Threat Management

Threat Management

The Threat Management APIs allow you to retrieve threat analysis data from L3C Threat Analytics or VirusTotal for a given threat indicator such as IP address, domain, or URL.

Fetches threat analysis data from L3C Threat Analytics for a given indicator.

Rate limit: 50 requests per minute per account.
OAuth Scope : logs360cloud.threat.READ
Role : Administrator

Arguments

indicator
string
(Required)
The threat indicator value — an IP address, domain, or URL.
Max length: 2048
indicator_type
string
Type of the threat indicator.
Allowed values: IP, DOMAIN, URL.
Note: when `DOMAIN` is supplied, the server normalizes the indicator and returns `indicator_type: "URL"` in the response payload.
action
string
(Required)
The analysis operation to perform.
Allowed values:
INFO — Retrieves reputation score, threat category, and key attributes for the indicator.
HISTORY — Retrieves reputation score history over a date range. filter.start_date and filter.end_date are required for URL and DOMAIN indicators.
WHOIS_INFO — Retrieves WHOIS and geo-location details (city, country, ASN, ISP, coordinates).
STATS — Retrieves related indicator statistics grouped by section.
CONNECTIONS — Retrieves connected items for a specific section. Requires filter.section, filter.severity, limit, and from.
INIT_DATA — Retrieves combined INFO and WHOIS_INFO data in a single call.
filter
object
Additional filter parameters for certain operations.
Show Sub-Attributes arrow
start_date
string
Start date for history queries (ISO 8601 format).
Max length: 30
Required for the HISTORY action when the indicator type is URL or DOMAIN.
The start date cannot be set earlier than 1 year prior to the current date.
end_date
string
End date for history queries (ISO 8601 format).
Max length: 30
Required for the HISTORY action when the indicator type is URL or DOMAIN.
Date range between start date and end date cannot be greater than 180 days.
section
string
Connection section filter.
Max length: 50
Required when action is CONNECTIONS.
Allowed values based on indicator type:
URL / DOMAIN: virtuallyhosted, sub_domains, hosted_files, hosted_apps, hosting_ips, common_registrant
IP: hosted_urls, asn, hosted_files, hosted_apps
FILE: outbound_ips, hosting_ips, outbound_urls, hosting_urls
severity
integer
Threat level filter for connections.
Minimum: 0 (malicious)
Maximum: 4 (trustworthy)
Required when action is CONNECTIONS.
limit
integer
Number of items to retrieve. Required when action is CONNECTIONS.
Minimum: 1
Maximum: 100
from
integer
Offset for pagination. Required when action is CONNECTIONS.
Minimum: 0
Maximum: 1000

Headers

account_id
string
(Required)

Request Example

Click to copy
parameters_data='{"field1":"value1","field2":"value2"}'; headers_data = Map(); headers_data.put("account_id", "18XXXXX4"); headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f"); response = invokeUrl [ url: "https://log360cloud.manageengine.com/api/v2/threat/search/advanced-threat-analytics" type: POST headers: headers_data content-type: application/json parameters: parameters_data connection: <connection_name> ]; info response;
OkHttpClient client = new OkHttpClient(); MediaType mediaType = MediaType.parse("application/json"); RequestBody body = RequestBody.create(mediaType, "{\"field1\":\"value1\",\"field2\":\"value2\"}"); Request request = new Request.Builder() .url("https://log360cloud.manageengine.com/api/v2/threat/search/advanced-threat-analytics") .post(body) .addHeader("account_id", "18XXXXX4") .addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f") .addHeader("content-type", "application/json") .build(); Response response = client.newCall(request).execute();
const options = { method: 'POST', headers: { account_id: '18XXXXX4', Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f', 'content-type': 'application/json' }, body: '{"field1":"value1","field2":"value2"}' }; fetch('https://log360cloud.manageengine.com/api/v2/threat/search/advanced-threat-analytics', options) .then(response => response.json()) .then(response => console.log(response)) .catch(err => console.error(err));
import http.client conn = http.client.HTTPSConnection("log360cloud.manageengine.com") payload = "{\"field1\":\"value1\",\"field2\":\"value2\"}" headers = { 'account_id': "18XXXXX4", 'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f", 'content-type': "application/json" } conn.request("POST", "/api/v2/threat/search/advanced-threat-analytics", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
const http = require("https"); const options = { "method": "POST", "hostname": "log360cloud.manageengine.com", "port": null, "path": "/api/v2/threat/search/advanced-threat-analytics", "headers": { "account_id": "18XXXXX4", "Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f", "content-type": "application/json" } }; const req = http.request(options, function (res) { const chunks = []; res.on("data", function (chunk) { chunks.push(chunk); }); res.on("end", function () { const body = Buffer.concat(chunks); console.log(body.toString()); }); }); req.write(JSON.stringify({field1: 'value1', field2: 'value2'})); req.end();
curl --request POST \ --url https://log360cloud.manageengine.com/api/v2/threat/search/advanced-threat-analytics \ --header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \ --header 'account_id: 18XXXXX4' \ --header 'content-type: application/json' \ --data '{"field1":"value1","field2":"value2"}'

