User Guide

Synapse-Intel471 User Guide

Synapse-Intel471 adds new Storm commands to allow you to query the Intel471 API using your existing credentials.

Getting Started

Check with your Admin to enable permissions and find out if you need a personal Verity Client ID/Secret (or, for existing Titan automations, a personal API key).

Intel471 APIs

Synapse-Intel471 offers support for the Intel471 Verity API and the Intel471 Titan API. The Titan API is scheduled to be retired by Intel471 on 2026-12-31. Synapse-Intel471 will support the Titan API until it is fully retired. New users of this Power-Up are encouraged to work with the Verity commands instead of the Titan commands. The list of commands by API is shown below.

Intel471 Verity API Commands

  • intel471.verity.config.add

  • intel471.verity.config.del

  • intel471.verity.config.list

  • intel471.verity.config.show

  • intel471.verity.config.update

  • intel471.verity.girs.sync

  • intel471.verity.indicators.search

  • intel471.verity.inforeport.get

  • intel471.verity.vulns.search

  • intel471.verity.vulns.get

  • intel471.verity.breach.search

  • intel471.verity.credentials.search

  • intel471.verity.forum.search

  • intel471.verity.message.search

  • intel471.verity.dataleak.search

Intel471 Titan API Commands

  • intel471.setup.apikey

  • intel471.setup.tagprefix

  • intel471.girs.sync

  • intel471.iocs.search

  • intel471.indicators.search

  • intel471.vulns.search

  • intel471.vulns.get

  • intel471.global.search

  • intel471.breach.search

  • intel471.forum.post.search

  • intel471.forum.message.search

  • intel471.dataleak.post.search

  • intel471.inforeport.search

  • intel471.inforeport.get

  • intel471.message.search

  • intel471.credential.search

Two Titan commands, intel471.iocs.search and intel471.global.search, have no Verity equivalent. Intel471’s Verity API has no unified IOC or global search endpoint - this is a capability removed by Intel471’s own platform redesign, not a gap in this Power-Up. Both commands will continue to work against the Titan API until it is retired.

Verity Examples

Setting your personal Verity Client ID/Secret

To set-up a personal use configuration:

> intel471.verity.config.add --scope self myconfig myclientid myclientsecret
Synapse-Intel471 Verity config "myconfig" added

Populate GIR definitions

Download GIR definitions to populate meta:rule nodes:

> intel471.verity.girs.sync

> meta:rule | limit 3
meta:rule=033b5c51fbf94f1fecf3e1c4aecd1759
        .created = 2026/08/03 15:58:03.116
        :desc = Information-stealer (or info stealer) malware is designed to gather information from a system such as login credentials, keystrokes and screenshots of sensitive information.
        :ext:id = 1.1.5
        :name = information-stealer malware
meta:rule=039e2135c5a71925afc74a2f9667dea7
        .created = 2026/08/03 15:58:04.066
        :desc =
        :ext:id = 6.2.1.15
        :name = djibouti
meta:rule=04a9693a20816c4460a135bba5d45c57
        .created = 2026/08/03 15:58:03.920
        :desc =
        :ext:id = 6.1.8.5
        :name = cloud services industry

Search for Malware Indicators

Search for indicators matching a filter criteria:

> intel471.verity.indicators.search --yield --size 2
file:bytes=sha256:c0f35e3546bd97eb9d2cdd0eaa49dd9f72be1f2780268658125bde7ab0dd767c
        .created = 2026/08/03 15:58:04.998
        .seen = ('2018/08/07 18:33:00.000', '2018/08/07 18:33:00.001')
        :md5 = 147f31ef8cc99c98a3868b8ecca94a58
        :sha1 = 08e5d3e2e396e8d24613bbc4b1b862e3ab9d7e62
        :sha256 = c0f35e3546bd97eb9d2cdd0eaa49dd9f72be1f2780268658125bde7ab0dd767c
        #rep.intel471.pony
inet:url=https://uiaoduiiej.chimkent.su/5fewucaopezanxenuzebu.dat
        .created = 2026/08/03 15:58:05.015
        .seen = ('2018/08/07 23:04:12.000', '2022/12/27 01:03:54.001')
        :base = https://uiaoduiiej.chimkent.su/5fewucaopezanxenuzebu.dat
        :fqdn = uiaoduiiej.chimkent.su
        :params =
        :path = /5fewucaopezanxenuzebu.dat
        :port = 443
        :proto = https
        #rep.intel471.zeus_panda

Titan Examples

Setting your personal API key

To set-up a personal use API key:

> intel471.setup.apikey --self myemail myapikey
WARNING: "intel471.setup.apikey" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
Setting Intel471 credentials for the current user.

