User Guide

Synapse-Volexity User Guide

Synapse-Volexity adds new Storm commands to ingest threat intelligence from the Volexity Intel API, including reports, entities (IOCs), YARA rules, and tags (threat actors, malware families, campaigns, exploits).

Getting Started

Check with your Admin to enable permissions and find out if you need a personal API key.

Examples

Adding your personal API credentials

To add a personal API credentials:

> volexity.config.add myconfig user@example.com myapikey --scope self
Synapse-Volexity config "myconfig" added

List available configurations

To list the available configurations, use the volexity.config.list command:

> volexity.config.list
 name                      | scope    | owner
===========================|==========|====================================================
 myconfig                  | user     | root

Fetching a report

To fetch a specific report by its report tag or ID:

> volexity.ti.reports.get TIB-20220408 --yield
WARNING: Synapse-Volexity API error (401): Unauthorized

Enriching a report

To enrich an existing media:news node with associated entities, YARA rules, and tags:

> media:news:ext:id=TIB-20220408 | volexity.ti.reports.enrich --yield

Running the feeds

Synapse-Volexity provides three feed commands for incremental synchronization. On the first run, all records are ingested from the full endpoint. On subsequent runs, only changes since the last run are consumed.

Tags feed (threat actors, malware families, campaigns, exploits):

volexity.ti.tags.feed --yield

Entities feed (IOCs - IP addresses, hostnames, file hashes, emails):

volexity.ti.entities.feed --yield

YARA rules feed:

volexity.ti.yara.feed --yield

Setting up a cron job

To run the feeds on a regular schedule, set up cron jobs in Storm:

cron.add --period hourly/4 {volexity.ti.tags.feed}
cron.add --period hourly/4 {volexity.ti.entities.feed}
cron.add --period hourly/4 {volexity.ti.yara.feed}

Use of meta:source nodes

Synapse-Volexity uses a meta:source node and -(seen)> light weight edges to track nodes observed from the Volexity API.

> meta:source=0a5ded60b5193d3bcfe37a8322dab4b8
meta:source=0a5ded60b5193d3bcfe37a8322dab4b8
        .created = 2026/07/24 21:26:41.230
        :name = volexity api
        :type = synapse.volexity

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Volexity. The following example shows how to filter the results of a query to include only results observed by Synapse-Volexity:

> #cool.tag.lift +{ <(seen)- meta:source=0a5ded60b5193d3bcfe37a8322dab4b8 }