TIDE Data Service

The heart of TIDE is the threats submitted by the Infoblox Cyber Intelligence group and external partners.

There are two main categories of bulk threat data retrievable in TIDE: threat state and threats by age. Threat state consists of records that are considered current threats, that is, threats that have not expired and have not been superseded by newer threats for the same indicator (host name, IP address, URL, hash, or email). Threats by age consists of all threats submitted in a specified time period.

If the same indicator was submitted by a data provider four times in one day, a threats-by-age call for daily results would return four records, while a threat state call would return only one, the most recent one submitted.

TIDE threat data is generally event oriented. Sometimes it is necessary instead to see threats by their current state, that is, threats that have not expired and have not been superseded by newer threats for the same indicator (host name, IP address, URL, hash, or email).

The materialized threat state objects contain the current active threats for all indicators of the specified record type. Threat state objects are materialized multiple times an hour.

API Endpoints

GET /tide/api/data/batches
GET /tide/api/data/batches/{batch_id}
GET /tide/api/data/batches/{batch_id}/detail
GET /tide/api/data/batches/search
GET /tide/api/data/batches/search/{request_type}
GET /tide/api/data/threats
GET /tide/api/data/threats/state
GET /tide/api/data/threats/state/{type}
GET /tide/api/data/threats/{type}/{age}
GET /tide/api/data/threats/id/{id}
GET /tide/api/data/threat/counts
GET /tide/api/data/threat/counts/historical
GET /tide/api/data/set/inforank/lookup
GET /tide/api/data/set/inforank/search
GET /tide/api/data/threat_classes/{class_id}
GET /tide/api/data/properties/{id}
GET /tide/api/data/default/ttl

GET `/tide/api/data/batches`

Get threat data for host, up, url, email or hash

rlimit

Number of records to return

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/batches/{batch_id}`

Get specific threat batch data

batch_id

ID of batch

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/batches/{batch_id}/detail`

Get details on threat batch

batch_id

ID of batch

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/batches/search`

Gets a summary of all batches

rlimt

Maximum number of records to return; maximum is 50000

Batch ID

type

The threat type to search for

profile

Input data profile

external_id

External id(s) to search for

description

Batch description

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

period

This specifies the submitted date period of the form [y years][q quarters][m months][w weeks][d days][h hours][m minutes]. This may be prefixed with "previous" to indicate that the period should refer to the previous full period before now. Examples, “1 day“ refers to the 24 hours before now. “previous 1 day“ refers to yesterday. “4 hours“ = the last 4 hours. “previous 1 week“ means last week.

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

imported_period

This specifies the imported date period. See “period” above for a description of the format

status

Batch status

method

sort

Field(s) to sort on, separated by commas; to sort a column descending, prefix the column name with a minus (“-”); valid column names are id, external_id, description, submitted, imported, profile, user, organization, org_user, status, method, type, total, num_successful, num_errors; default is reverse order if import date

start

Zero-based record number at which to start

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/batches/search/{request_type}`

Gets a summary of all batches

request_type

user or organization, default is "user" get batches submitted by current "user" or current "organization"

rlimt

Maximum number of records to return; maximum is 50000

Batch ID

type

The threat type to search for

profile

Input data profile

external_id

External id(s) to search for

description

Batch description

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

period

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

imported_period

This specifies the imported date period. See “period” above for a description of the format

status

Batch status

method

sort

start

Zero-based record number at which to start

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threats`

Get active threats by indicator

type

Threat type to search for. For example if one wanted to search for a host, they could query tide/api/data/threats?type=host&host=one.one.one.one

rlimit

Maximum number of records to return. Default: 10000, Maximum: 10000.

host

Host(s) to search for.Multiple hosts(and other indicators) may be specified in the following form - “host=op.gg&host=one.one.one.one”

IP address(es) to search for

url

URL(s) to search for

Email(s) to search for

hash

Hash(es) to search for

domain

Domain(s) to search for

tld

Top level domain(s) to search for

profile

Profile(s) to search for. Multiple profiles may be queried by specifying comma-separated values. For example, “A,B,C“ will search for profiles A, B, and C.