Populate GIR definitions

Download GIR definitions to populate meta:rule nodes:

> intel471.girs.sync
WARNING: "intel471.girs.sync" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.

> meta:rule | limit 3
meta:rule=033b5c51fbf94f1fecf3e1c4aecd1759
        .created = 2026/08/03 15:58:03.116
        :desc = Information-stealer (or info stealer) malware is designed to gather information from a system such as login credentials, keystrokes and screenshots of sensitive information.
        :ext:id = 1.1.5
        :name = information-stealer malware
meta:rule=039e2135c5a71925afc74a2f9667dea7
        .created = 2026/08/03 15:58:04.066
        :desc =
        :ext:id = 6.2.1.15
        :name = djibouti
meta:rule=04a9693a20816c4460a135bba5d45c57
        .created = 2026/08/03 15:58:03.920
        :desc =
        :ext:id = 6.1.8.5
        :name = cloud services industry

Search for IOCs

Search for IOCs matching a filter criteria:

> intel471.iocs.search ".com" --from "2022-11-01" --until "2022-12-01" --yield --size 2
WARNING: "intel471.iocs.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
inet:fqdn=ldver09.com
        .created = 2026/08/03 15:58:05.478
        .seen = ('2022/11/14 14:23:08.000', '2022/11/14 14:23:08.001')
        :domain = com
        :host = ldver09
        :issuffix = false
        :iszone = true
        :zone = ldver09.com
        #rep.intel471.malicious
inet:fqdn=ldver263.com
        .created = 2026/08/03 15:58:05.490
        .seen = ('2022/11/14 14:23:08.000', '2022/11/14 14:23:08.001')
        :domain = com
        :host = ldver263
        :issuffix = false
        :iszone = true
        :zone = ldver263.com
        #rep.intel471.malicious

Search for Malware Indicators

Search for Indicators matching a filter criteria:

> intel471.indicators.search --from "2022-11-01" --until "2022-12-01" --yield --size 2
WARNING: "intel471.indicators.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
inet:url=http://211.138.30.200:443
        .created = 2026/08/03 15:58:05.532
        .seen = ('2022/09/17 06:49:06.000', '2022/12/08 18:31:47.001')
        :base = http://211.138.30.200:443
        :ipv4 = 211.138.30.200
        :params =
        :path =
        :port = 443
        :proto = http
        #rep.intel471.redline:intel471:confidence = medium
        #rep.intel471.redline:intel471:expiration = 2023/01/07 18:31:47.000
inet:url=https://78.180.100.59:443
        .created = 2026/08/03 15:58:05.543
        .seen = ('2022/07/01 16:22:34.000', '2022/12/08 18:11:04.001')
        :base = https://78.180.100.59:443
        :ipv4 = 78.180.100.59
        :params =
        :path =
        :port = 443
        :proto = https
        #rep.intel471.qbot:intel471:confidence = medium
        #rep.intel471.qbot:intel471:expiration = 2023/01/07 18:11:04.000

Search for Vulnerabilities

Search for Vulnerability Reports matching a filter criteria:

> intel471.vulns.search --vendorname microsoft --yield --size 2
WARNING: "intel471.vulns.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
risk:vuln=1151f2b87452247da5ba11c684d7c52d
        .created = 2026/08/03 15:58:05.591
        .seen = ('2023/02/13 09:16:57.000', '2023/02/13 09:16:57.001')
        :_intel471:uid = ce1c92f84040f1ad008b55665bfde326
        :cve = cve-2021-28312
        :cvss:v2_0:score = 4.3
        :cvss:v3_0:score = 6.5
        :desc = CVE-2021-28312 is an unspecified vulnerability impacting multiple products and versions of Microsoft Windows. A proof of concept (PoC) was not observed publicly or in the underground.
        :exploited = false
        :mitigated = true
        :reporter = 0847739e5e2f2ecd1c57961af850fc6e
        :reporter:name = intel471
        :severity = low
risk:vuln=55924023b0830b548766f2970bdca691
        .created = 2026/08/03 15:58:05.717
        .seen = ('2022/05/31 06:42:19.000', '2022/05/31 06:42:19.001')
        :_intel471:uid = 569ec70b8c51b7983f98b04f6559ead5
        :cve = cve-2022-30190
        :cvss:v2_0:score = 9.3
        :cvss:v3_0:score = 7.8
        :desc = CVE-2022-30190 aka Follina is an arbitrary code execution vulnerability impacting multiple products and versions of Microsoft Windows. A Metasploit module, a proof of concept (PoC) and an exploit generator tool was observed in open source and subsequently shared in the underground. Further, a walk-through demo of a PoC was shared via Twitter and YouTube. Additionally, Microsoft claimed to be aware of the vulnerability being actively exploited in the wild.
        :exploited = true
        :mitigated = true
        :reporter = 0847739e5e2f2ecd1c57961af850fc6e
        :reporter:name = intel471
        :severity = high
        :type = arbitrary_code_execution

