mlab.sh × AmbactiBring mlab.sh into
the flow of work.
A little less busywork with mlab.sh.
Domain3 capabilities+
- Scan a domain
Launch a domain scan and (optionally) wait for the results
- Get the status of a domain scan
- Get the results of a domain scan
IP Address1 capabilities+
- Look up an IP address
Resolve geolocation, ASN and ownership for an IP address
Crypto Address1 capabilities+
- Look up a crypto address
Check sanctions, labels and risk score for a crypto address
File2 capabilities+
- Upload a file for analysis
Upload a file (max 10MB) and launch analysis
- Get file analysis results
Fetch analysis results by SHA-256 hash
Quota1 capabilities+
- Get remaining quota
Get the remaining daily quota for a scan type
CVE3 capabilities+
- Search vulnerabilities
Search vulnerabilities by keyword, vendor or product
- Get a CVE by ID
Retrieve full details for a CVE (including EPSS and KEV data)
- Get latest vulnerabilities
Fetch vulnerabilities from the last 7 days
Threat Actor3 capabilities+
- List or search threat actors
List actors with optional filters (origin, motivation, sector)
- Get a threat actor
Get a single actor by slug, including aliases, tools, CVEs and techniques
- Get actors that exploit a CVE
Reverse lookup: which actors are known to exploit a given CVE
Frequently asked
questions.
What could an Ambacti integration do with mlab.sh?
The documented operations include Domain: Scan a domain; Domain: Get the status of a domain scan; Domain: Get the results of a domain scan; IP Address: Look up an IP address.
Could I keep a workflow read-only?
For a read-only workflow, limit account permissions to reading data and exclude actions that create, update, or delete records.
Will every action run automatically?
Choose which steps could run on their own and which should pause for review. Changes should follow the permissions and approval rules you set.
Do I need to review actions in mlab.sh?
Decide which work could run on its own and which steps need your review.