
Cofense Triage V2 is available for use in:
Connection
To connect to Cofense Triage V2 from D3 SOAR, follow this part to collect the required information below:
Parameter | Description | Example |
Server URL | The URL of Cofense Triage server. | https://<client-instance>.phishmecloud.com |
Client ID | The client ID for authentication. | AR*****X5_SA |
Client Secret | The client secret for authentication. | Br*****b0s |
API Version | The version of API. | v2 |
Configuring D3 SOAR to Work with Cofense Triage V2
Log in to D3 SOAR.
Find the Cofense Triage V2 integration.
.png?inst-v=edf92d23-a6f6-40a1-8796-cbc923680ded)
Navigate to Configuration on the top header menu.
Click on the Integration icon on the left sidebar.
Type Cofense Triage V2 in the search box to find the integration, then click it to select it.
Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Cofense Triage V2.
.png?inst-v=edf92d23-a6f6-40a1-8796-cbc923680ded)
Connection Name: The desired name for the connection.
Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
Description (Optional): The description for the connection.
Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
Configure User Permissions: Defines which users have access to the connection.
Active: The checkbox that enables the connection to be used when selected.
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
.png?inst-v=edf92d23-a6f6-40a1-8796-cbc923680ded)
1. Input the Server URL. The default value is https://<client-instance>.phishmecloud.com.
2. Copy the Client ID from the Cofense Triage V2 platform.
3. Copy the Client Secret from the Cofense Triage V2 platform.
4. Input the API Version. The default value is v2.
Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Test the connection.
Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
Click OK to close the alert window.
Click + Add to create and add the configured connection.
Commands
Cofense Triage V2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, users can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the Cofense Triage V2 API, refer to the Cofense Triage V2 API reference.
Note for Time-related parameters
The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:
Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose the desired date and time format, then click on the Save button.
The selected time format will now be visible when configuring Date/Time command input parameters.
Add Comment
Creates comments to resources.
READER NOTE
Resource ID is a required parameter to run this command.
If the Resource Type = Reports, the resource ID can be obtained from the Fetch Event command. Report IDs can be found in the returned raw data at the path $.data[*].id.
If the Resource Type = Threat Indicators, the resource ID can be obtained from the List Threat Indicators command. Threat Indicators can be found in the returned raw data at the path $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
ResourceType | Required | The type of the resource. Available options are Reports and Threat Indicators. | Reports |
Resource ID | Required | The ID of the resource to which the comment is being added. | ***** |
Comment | Required | The comment to be added. | Test Comment |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Add Comment failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Add Comment failed. Status Code: 404. Message: The requested resource does not exist. |
Categorize Report
Categorizes reports.
READER NOTE
Report IDs is a required parameter to run this command.
Run the Fetch Event command to obtain the Report IDs. Report IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Report IDs | Required | The report IDs to be categorized. Report ID can be obtained using the Fetch Event command. |
JSON
|
Category Name | Required | The name of the category. | Crimeware |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Categorize Report failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Categorize Report failed. Status Code: 404. Message: The requested resource does not exist. |
Delete Comments
Deletes comments.
READER NOTE
Comment IDs is a required parameter to run this command.
Run the List Comment command to obtain the Comment IDs. Comment IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Comment IDs | Required | The IDs of the comments to be deleted. Comment ID can be obtained using the List Comment command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Delete Comments failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Delete Comments failed. Status Code: 404. Message: The requested resource does not exist. |
Download Attachments
Download attachments.
READER NOTE
Attachment IDs is a required parameter to run this command.
Run the Get Report Attachments command to obtain the Attachment IDs. Attachment IDs can be found in the raw data at $.[*]id.
Input
Input Parameter | Required/Optional | Description | Example |
Attachment IDs | Required | The ID(s) of the attachment(s) to be downloaded. Attachment IDs can be obtained using the Get Report Attachments command. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Download Attachments failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Download Attachments failed. Status Code: 404. Message: The requested resource does not exist. |
Download Original Report
Downloads the raw email associated with the report.
READER NOTE
Report ID is a required parameter to run this command.
Run the Fetch Event command to obtain the Report IDs. Report IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Report ID | Required | The ID of the report to be downloaded. Report ID can be obtained using the Fetch Event command. | ***** |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Download Original Report failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Download Original Report failed. Status Code: 404. Message: The requested resource does not exist. |
Fetch Event
Retrieves a list of events with details based on the specified criteria. These events consist of reported emails ingested by Cofense Triage, and include components like headers, body, domains and URLs, attachments and hashes, along with additional information such as risk score.
