Package Documentation
Storm Package: synapse-volexity
The following Commands are available from this package. This documentation is generated for version 0.1.0 of the package.
Storm Commands
This package implements the following Storm Commands.
volexity.config.add
Add a Synapse-Volexity configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Add a global configuration
volexity.config.add global_config user@example.com secret1234
// Add a configuration for the current user
volexity.config.add --scope self my_config user@example.com secret5678
Usage: volexity.config.add [options] <name> <principal> <apikey>
Options:
--help : Display the command usage.
--ssl-noverify : Do not perform SSL/TLS verification.
--proxy <proxy> : Configure the proxy usage. (default: True)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Volexity. (default: rep.volexity)
--scope <scope> : Set the scope on the configuration. (default: global, choices: global, self, unscoped)
--no-check-apikey : Do not perform API key validation with Volexity.
Arguments:
<name> : A unique name for the configuration.
<principal> : The Volexity API username (email).
<apikey> : The Volexity API key.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.config.del
Delete a Synapse-Volexity configuration.
Examples:
// Delete the "fooconfig" configuration
volexity.config.del fooconfig
Usage: volexity.config.del [options] <name>
Options:
--help : Display the command usage.
Arguments:
<name> : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.config.list
Display the list of Synapse-Volexity configurations you have access to.
Usage: volexity.config.list [options]
Options:
--help : Display the command usage.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.config.migrate
Migrate options for all Synapse-Volexity configurations.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Migrate the tag prefix for all configurations
volexity.config.migrate --tag-prefix my.tagpref
Usage: volexity.config.migrate [options]
Options:
--help : Display the command usage.
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Volexity. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.admin
volexity.config.show
Show the details of a configuration.
Examples:
// Show the in-use configuration for the current user
volexity.config.show
// Show a configuration by name
volexity.config.show myconfig
Usage: volexity.config.show [options] <name>
Options:
--help : Display the command usage.
Arguments:
[name] : The name of the configuration.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.config.update
Update the configuration of a defined Synapse-Volexity configuration.
The proxy argument can be set to one of the following values:
true: Use the Cortex configured proxy if set.
false: Do not use the Cortex configured proxy if set.
<str>: A proxy URL to use.
Examples:
// Set the permission level for user "myuser" to "admin" on the "fooconfig"
// configuration
volexity.config.update fooconfig --perm user myuser admin
// Set the permission level for the "all" role to "deny" on the
// "fooconfig" configuration
volexity.config.update fooconfig --perm role all deny
// Do not verify the SSL certificate when connecting to "fooconfig"
volexity.config.update fooconfig --ssl-verify (false)
// Change the name of the "fooconfig" configuration to "barconfig"
volexity.config.update fooconfig --name barconfig
Usage: volexity.config.update [options] <config>
Options:
--help : Display the command usage.
--principal <principal> : The Volexity API username (email). (default: None)
--apikey <apikey> : The Volexity API key. (default: None)
--perm <perm> : Set the permission level for a user or role on this configuration.
Arguments to this option are ``scope``, ``name``, ``level``:
<scope>: The scope for the permission, either "user" or "role".
<name>: The user/role name depending on scope.
<level>: The $lib.auth.easyperm.level, or None to remove the permission.
(default: None)
--ssl-verify <ssl_verify> : Set whether to verify the SSL certificate of the server. (default: None)
--proxy <proxy> : Configure the proxy usage. (default: None)
--tag-prefix <tag_prefix> : The tag prefix to use when recording data from Volexity. (default: None)
--name <name> : Rename the configuration. (default: None)
--no-check-apikey : Do not perform API key validation with Volexity.
Arguments:
<config> : The name of the configuration to modify.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.ti.entities.feed
Ingest entities (IOCs) from the Volexity Intel API.
Uses the ``/feeds/entities`` endpoint. On the first run, changes from
the last 24 hours are ingested. On subsequent runs with ``--since-last``,
only changes since the last run are consumed.
Entity types include IP addresses, hostnames, file hashes, and email
senders. Related tags are resolved and linked to ingested entities.
Use ``--updated-after`` to override the default 24-hour lookback window for
one-off or backfill runs. When ``--since-last`` is used and a stored
offset exists, it takes precedence over ``--updated-after``.
