doLookup

Required function which takes entities from the user and returns enriched results

Summary

required function doLookup(entities, options, callback)

Parameters	Description
entities	An array of entity objects seen on the requesting user's screen
options	An options object with key value pairs representing the requesting user's options and their value
callback	A Node.js style callback which should return an array of resultObjects

For a quick overview of the doLookup method please see the Quick Start Guide.

The doLookup method is main entry point into your main module. This method is currently the only function that must be exported from your main module (integration.js). The method receives a list of entities that appeared on the user's screen and the returns contextual data related to those entities.

Parameters

The following is an explanation of the doLookup parameters

entities

The entities parameter is an array of Entity Objects. Each entity object contains a range of boolean flags that can be used to determine the type of the entity. In addition, every entity object contains a value, type, and types property.

For additional information please see the section on Entity Objects

Sample entities array

  [{
     // entity object
     type: 'IPv4',
     types: ['IP', IPv4'],
     isIP: true,
     isIPv4: true,
     isIPv6: false,
     isPrivateIP: true,
     IPType: 'IPv4',
     isDomain: false,
     isHash: false,
     isMD5: false,
     isSHA1: false,
     isSHA256: false,
     hashType: '',
     isEmail: false,
     isURL: false,
     value: '192.168.0.1',
     IPLong: 939655937,
     channels: []
 }]

options

The second parameter to the doLookup method is the options object which contains the values for the integration options as set in the integration config.js. Note that for per-user settings the value in the options object will reflect the value of the user requesting the lookup.

The key in the options object is the same value of the key property set in the integration config.js file.

Sample Options Object

{
    "apiKey": "lkasjdioajsdoij12lk3j1lk23j12",
    "lookupHashes": true,
    "throttleLookups": false
}

callback(error, results)

@param callback
@type Function
@param {String | Object} error
@param {Array} results

The callback must be called before execution of the doLookup method completes. The callback accepts two parameters.

The first parameter is an error which can either be a string literal or a JSON API error object. In the case of a string literal the returned string is displayed as an error in the notification window as well as tracked as an error in the integration

//callback parameters
callback(error, results);

If you have no error to return you should return null for the error parameter.

Please see below for additional information on error objects and result objects.