Input
Input Parameter | Required/Optional | Description | Example |
Start Time | Required | The start time of the time range, in UTC time. | 2021-05-25 00:00 |
End Time | Required | The end time of the time range, in UTC time. | 2021-05-26 00:00 |
Number of Event(s) Fetched | Optional | The maximum number of events to return. The default value of this field is 20. | 20 |
Search Condition | Optional | The query string to define search condition. The query format is from=<fromValue> subject=<subjectValue> body=<bodyValue> priority=<priorityValue> riskscore=<riskcoreValue> location=<locationValue>. The valid value for priority is 1, 2 , 3, 4, or 5. The valid values for riskscord is from 0 to 100. You can specify multiple values as a comma-separated list. Doing so returns records that match ANY of the supplied values. If the value of the from, subject, or body field contains a space, then the double quotation is needed. For example, "wherever I". The Cofense filter syntax "filter[ATTRIBUTE_OP]=VALUE" can be used for all other fields that are not listed in the description. Please refer to (https://*****.phishmecloud.com/docs/api/v2/index.html#filtering) for the available operators. For example filter[tags_all]=abc,efg will return the events only with both tags "abc" and "efg". | from=*****@*****.com subject="may Rome" body="wherever I" priority=1 riskscore=20 location=inbox,reconnaissance filter[tags_all]=abc,efg |
Fetch Event Field Mapping
The Cofense Triage V2 system integration includes pre-configured field mappings for the default event source.
The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data.
The Main Event JSON Path can be viewed by clicking on the Edit Event Source button.
.png?inst-v=edf92d23-a6f6-40a1-8796-cbc923680ded)
Main Event JSON Path: $.data
The data array contains the event objects. Within each event object, the key id denotes the Unique Event Key field. As such, the full JSONPath expression to extract the Unique Event Key is $.data.id.
The pre-configured field mappings are detailed below:
Field Name | Source Field |
Unique Event Key | .id |
Event Type | .type |
Sender | .attributes.from_address |
Email subject | .attributes.Subject |
Start Time | .attributes.received_at |
Message body | .attributes.text_body |
File Hash MD5 | .attributes.md5 |
File Hash SHA256 | .attributes.sha256 |
Risk Score | .attributes.risk_score |
Raw Headers | .attributes.raw_headers |
Match Priority | .attributes.match_priority |
location | .attributes.location |
RiskScore | .attributes.risk_score |
RawHeaders | .attributes.raw_headers |
MatchPriority | .attributes.match_priority |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Fetch Event failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The request could not be processed due to invalid syntax. |
Error Sample Data Fetch Event failed. Status Code: 400. Message: The request could not be processed due to invalid syntax. |
Generic GET Command
Generic command to take retrieval or download action toward specified resource.
Input
Input Parameter | Required/Optional | Description | Example |
Action | Optional | The action to be performed on the specified resource. Please note that the Download action is applicable only to Report, Attachment, and Attachment Payloads resources. When selecting the Download action, you must specify the Resource ID. | Download |
Resource Name | Required | The name of the resource on which to take action. Please note that the Download action can only be applied to Attachments, Attachment Payloads, and Reports resources. The Retrieve action can be applied to all resources. | Reports |
Resource ID | Optional | The ID of the resource on which to take action. If not specified, all resources of the specified Resource Name will be retrieved. For the Download action, the Resource ID is required. | ***** |
Filter | Optional | The filter conditions used to refine the returned resources. This parameter is only applicable when performing the Retrieve action without specifying the Resource ID. | filter[risk_score_gteq]=20[received_at_gteq]=2021-01-01 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Generic GET Command failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The request could not be processed due to invalid syntax. |
Error Sample Data Generic GET Command failed. Status Code: 400. Message: The request could not be processed due to invalid syntax. |
Get Report Attachments
Retrieves all attachments of the specified reports.
READER NOTE
Report IDs is a required parameter to run this command.
Run the Fetch Event command to obtain the Report IDs. Report IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Report IDs | Required | The ID(s) of report(s) to get attachments. Report ID can be obtained using the Fetch Event command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Report Attachments failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Get Report Attachments failed. Status Code: 404. Message: The requested resource does not exist. |
Get Reports
Retrieves the specified report(s) by Report ID(s).
READER NOTE
Report IDs is a required parameter to run this command.
Run the Fetch Event command to obtain the Report IDs. Report IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Report IDs | Required | The ID of the report. Report ID can be obtained using the Fetch Event command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Get Reports failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Get Reports failed. Status Code: 404. Message: The requested resource does not exist. |
List Attachment Payloads
Lists the attachment payloads based on query criteria. Attachment payloads contain the MIME type and MD5 and SHA256 hash signatures of reported emails, along with the risk score assigned by Cofense Triage.
