Splunk SOAR, Cortex XSOAR, Tines and Torq
A threat.detected webhook opens a case with the policy and hostname. If the playbook decides to block, it pushes the IOC to the block list with an expiry, and every policy stops resolving the destination on the next publish.
Integration steps for Splunk SOAR, Cortex XSOAR, Tines and Torq
Inbound: the webhook
Register a webhook for threat.detected and list.updated. The playbook verifies the signature in its first step.
curl -s https://control.securd.com/api/v1/gateway/webhooks \
-H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{ "name": "soar", "url": "https://soar.example.com/hooks/securd", "events": ["threat.detected", "list.updated"] }'
Outbound: push the verdict
The push API accepts an API key with the lists:write scope. Set expires_in so a temporary block is removed automatically.
curl -s https://control.securd.com/api/v1/gateway/push/$BLOCK_LIST_UUID/entries \
-H "Authorization: Bearer sk_..." -H "X-Tenant-UUID: $TENANT" \
-H "Content-Type: application/json" \
-d '{ "entries": [ { "value": "exfil-data.click", "confidence": 95, "expires_in": 86400, "source_ref": "case-4412" } ] }'
Tines and Torq
Both platforms are HTTP-native. The webhook is a trigger; the push is an HTTP request action using the API key from the credential store. No custom integration is required.
Two queries: one confirms ingestion, one lists first-seen destinations by policy.
Round trip test
1. Resolve a known-bad test name from a policy.
2. Confirm the playbook received threat.detected within seconds.
3. Push the name with expires_in=600.
4. Resolve again from a second policy: the answer is the block page address.Change log shows the push
curl -s "https://control.securd.com/api/v1/gateway/audit/changelog" -H "Authorization: Bearer $TOKEN" -H "X-Tenant-UUID: $TENANT" | jq '.data[0]'Evaluate Agent DNS with your own agent traffic
Forward events from a single policy and review them with your security team.