Body Parameters

Click to copy

Response Example

Fetches threat analysis data from VirusTotal for a given indicator (IP, domain, or URL).
The indicator type is auto-detected from the indicator value, so indicator_type is not accepted in the request body.

The set of sections returned under data varies by the detected indicator type:

  • IP: virus_total_info, security_vendor_analysis, related_files, ssl_certificate_info, resolutions, whois_info.
  • Domain: virus_total_info, security_vendor_analysis, related_files, ssl_certificate_info, related_domains, dns_records, resolutions, whois_info.
  • URL: virus_total_info, security_vendor_analysis, html_info, http_response_headers.
Individual sections may be omitted when VirusTotal does not provide the corresponding data for a given indicator.

Rate limit: 50 requests per minute per account.
OAuth Scope : logs360cloud.threat.READ
Role : Administrator

Arguments

indicator
string
(Required)
The threat indicator value — an IP address, domain, or URL.
Max length: 2048

Headers

account_id
string
(Required)

Request Example

Click to copy
parameters_data='{"field1":"value1","field2":"value2"}'; headers_data = Map(); headers_data.put("account_id", "18XXXXX4"); headers_data.put("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f"); response = invokeUrl [ url: "https://log360cloud.manageengine.com/api/v2/threat/search/virustotal" type: POST headers: headers_data content-type: application/json parameters: parameters_data connection: <connection_name> ]; info response;
OkHttpClient client = new OkHttpClient(); MediaType mediaType = MediaType.parse("application/json"); RequestBody body = RequestBody.create(mediaType, "{\"field1\":\"value1\",\"field2\":\"value2\"}"); Request request = new Request.Builder() .url("https://log360cloud.manageengine.com/api/v2/threat/search/virustotal") .post(body) .addHeader("account_id", "18XXXXX4") .addHeader("Authorization", "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f") .addHeader("content-type", "application/json") .build(); Response response = client.newCall(request).execute();
const options = { method: 'POST', headers: { account_id: '18XXXXX4', Authorization: 'Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f', 'content-type': 'application/json' }, body: '{"field1":"value1","field2":"value2"}' }; fetch('https://log360cloud.manageengine.com/api/v2/threat/search/virustotal', options) .then(response => response.json()) .then(response => console.log(response)) .catch(err => console.error(err));
import http.client conn = http.client.HTTPSConnection("log360cloud.manageengine.com") payload = "{\"field1\":\"value1\",\"field2\":\"value2\"}" headers = { 'account_id': "18XXXXX4", 'Authorization': "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f", 'content-type': "application/json" } conn.request("POST", "/api/v2/threat/search/virustotal", payload, headers) res = conn.getresponse() data = res.read() print(data.decode("utf-8"))
const http = require("https"); const options = { "method": "POST", "hostname": "log360cloud.manageengine.com", "port": null, "path": "/api/v2/threat/search/virustotal", "headers": { "account_id": "18XXXXX4", "Authorization": "Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f", "content-type": "application/json" } }; const req = http.request(options, function (res) { const chunks = []; res.on("data", function (chunk) { chunks.push(chunk); }); res.on("end", function () { const body = Buffer.concat(chunks); console.log(body.toString()); }); }); req.write(JSON.stringify({field1: 'value1', field2: 'value2'})); req.end();
curl --request POST \ --url https://log360cloud.manageengine.com/api/v2/threat/search/virustotal \ --header 'Authorization: Zoho-oauthtoken 1000.41d9xxxxxxxxxxxxxxxxxxxxxxxxc2d1.8fccxxxxxxxxxxxxxxxxxxxxxxxx125f' \ --header 'account_id: 18XXXXX4' \ --header 'content-type: application/json' \ --data '{"field1":"value1","field2":"value2"}'

Body Parameters

Click to copy

Response Example