Flowintel, an open-source case management platform

API

Here are some examples of how to use the API.

Case

Note

Full documentation /api/case/doc.

Create a case

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = {
    "title": "Super Case from API"
}

url = "http://127.0.0.1:7006/api/case/create"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/case/create\
     -d '{"title": "Super Case from API"}'

List cases

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/case/all"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/case/all

Search a case

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}
data = {
    "search": "Case"
}

url = "http://127.0.0.1:7006/api/case/search"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/case/search\
     -d '{"search": "Case"}'

Delete a case

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/case/1/delete"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/case/1/delete

Complete a case

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/case/1/complete"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/case/1/complete

Task

Note

Full documentation /api/task/doc.

Create a task

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = {
    "title": "First task from API"
}

url = "http://127.0.0.1:7006/api/case/1/create_task"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/case/1/create_task\
     -d '{"title": "First task from API"}'

List tasks

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/case/1/tasks"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/case/1/tasks

Delete a task

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/task/1/delete"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/task/1/delete

Complete a task

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/task/1/complete"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/task/1/complete

Admin

Note

Full documentation /api/admin/doc.

Add user

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = {
    "first_name": "John",
    "last_name": "Doe",
    "email": "j.d@j.admin",
    "password": "Password1234",
    "role": 1
}

url = "http://127.0.0.1:7006/api/admin/add_user"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/admin/add_user\
     -d '{"first_name": "John", "last_name": "Doe", "email": "j.d@j.admin", "password": "Password1234", "role": 1}'

List roles

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE"
}

url = "http://127.0.0.1:7006/api/admin/roles"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "X-API-KEY: YOUR-API-KEY-HERE" -X GET 127.0.0.1:7006/api/admin/roles

Templating

Note

Full documentation /api/template/doc.

Create a case

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = {
    "title": "Super Template Case from API"
}

url = "http://127.0.0.1:7006/api/template/create_case"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/template/create_case\
     -d '{"title": "Super Template Case from API"}'

Create a case from a template

Python

# A template need to be created before

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = {
    "title": "Super Case from Template API"
}

url = "http://127.0.0.1:7006/api/template/create_case_from_template/1"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/template/create_case_from_template/1\
     -d '{"title": "Super Case from Template API"}'

Analyser

Note

Full documentation /api/analyzer/doc.

Send a query to Flowintel

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json",
}

data = {
    "query": ["circl.lu", "hack.lu"],
    "input": "domain",
    "modules": ["circl_passivedns", "dns"]
}

url = "http://127.0.0.1:7006/api/analyzer/misp-modules/query"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/analyzer/misp-modules/query\
     -d '{"query": ["circl.lu", "hack.lu"], "input": "domain", "modules": ["circl_passivedns", "dns"]}'

Check the status of an analysis

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json",
}

url = "http://127.0.0.1:7006/api/analyzer/misp-modules/status/<session_uuid>"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X GET 127.0.0.1:7006/api/analyzer/misp-modules/status/<session_uuid>

Get the result of an analysis

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json",
}

url = "http://127.0.0.1:7006/api/analyzer/misp-modules/result/<session_uuid>"
r = requests.get(url, headers=headers)
print(r.text)

curl

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X GET 127.0.0.1:7006/api/analyzer/misp-modules/result/<session_uuid>

Importer

The JSON used in this example:

{
    "uuid": "be8ebf37-6a11-43d1-a4d2-cce097b2bddd",
    "title": "Case test",
    "description": "My super case for the documentation",
    "recurring_type": None,
    "notes": "This case is just boring...\nYes it is !",
    "deadline": None,
    "recurring_date": None,
    "tags": [],
    "clusters": [],
    "tasks": [
        {
            "uuid": "5a1f4902-9d54-476f-a4f8-2a93cbe20597",
            "title": "Prepare a super tea",
            "description": "Keep it as hot as possible",
            "url": "",
            "notes": [
                {
                    "uuid": "864fa9c7-b4d6-4e9b-80e7-0cc07c894e60",
                    "note": "# Preparation\n- add one sugar\n",
                    "task_uuid": "5a1f4902-9d54-476f-a4f8-2a93cbe20597"
                }
            ],
            "deadline": None,
            "tags": [
                "PAP:RED"
            ],
            "clusters": []
        }
    ]
}

Python

headers = {
    "X-API-KEY": "YOUR-API-KEY-HERE",
    "Content-Type": "application/json"
}

data = ... # Use the dict above.

url = "http://127.0.0.1:7006/api/importer/"
r = requests.post(url, json=data, headers=headers)
print(r.text)

curl

Save the dict above in a file named CaseTest.json.

curl -H "Content-Type: application/json"\
     -H "X-API-KEY: YOUR-API-KEY-HERE"\
     -X POST 127.0.0.1:7006/api/importer/\
     -d @CaseTest.json