Search for Credentials

Search for credentials matching a filter criteria:

> intel471.credential.search --yield --domain "example.com" --size 2
WARNING: "intel471.credential.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
risk:leak=10973136a1f005e4f83c1bcb0fffdda4
        .created = 2026/08/03 15:58:05.943
        .seen = ('2023/11/13 18:26:40.000', '2023/11/13 18:26:40.001')
        :disclosed = 2023/11/12 14:40:00.000
        :name = synthetic log collection
        :reporter = 0847739e5e2f2ecd1c57961af850fc6e
        :reporter:name = intel471
WARNING: Intel471 API credentialSets returned HTTP code: -1 - Exception occurred during request: CannotOverwriteExistingCassetteException: Can't overwrite existing cassette ('/home/docs/checkouts/readthedocs.org/user_builds/vertex-storm-packages/checkouts/latest/packages/synapse-intel471/docs/mocks/userguide-credentials.yaml') in your current record mode (<RecordMode.ONCE: 'once'>).
No match for the request (<Request (GET) https://api.intel471.com/v1/credentialSets?credentialSetUid=11223344556677889900aabbccddeeff&v=1.20.0>) was found.
Found 1 recorded request(s) matching (<Request (GET) https://api.intel471.com/v1/credentialSets?credentialSetUid=11223344556677889900aabbccddeeff&v=1.20.0>) but they have already been consumed.

Search for Instant Messages

Search for instant messages matching a filter criteria:

> intel471.message.search --yield --message "credit card" --size 2
WARNING: "intel471.message.search" is deprecated: This command relies on the Intel471 Titan API, which Intel471 is retiring.
inet:service:message=d5df6eae51069575d460ac00d687360a
        .created = 2026/08/03 15:58:06.022
        .seen = ('2023/11/13 18:26:40.000', '2023/11/13 18:26:40.001')
        :account = 0baaff479a1ccdb8f089d3e26b0d0fb7
        :channel = 01d31ffff8c371f7683fc87d0d7d794a
        :platform = e1f45e580ac26d7da15f9d4291567ff2
        :text = Looking to buy credit card data, DM for details.
        :time = 2023/11/13 18:26:40.000
inet:service:message=da6547adabbe396cfe8ad150d55c01c2
        .created = 2026/08/03 15:58:06.042
        .seen = ('2023/11/13 18:26:40.100', '2023/11/13 18:26:40.101')
        :account = 1b8746b9f4120416bae75a143bac744c
        :channel = ff14acd46d22882a0b9daf145b80a6d1
        :platform = e1f45e580ac26d7da15f9d4291567ff2
        :text = Selling credit card info in bulk, contact via DM.
        :time = 2023/11/13 18:26:40.100

Use of meta:source nodes

Synapse-Intel471 uses a meta:source node and -(seen)> light weight edges to track nodes observed from the Intel471 API. The same meta:source node is used for both the Verity and Titan API surfaces.

> meta:source=1af648f200c0e9238260040855b534e5
meta:source=1af648f200c0e9238260040855b534e5
        .created = 2026/08/03 15:58:03.089
        :name = intel471 api

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Intel471. The following example shows how to filter the results of a query to include only results observed by Synapse-Intel471:

> inet:ipv4#my.tag +{ <(seen)- meta:source=1af648f200c0e9238260040855b534e5 }

Model Extensions

The following extended props are created by the Synapse-Intel471 Power-Up:

risk:vuln:_intel471:uid
    str - The Intel471 vulnerability report identifier.

media:news:_intel471:admiralty
    str - The Intel471 admiralty code.

media:news:_intel471:source:characterization
    str - The Intel471 source characterization.

risk:tool:software:_intel471:version
    str - The version of the tool reported by Intel471.

risk:tool:software:_intel471:variant
    str - The variant of the tool reported by Intel471.

risk:tool:software:_intel471:malware:family:uid
    str - The Intel471 malware family profile UID.

risk:compromise:_intel471:confidence
    int - The confidence level of a breach.