Maltiverse icon

Maltiverse

Consulta la API de Maltiverse para enriquecer IPs, dominios, URLs y hashes con inteligencia de amenazas.

Maltiverse

AI-generated

Summary

Query Maltiverse or manage indicators, feeds, and audit data using the selected resource and operation. Authenticate with a Maltiverse API credential; inputs and effects depend on the selected operation.

Inputs

  • Resource and operation (required) — Select an indicator type (IP, hostname, URL, file hash, or email), generic IoC, MQL search, bulk lookup, feed, or audit resource, then choose an available action such as lookup, create/update, delete, or list.
  • Indicator value (required) — Provide the required IP, hostname, URL, email, or hash for the selected action. URL actions calculate a SHA-256 checksum automatically. Hash lookups accept SHA-256, SHA-1, SHA-512, or MD5; sample creation and deletion use SHA-256.
  • Classification, tags, and additional fields — For create/update actions, set a classification, comma-separated tags, and optional source, description, distributability, or reference fields.
  • IoC array (required) — For generic bulk upload, provide a JSON array of IoC objects; each is sent individually to Maltiverse.
  • IoC type and value (required) — For generic IoC deletion, select IP, hostname, URL, or sample and provide its value. URL deletion calculates its SHA-256 checksum.
  • MQL query, limit, and offset (required) — For search, provide an MQL query. The result limit defaults to 20 (allowed range 1–1000) and offset defaults to 0.
  • Bulk values (required) — For bulk lookup, enter one value per line; the selected bulk operation determines whether they are IPs, hostnames, emails, URLs, or hashes.
  • Feed fields — Feed actions may use a feed ID. Create/update also accepts a required name and optional description, MQL query, indicator type, access level, tags, and advanced query options.
  • Output options — Optionally include each input item's fields in its result or simplify returned indicator data to a summary including classification, score, tags, country, and up to three blacklist entries.

Output shape

One output item per input item, each containing the Maltiverse response as JSON.

Generic bulk IoC upload returns an object with the count and individual responses. A 404 lookup is returned as an error object; with continue-on-fail enabled, other per-item errors are returned as {"error": "…"}. Feed download is also returned as JSON by the node.

Links

Discussion