Examples:
// Run the entities feed (defaults to last 24 hours on first run)
volexity.ti.entities.feed --yield
// Run the entities feed using the last offset (incremental)
volexity.ti.entities.feed --yield --since-last
// Ingest entities changed in the last 30 days
volexity.ti.entities.feed --yield --updated-after -30days
Endpoints:
/entities : List entities (IOCs).
/feeds/entities : Entity change feed.
/tags : List tags.
Usage: volexity.ti.entities.feed [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Show verbose debug output.
--size <size> : Maximum number of nodes to yield per batch. (default: 100)
--since-last : Use the last feed offset to resume ingestion.
--updated-after <updated_after>: Ingest changes updated after this time (e.g. -30days or 2026-01-01). (default: -1day)
--config <config> : The name of the Synapse-Volexity configuration to use. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.ti.reports.enrich
Enrich an existing ``media:news`` node with data from the Volexity Intel API.
This is a node-action command that operates on inbound ``media:news`` nodes.
It uses the ``:ext:id`` property to look up the report and fetch associated
entities, YARA rules, and tags.
Examples:
// Enrich a specific report node
media:news:ext:id=TIB-20220408 | volexity.ti.reports.enrich --yield
Endpoints:
/reports/{id} : Get report by ID or report_tag.
/entities : List entities (IOCs).
/yara : List YARA rules.
/tags : List tags.
/reports/{id}/attachments/{name}: Get individual report attachment.
Usage: volexity.ti.reports.enrich [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Show verbose debug output.
--config <config> : The name of the Synapse-Volexity configuration to use. (default: None)
--recursion-depth <recursion_depth>: Maximum depth for related tag ingestion (0 = no recursion). (default: 1)
Inputs:
media:news : media:news nodes
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.ti.reports.get
Fetch a single report from the Volexity Intel API by report ID or report tag.
This command retrieves the report metadata, associated entities (IOCs),
YARA rules, and tags, creating appropriate nodes and relationships.
Examples:
// Fetch a report by report tag
volexity.ti.reports.get TIB-20220408 --yield
// Fetch a report by Volexity portal ID
volexity.ti.reports.get kA14N0000000oSaSAI --yield
Endpoints:
/reports/{id} : Get report by ID or report_tag.
/entities : List entities (IOCs).
/yara : List YARA rules.
/tags : List tags.
/reports/{id}/attachments/{name}: Get individual report attachment.
Usage: volexity.ti.reports.get [options] <id>
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Show verbose debug output.
--config <config> : The name of the Synapse-Volexity configuration to use. (default: None)
--recursion-depth <recursion_depth>: Maximum depth for related tag ingestion (0 = no recursion). (default: 1)
Arguments:
<id> : The report ID or report tag to fetch.
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
volexity.ti.yara.feed
Ingest YARA rules from the Volexity Intel API.
Uses the ``/feeds/yara`` endpoint. On the first run, changes from the
last 24 hours are ingested. On subsequent runs with ``--since-last``,
only changes since the last run are consumed.
Related tags are resolved and linked to ingested YARA rules.
Use ``--updated-after`` to override the default 24-hour lookback window for
one-off or backfill runs. When ``--since-last`` is used and a stored
offset exists, it takes precedence over ``--updated-after``.
Examples:
// Run the YARA feed (defaults to last 24 hours on first run)
volexity.ti.yara.feed --yield
// Run the YARA feed using the last offset (incremental)
volexity.ti.yara.feed --yield --since-last
// Ingest YARA rules changed in the last 30 days
volexity.ti.yara.feed --yield --updated-after -30days
Endpoints:
/yara : List YARA rules.
/feeds/yara : YARA rule change feed.
/tags : List tags.
Usage: volexity.ti.yara.feed [options]
Options:
--help : Display the command usage.
--yield : Yield the newly created nodes.
--debug : Show verbose debug output.
--size <size> : Maximum number of nodes to yield per batch. (default: 100)
--since-last : Use the last feed offset to resume ingestion.
--updated-after <updated_after>: Ingest changes updated after this time (e.g. -30days or 2026-01-01). (default: -1day)
--config <config> : The name of the Synapse-Volexity configuration to use. (default: None)
The command is accessible to users with one or more of the following permissions:
power-ups.volexity.adminpower-ups.volexity.user
Storm Modules
This package does not export any Storm APIs.