Enricher - CIRCL IPs related to SSL certificate


This article describes the specific configuration options to set up the enricher.
To configure the general options for the enricher, see Configure the general options.

Specifications

Enricher name

CIRCL IPs related to SSL certificate

Input

Hash-sha1.

Output

Enriches SSL fingerprint hash observables with all associated IP addresses.

API endpoint

https://www.circl.lu/v2pssl/cquery/

Description

The CIRCL IPs related to SSL certificate enricher uses the CIRCL API to poll the CIRCL Passive SSL database and to obtain all IP addresses associated with the input SSL SHA-1 hash fingerprints.

Requirements

Users need an API username and an API key. Sign up and subscribe to the service to obtain the required credentials to access the API endpoint exposing the service.

Configure the enricher parameters

  1. Edit the enricher.

  2. From the Observable types drop-down menu, select one or more observable types you want to enrich with data retrieved through the CIRCL IPs related to SSL certificate enricher.

  3. In the API user name field, enter your CIRCL user name.

  4. In the API key field, enter your CIRCL API key.

  5. To store your changes, click Save; to discard them, click Cancel.

See also