Input
Input Parameter | Required/Optional | Description | Example |
MIME Type | Optional | The MIME type of the payload. | application/msword |
Hash | Optional | The payload's hash, either SHA256 or MD5. | ***** |
Start Time | Optional | The start time to query, in UTC time. | 2020-10-30 00:00 |
End Time | Optional | The end time to query, in UTC time. | 2020-10-31 00:00 |
Page Number | Optional | The page number to return. The default value of this field is 1. The page size is 200. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Attachment Payloads failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data List Attachment Payloads failed. Status Code: 401. Message: The access token is missing or is not valid. |
List Comments
Comments allow users to communicate additional information about reports and threat indicators. List comments based on query criteria.
Input
Input Parameter | Required/Optional | Description | Example |
Content | Optional | The content of the comment to query. | Phishing |
Start Time | Optional | The start time to query, in UTC time. | 2020-10-30 00:00 |
End Time | Optional | The end time to query, in UTC time. | 2020-10-31 00:00 |
Page Number | Optional | The page number to return. The default value of this field is 1. The page size is 200. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Comments failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data List Comments failed. Status Code: 401. Message: The access token is missing or is not valid. |
List Domains
For reported emails that contain URLs, Cofense Triage captures the domain port of the URL and assigns it a risk score. List the Domains according to query criteria.
Input
Input Parameter | Required/Optional | Description | Example |
Start Time | Optional | The start time to query, in UTC time. | 2020-10-30 00:00 |
End Time | Optional | The end time to query, in UTC time. | 2020-10-31 00:00 |
Page Number | Optional | The page number to return. The default value of this field is 1. The page size is 200. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Domains failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data List Domains failed. Status Code: 401. Message: The access token is missing or is not valid. |
List Threat Indicators
Retrieves a list of threat indicators with details based on the specified criteria(s). Threat indicators identify the threat level of an email's subject, sender, domains, URLs, and MD5 and SHA256 attachment hash signatures.
Input
Input Parameter | Required/Optional | Description | Example |
Threat Type | Optional | The type of threat to query. | MD5 |
Threat Value | Optional | The threat value to query. | 5d4***92 |
Threat Level | Optional | The threat level to query. | Malicious |
Start Time | Optional | The start time to query, in UTC time. | 2020-10-30 00:00 |
End Time | Optional | The end time to query, in UTC time. | 2020-10-31 00:00 |
Page Number | Optional | The page number to return. The default value of this field is 1. The page size is 200. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Threat Indicators failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data List Threat Indicators failed. Status Code: 401. Message: The access token is missing or is not valid. |
List URLs
Lists the URLs based on query criteria for reported emails containing URLs. Cofense Triage captures each URL and assigns it a risk score.
Input
Input Parameter | Required/Optional | Description | Example |
Start Time | Optional | The start time to query, in UTC time. | 2020-10-30 00:00 |
End Time | Optional | The end time to query, in UTC time. | 2020-10-31 00:00 |
Page Number | Optional | The page number to return. The default value of this field is 1. The page limit is set to 200 records. If the number of returned records exceeds 200, you must specify the page number. For example, 2 indicates the second page, while 3 indicates the third page. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List URLs failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data List URLs failed. Status Code: 401. Message: The access token is missing or is not valid. |
Retrieve Related Resources
Retrieves the specified relationship of a resource with a given resource ID. If no relationship is specified, return the related information of the resource.
Input
Input Parameter | Required/Optional | Description | Example |
Resource Type | Required | The type of the resource. | Attachment Payloads |
Resource ID | Required | The ID of the resource. | ***** |
Relationship Name | Optional | The name of the relationship to retrieve. If not specified, all relationship names will be returned in the result. | Attachments |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Retrieve Related Resources failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message:The requested resource does not exist. |
Error Sample Data Retrieve Related Resources failed. Status Code: 404. Message: The requested resource does not exist. |
Update Report Tags
Updates the tag of the specified report.
READER NOTE
Report IDs is a required parameter to run this command.
Run the Fetch Event command to obtain the Report IDs. Report IDs can be found in the raw data at $.data[*].id.
Input
Input Parameter | Required/Optional | Description | Example |
Report IDs | Required | The report IDs to be tagged. Report ID can be obtained using the Fetch Event command. |
JSON
|
Tags | Required | The tag names. Delimit them by a comma if multiple tags are needed. | Tag1,tag2 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Update Report Tags failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The requested resource does not exist. |
Error Sample Data Update Report Tags failed. Status Code: 404. Message: The requested resource does not exist. |
Test Connection
Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.
Input
N/A
Output
Output Type | Description | Return Data Type |
Return Data | Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors:
More details about an error can be viewed in the Error tab. | String |
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Test Connection failed. Failed to check the connector. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Cofense Triage V2 portal. Refer to the HTTP Status Code Registry for details. | Status Code: 401. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: The access token is missing or is not valid. |
Error Sample Data Test Connection failed. Failed to check the connector. Status Code: 401. Message: The access token is missing or is not valid. |