Cisco Talos IP Reputation API Integration

[BalajiNagarajan]

Hello,

I need to integrate the cisco talos IP reputation for validating multiple IPs and send mail.

Does Cisco Talos provide API for it?

[balaji.bandi]

i used before long back as below :

https://docs.ces.cisco.com/docs/api-developer-documentation

[Brian Sak]

You can use the SecureX APIs to get disposition from the integrated Talos threat intelligence feed.  https://ciscosecurity-sx-00-integration-workflows.readthedocs-hosted.com/en/latest/threatresponse/query_tr.html

[Nicholas Penning]

Does it required a paid account or business account with Cisco needed to use SecureX APIs?

[JonathanY]

May I know if this is the only solution to get Talos intelligence observable reputation? 

If below api doesn't work anymore? As I already get Response [403].

GET 

('https://talosintelligence.com/sb_api/query_lookup', data={"query": "/api/v2/details/ip/", "query_entry": ip_addr, "offset": 0, "order": "ip asc"}, headers={'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.31 Safari/537.36', 'referer': 'https://talosintelligence.com/reputation_center/lookup?search=' + ip_addr})

[Brian Sak]

There isn't a published public API for reputation off of the talosintelligence.com site. You can run a query off of the website (https://talosintelligence.com/reputation_center/lookup?search=4.2.2.1), but not through an API interface. The SecureX APIs mentioned in this thread will allow you do essentially do the same thing through the Talos Intelligence integration.