Security & Identity · CONNECTIONScan domains, IPs, crypto addresses, hashes and files, run RedKit audits, manage cases and look up threat actors on mlab.sh.
Explore 46 workflow actions for mlab.sh, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Validity, country, area, line type and allocated operator from numbering-plan metadata, plus scam shapes (premium-rate, callback ranges).
Parses the URL and flags phishing shapes: IP hosts, punycode, embedded credentials, shorteners, redirect parameters, encoded payloads.
Mailbox type (disposable, role account, consumer provider), canonical form, and how easily the domain can be spoofed, judged from its SPF, DMARC and DKIM.
Returns a greeting with your organization and plan.
Loads the target URL in a headless browser and returns every network request the page makes (documents, scripts, XHR, images…) with method, status, MIME type, bytes, timing and remote IP.
Returns the remaining and total daily quota for a scan type.
API key permission: scan.domain.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Schedules a recurring domain scan or redkit audit.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Deletes a schedule.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Pulls every indicator (IPs, domains, URLs, emails, hashes, crypto addresses, CVEs...) out of up to 1 MB of raw text, grouped by kind, each with its mlab analysis link.
Nodes and edges for an actor's neighbourhood: its malware, tools, ATT&CK techniques and CVEs at depth 1, plus the other actors sharing any of them at depth 2.
Country-level counts behind /map.
Which actors are documented exploiting a CVE.
Returns file metadata and per-job analysis output.
The raw output of a single analysis tool for a file, kept out of /scan/file/results so that summary stays light.
Returns the result set of the last scan: discovered subdomains, DNS resolve and TXT records, SSL certificates and well-known files.
Returns SSL/TLS certificates observed for a domain (from certificate transparency logs).
The complete domain scan, schema domain-report/2: every check grouped by section (registration, dns, mail, web, certificates, surface), the aggregated findings with the section they belong to, and.
One actor by slug, with aliases, tools, CVEs and techniques.
Starts an asynchronous security scan for a domain.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Starts a RedKit web audit of a domain with the chosen plugins.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Techniques bucketed by tactic in kill-chain order, each with the number of indexed actors documented using it.
Cases are part of the Team and Enterprise plans.
The tags set on an audit's findings.
Every scheduled scan of the organization.
Threat actors, filtered by origin, motivation, sector, CVE or update time.
The same lookup as the GET route, batched: up to 100 addresses in one request.
The same lookup as the GET route, for up to 500 digests (an EDR export, say).
Labels, sanctions status, risk scoring and address type for an address on Bitcoin, any of 13 EVM chains, Tron, Solana, TON or Dogecoin.
Checks an MD5, SHA-1 or SHA-256 digest against CIRCL hashlookup (NIST NSRL), which knows legitimate files and flags some known malware, plus any sample already analysed on mlab (mlabsample).
Vendor (from the IEEE OUI registry), unicast or multicast, universal or locally administered, randomized addresses, virtualization vendors, reserved ranges, the EUI-64 IPv6 interface ID and every.
For a single address: geolocation, ISP/ASN, network type (proxy, hosting, mobile), reverse DNS with forward confirmation, the RDAP allocation record for its block including the network abuse contact.
Turns a schedule on or off.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cases are part of the Team and Enterprise plans.
The organization's RedKit quota.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
The audit's status; once completed, its raw results in rawjson.
Sets a tag on a finding.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Parses up to 1 MB of pasted text (one indicator per line, or any free text), keeps at most 200 distinct indicators and returns what mlab already knows about each, from cache: no scan quota is spent.
Removes a tag from a finding.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Cases are part of the Team and Enterprise plans.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in mlab.sh. A saved workflow is not a completed provider action.
