Enricher - CIRCL IPs related to SSL certificate

Note

This article describes how to configure a particular enrichment source. To see how to configure enrichers in general, see Configure enrichers.

	Specifications
Enricher name	CIRCL IPs related to SSL certificate
Input	Hash-sha1.
Output	Enriches SSL fingerprint hash observables with all associated IP addresses.
API endpoint	https://www.circl.lu/v2pssl/cquery/
Description	The CIRCL IPs related to SSL certificate enricher uses the CIRCL API to poll the CIRCL Passive SSL database and to obtain all IP addresses associated with the input SSL SHA-1 hash fingerprints.

Requirements

Users need an API username and an API key. Sign up and subscribe to the service to obtain the required credentials to access the API endpoint exposing the service.

Configure the enricher parameters

1. Edit the enricher.

2. From the Observable types drop-down menu, select one or more observable types you want to enrich with data retrieved through the CIRCL IPs related to SSL certificate enricher.

3. In the API user name field, enter your CIRCL user name.

4. In the API key field, enter your CIRCL API key.

5. To store your changes, click Save; to discard them, click Cancel.