property

Property(ies) to search for. Multiple properties may be queried by specifying comma-separated values. For example, “A,B,C“ will search for properties A, B, and C.

class

Threat class(es) to search for. Multiple classes may be queried by specifying comma-separated values. For example, “A,B,C“ will search for classes A, B, and C.

target

Target(s) to search for

expiration

Find records that do not expire or expire after this date

dga

Find threats from dynamically generated algorithms or not

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

period

field

Field(s) to return

data_format

json, csv, tsv, psv

include_ipv6

for type=ip request, return IPv6 records

show_full_profiles

(“t”, “true”) Return the “full_profile” field which gives the : instead of just

has_threat_label

Filter for records that have "threat_label" field

is_major_threat

Get Infoblox cyber int's major threat's active records (IID:ANALYST,IID:IB_NOC,IID:IB_PM,IID:IB_DS,IID:IB_SE).

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threats/state`

Get active threats by type and optionally indicator

type

Threat type to search for.

host

Host(s) to search for.Multiple hosts(and other indicators) may be specified in the following form - “host=op.gg&host=one.one.one.one”

IP address(es) to search for

url

URL(s) to search for

Email(s) to search for

hash

Hash(es) to search for

rlimit

Maximum number of records to return. Default: 10000, Maximum: 10000.

distinct

"property" or "profile". Default: "property"

domain

Domain(s) to search for

tld

Top level domain(s) to search for

profile

Profile(s) to search for. Multiple profiles may be queried by specifying comma-separated values. For example, “A,B,C“ will search for profiles A, B, and C.

property

Property(ies) to search for. Multiple properties may be queried by specifying comma-separated values. For example, “A,B,C“ will search for properties A, B, and C.

class

Threat class(es) to search for. Multiple classes may be queried by specifying comma-separated values. For example, “A,B,C“ will search for classes A, B, and C.

target

Target(s) to search for

expiration

Find records that do not expire or expire after this date

dga

Find threats from dynamically generated algorithms or not

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

period

field

Field(s) to return

data_format

json, csv, tsv, psv

include_ipv6

for type=ip request, return IPv6 records

show_full_profiles

(“t”, “true”) Return the “full_profile” field which gives the : instead of just

has_threat_label

Filter for records that have "threat_label" field

is_major_threat

Get Infoblox cyber int's major threat's active records (IID:ANALYST,IID:IB_NOC,IID:IB_PM,IID:IB_DS,IID:IB_SE).

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threats/state/{type}`

Get active threats by type and optionally indicator

type

Threat type to search for.

host

Host(s) to search for.Multiple hosts(and other indicators) may be specified in the following form - “host=op.gg&host=one.one.one.one”

IP address(es) to search for

url

URL(s) to search for

Email(s) to search for

hash

Hash(es) to search for

rlimit

Maximum number of records to return. Default: 10000, Maximum: 10000.

distinct

"property" or "profile". Default: "property"

domain

Domain(s) to search for

tld

Top level domain(s) to search for

profile

Profile(s) to search for. Multiple profiles may be queried by specifying comma-separated values. For example, “A,B,C“ will search for profiles A, B, and C.

property

Property(ies) to search for. Multiple properties may be queried by specifying comma-separated values. For example, “A,B,C“ will search for properties A, B, and C.

class

Threat class(es) to search for. Multiple classes may be queried by specifying comma-separated values. For example, “A,B,C“ will search for classes A, B, and C.

target

Target(s) to search for

expiration

Find records that do not expire or expire after this date

dga

Find threats from dynamically generated algorithms or not

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

period

field

Field(s) to return

data_format

json, csv, tsv, psv

include_ipv6

for type=ip request, return IPv6 records

show_full_profiles

(“t”, “true”) Return the “full_profile” field which gives the : instead of just

has_threat_label

Filter for records that have "threat_label" field

is_major_threat

Get Infoblox cyber int's major threat's active records (IID:ANALYST,IID:IB_NOC,IID:IB_PM,IID:IB_DS,IID:IB_SE).

