Area1 SOAR Integration

April 26, 2025 ยท View on GitHub

This document details the tools provided by the Area1 SOAR integration.

Tools

area1_search_indicator

Search indicator on Area 1 by hash, URL, domain, IP, email.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

area1_ping

Test Area1 connectivity.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

area1_get_recent_indicators

Get recent malicious indicators from Area1.

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • seconds_back (str, required): ul
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.