Documentation

Actions

Action helpers exposed to CYBERQUEST scripts through CQ.Actions.

Overview

The CQ.Actions namespace provides the TI and SSL helpers for use in CYBERQUEST scripts.

Available members

Access path	Exported helper
`CQ.Actions.TI`	`TI`
`CQ.Actions.SSL`	`SSL`

Usage

‎

TI

CQ.Actions.TI manages Threat Intelligence block lists. Before invoking a TI request, configure the target host and bearer token:

CQ.Actions.TI.setHost("https://webapplication");
CQ.Actions.TI.setBearerToken("token");

Configuration and helpers

Method	Parameters	Returns
`setHost(value)`	`value` (string): API base URL.	`undefined`
`getHost()`	None.	Configured host string. Throws if it is undefined.
`setBearerToken(value)`	Bearer token string without the `Bearer` prefix.	`undefined`
`validateBearerToken()`	None.	`undefined`. Throws if authentication is missing.
`setBody(data)`	Any JSON-serializable value.	`undefined`
`getOutput(response)`	An `HttpResponse`.	Parsed JSON, or `{}`.
`addSecondsToNow(seconds)`	Number of seconds.	Date-time string formatted as `YYYY-MM-DD HH:mm:ss`.

Threat Intelligence operations

Method	Parameters	Returns
`CheckListInTI(data)`	Object containing `list` and `type`.	Parsed API response, or `{}`.
`CheckAndBlockIP(data, expires, comment, list)`	One value or an array; optional expiration, comment, and list.	Parsed API response, or `{}`.
`GetBlockedIps(list)`	Optional list name.	`IntegrationHTTPResponse` whose `data` is an array of IP entries.
`GetBlockedDomains(list)`	Optional list name.	`IntegrationHTTPResponse` whose `data` is an array of domain entries.
`AddBlockedIps(data, expires, comment, list)`	One value or an array; optional expiration, comment, and list.	Parsed API response, or `{}`.
`AddBlockedDomains(data, expires, comment, list)`	One value or an array; optional expiration, comment, and list.	Parsed API response, or `{}`.
`RemoveBlockedIps(data)`	One IP value or an array.	Parsed API response, or `{}`.
`RemoveBlockedDomains(data)`	One domain value or an array.	Parsed API response, or `{}`.

For add and check-and-block operations, expires defaults to null, comment to "", and list to null. An integer expires value is interpreted as seconds from the current time.

SSL

CQ.Actions.SSL validates TLS certificates for one or more hosts.

CQ.Actions.SSL.validateCertificate(host);
CQ.Actions.SSL.validateCertificates(hosts);

Method	Parameters	Returns
`validateCertificate(host)`	`host` (string): hostname to validate.	Result object with `isSuccess` and `data`.
`validateCertificates(hosts)`	`hosts` (array of strings).	`{ isSuccess, data }`, where `data` contains one result per host.

For validateCertificate, data contains STDOUT and STDERR. When the certificate expiration can be parsed, it also contains expiration_date and days_difference. Invalid input returns { isSuccess: false, message }.