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threats/{type}/{age}`

Get threats by type and age

type

Threat type to search for.

age

Time frame to search

host

Host(s) to search for.Multiple hosts(and other indicators) may be specified in the following form - “host=op.gg&host=one.one.one.one”

IP address(es) to search for

url

URL(s) to search for

Email(s) to search for

hash

Hash(es) to search for

rlimit

Maximum number of records to return. Default: 10000, Maximum: 10000.

domain

Domain(s) to search for

tld

Top level domain(s) to search for

profile

Profile(s) to search for. Multiple profiles may be queried by specifying comma-separated values. For example, “A,B,C“ will search for profiles A, B, and C.

property

Property(ies) to search for. Multiple properties may be queried by specifying comma-separated values. For example, “A,B,C“ will search for properties A, B, and C.

class

Threat class(es) to search for. Multiple classes may be queried by specifying comma-separated values. For example, “A,B,C“ will search for classes A, B, and C.

target

Target(s) to search for

expiration

Find records that do not expire or expire after this date

dga

Find threats from dynamically generated algorithms or not

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

period

field

Field(s) to return

data_format

json, csv, tsv, psv

include_ipv6

for type=ip request, return IPv6 records

show_full_profiles

(“t”, “true”) Return the “full_profile” field which gives the : instead of just

has_threat_label

Filter for records that have "threat_label" field

is_major_threat

Get Infoblox cyber int's major threat's active records (IID:ANALYST,IID:IB_NOC,IID:IB_PM,IID:IB_DS,IID:IB_SE).

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threats/id/{id}`

Get threats by ID

ID of threat

host

Host(s) to search for.Multiple hosts(and other indicators) may be specified in the following form - “host=op.gg&host=one.one.one.one”

IP address(es) to search for

url

URL(s) to search for

Email(s) to search for

hash

Hash(es) to search for

domain

Domain(s) to search for

tld

Top level domain(s) to search for

profile

Profile(s) to search for. Multiple profiles may be queried by specifying comma-separated values. For example, “A,B,C“ will search for profiles A, B, and C.

property

Property(ies) to search for. Multiple properties may be queried by specifying comma-separated values. For example, “A,B,C“ will search for properties A, B, and C.

class

Threat class(es) to search for. Multiple classes may be queried by specifying comma-separated values. For example, “A,B,C“ will search for classes A, B, and C.

target

Target(s) to search for

expiration

Find records that do not expire or expire after this date

dga

Find threats from dynamically generated algorithms or not

from_date

Find batches submitted on or after this date in ISO 8601 format

to_date

Find batches submitted on or before this date is ISO 8601 format

imported_from_date

Find batches imported on or after this date in ISO 8601 format

imported_to_date

Find batches imported on or before this date in ISO 8601 format

period

field

Field(s) to return

data_format

json, csv, tsv, psv

include_ipv6

for type=ip request, return IPv6 records

show_full_profiles

(“t”, “true”) Return the “full_profile” field which gives the : instead of just

has_threat_label

Filter for records that have "threat_label" field

is_major_threat

Get Infoblox cyber int's major threat's active records (IID:ANALYST,IID:IB_NOC,IID:IB_PM,IID:IB_DS,IID:IB_SE).

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threat/counts`

Get active threat counts

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threat/counts/historical`

Get historical threat counts

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/set/inforank/lookup`

Lookup domain in the InfoRank list

domain

The domain to search for

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/set/inforank/search`

Search for related domains in the InfoRank list

String to search for

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/threat_classes/{class_id}`

Get a threat class by ID

class_id

ID of class. If no class_id is specified, the API will return all available threat_classes

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/properties/{id}`

Get a threat property by ID

ID of property, if no id is specifed, the API will search on all properties filtered by the remaining parameters

name

Name of the property

class

Class of the property

threat_level

Threat level of the property

Authorization

Access token for authentication. For API keys, use: Token

Response

GET `/tide/api/data/default/ttl`

Get default TTL for threat classes

Authorization

Access token for authentication. For API keys, use: Token

Response