IoC Search GraphQL API
The ESET Threat Intelligence GraphQL API enables users to search for Indicators of Compromise (IoC) in the ESET database and check the reputation of specific indicators. All searches return results from the last 90 days and are limited to 100 records per one search. Searches are case-insensitive.
ESET Threat Intelligence GraphQL API access
To access the ESET Threat Intelligence GraphQL API:
1.Generate the IoC API Token for further authentication.
2.Use the single endpoint https://eti.eset.com/graphql to send all GraphQL requests, including introspection queries.
POST https://eti.eset.com/graphql Authorization: Bearer <your IoC API token> Content-Type: application/json |
Refer to the ESET Threat Intelligence IoC Search GraphQL API usage examples to get example GraphQL queries and common investigation workflows.
|
To explore the complete live schema, run an introspection query against the endpoint, or use a GraphQL client such as Bruno or Postman. Tools like Bruno or Postman natively support GraphQL. Point them to https://eti.eset.com/graphql with your Bearer token, and they will automatically run introspection to build a browsable schema and query builder that provides autocomplete, inline field description, and validation as you type. |
Queries
The ESET Threat Intelligence GraphQL API accepts the following queries:
Query |
Purpose |
Input |
|---|---|---|
iocSearch |
Searches across all IoC types (free text). Detects the indicator type (Domain, URL, IP, or Hash) from the value; supports a wildcard % for partial matches, for example, %.example.com or 44d88612fea8a8f36de82e1278abb02%. |
conditions: string! |
iocSearchBotnet |
Looks up Botnet IoCs linked to a file SHA-1. |
sha1: string! |
iocSearchCnc |
Looks up Command and Control (C&C) server IoCs by host. |
cnc: string! |
iocSearchDomain |
Looks up Domain-type IoCs. |
domain: string! |
iocSearchFile |
Looks up a single File IoC by SHA-1. |
sha1: string! |
iocSearchFiles |
Looks up multiple File IoCs by SHA-1 (up to 10). |
sha1: string!! |
iocSearchIp |
Looks up IP-type IoCs. |
ip: string! |
iocSearchUrl |
Looks up URL-type IoCs. |
url: string |
iocReputationCheck |
Checks whether ESET currently blocks one or more indicators. Accepts SHA-256, SHA-1, URL, IP, or Domain lists (up to 100 each, only one type per request). |
One of (lists): •domain •ip •sha1 •sha256 •url |
Returned fields per IoC
IoC Type |
Returned Fields |
|---|---|
Botnet |
threat, valid_to, cncs (list of associated C&C endpoints), file (linked file sample), targets (targeted entities) |
C&C Server |
cnc (URL), host, ip, port, threat, state, domain_first_seen, domain_last_seen, domain_count, last_alive, prot_l4, prot_l7, valid_to |
Domain |
domain, ip, state, reason, confidence, location, first_seen, last_seen, valid_to, count, count_24h, direction, protocol, opener_detection, downloaded_detection, countries |
File |
md5, sha1, sha256, subtopic, first_seen, threat (malware family), countries (geo distribution) |
IP |
ip, port, state, reason, confidence, location, direction, protocol, valid_to |
URL |
url, domain, ip, threat, state, reason, confidence, first_seen, last_seen, valid_to, count, count_24h, opener_detection, downloaded_detection, subtopic, countries |
Reputation Check |
indicator_value, blocked (true/false) |
The results returned by iocSearch combine all IoC types into a single unified result list. Check __typename to differentiate the IoC types.