Skip to main content

Multiple Zynap APIs

Multiple Zynap APIs​

Overview​

This workflow collects threat intelligence data from multiple internal Zynap API services and consolidates the results into a single structured output. It queries malware analysis results, threat actor intelligence, and underground forum monitoring data, then merges all responses into a unified JSON structure for further analysis.

How It Works​

  1. Malware Intelligence Collection: Queries the internal Zynap Sandbox (malware-api) to retrieve malware analysis data, including behavioral patterns, threat classifications, IOCs, and signature information from the internal gRPC-based malware analysis service.
  2. Threat Actor Data Retrieval: Accesses the internal Threat Actors API to gather threat actor intelligence, including actor profiles, known aliases, attack patterns, and attribution data.
  3. Underground Forum Data Collection: Leverages the internal Forums API to search underground forums and darkweb sources for relevant threat discussions and communications.
  4. Data Consolidation: Executes a simple aggregation script that merges JSON responses from all three internal API sources into a single structured output file, organizing data by source filename.
  5. Unified Output Generation: Produces a consolidated JSON structure containing all collected data from the three internal intelligence sources for downstream processing or analysis tools.

Who is this for?​

  • Threat intelligence analysts requiring data from multiple internal Zynap sources
  • Security operations teams needing consolidated threat data collection
  • Incident response analysts investigating threats across multiple intelligence databases
  • Security researchers analyzing data from various internal threat intelligence services
  • SOC analysts requiring unified data collection for alert investigation

What problem does this workflow solve?​

  • Eliminates manual querying of multiple internal API services by automating data collection from all Zynap intelligence sources simultaneously
  • Provides a single consolidated output containing data from malware analysis, threat actor databases, and forum monitoring services
  • Reduces data collection time by parallelizing queries across multiple internal services and automatically merging results
  • Simplifies data handling by combining multiple API responses into a single structured JSON file
  • Standardizes multi-source data collection processes for consistent access to internal intelligence services