Skip to main content

SOCRadar

Integrate SOCRadar with Torq to trigger workflows from SOCRadar alarms and automate alarm triage, threat intelligence enrichment, dark web exposure handling, and takedown requests using API key configuration.

SOCRadar is an Extended Threat Intelligence (XTI) platform that unifies cyber threat intelligence, digital risk protection, and external attack surface management in a single console. It continuously monitors the surface, deep, and dark web for leaked credentials, impersonating domains, exposed assets, and emerging vulnerabilities, raising prioritized alarms for security teams. SOCRadar also provides in-house takedown services for phishing domains and brand abuse.

Torq enables quick and easy integration with SOCRadar, so you can automate anything and everything within moments. Torq's pre-built SOCRadar steps include:

  • List Incidents

  • Update Alarm Status

  • Add Alarm Comment

  • Get Entity Reputation

  • Change Alarm Severity

  • Change Alarm Assignee

  • Add or Remove Alarm Tag

  • Get Indicator Details

  • Get Botnet Data

  • Get PII Exposure

  • Update Botnet Data Status

  • +8 more...

If you don't see a step you need, you can create your own in various ways, such as using the Send an HTTP Request step or Torq's Step Builder, and share it across your organization.

Use SOCRadar to trigger workflows in Torq

Create a SOCRadar trigger integration in Torq

  1. Navigate to integration: In Torq, go to Build > Integrations > Triggers > SOCRadar and click Add Instance.

  2. Configure the integration:

    1. Enter a unique and meaningful name for the integration.

    2. Click Add. The webhook URL appears in the Endpoint column.

  3. Save information: Copy and save the webhook URL. You'll need it in SOCRadar.

Add the webhook in SOCRadar

  1. In the SOCRadar console, go to Settings > API & Integrations > Webhooks and click + New Webhook.

  2. Enter a name and description for the webhook, and select which events to send to the webhook.

  3. Paste the webhook you generated in Torq in the Webhook URL field.

  4. Select what fields to send in the Request Payload (All is recommended).

  5. Ensure the Enabled box is selected and click Confirm.

Use SOCRadar steps in a Torq workflow

Generate a SOCRadar API key

  • Navigate to API keys: In the SOCRadar console, go to Settings > API & Integrations > API Options and copy your Company API Key and Company ID.

An Advanced API Key is required for Advanced Threat Intelligence APIs.

Create a SOCRadar steps integration in Torq

  1. Navigate to the integration: In Torq, go to Build > Integrations > Steps > SOCRadar, then click Add Instance.

  2. Set up integration:

    1. Instance name: Enter a unique and meaningful name for the integration.

    2. API Key & Company ID: Paste the API key and Company ID you copied earlier.

  3. Leave the Base URL as default unless testing against pre-production.

  4. Finalize: Click Add to save.

Related Articles
Did this answer your question?