Accessing Threat Models

The Threat Model list page displays the threat model entities — Actors, Attack Patterns, Campaigns, Courses of Action, Identities, Incidents, Infrastructure, Intrusion Sets, Malware, Signatures, Threat Bulletins, Tools, TTPs, and Vulnerabilities — that your organization has access to on ThreatStream. It enables you to quickly search entities via keyword searches and easy-to-use filtering.

Access the Threat Model list page by navigating to ThreatStream > Analyze > Threat Model.

Note: Due to the large number of Vulnerabilities imported by the system on a daily basis, Vulnerabilities do not appear in the results by default. You must click Vulnerabilities under Filter Options for Vulnerabilities to appear in search results.

From the Threat Model list view page, you can also create new threat model entities and apply the following actions to selected threat model entities: edit tags, add to investigations, share via email, and delete.

Search Threat Model: Perform basic threat model search by keywords. See Performing Basic Threat Model Searches for more information.

Advanced Search: Perform an advanced threat model search. See Performing Advanced Threat Model Searches for more information.

Filter Options: Filter displayed search results. Note that the filter options are only available in Basic search mode and are grayed out in Advanced search mode.

Filter	Description
Entity Type	Filter search results by entity type. Entity types include: Actors, Attack Patterns, Campaigns, Courses of Action, Identities, Incidents, Infrastructure, Intrusion Sets, Malware, Signatures, Threat Bulletins, Tools, TTPs, and Vulnerabilities. Vulnerabilities are not included in search results unless you select Vulnerabilities. Tip: When you select, the Actors filter, you can select additional Actor type filters When you select the Infrastructure filter, you can select additional identity class filters. When you select the Threat Bulletins filter, an Exclude Email filter is available that removes Threat Bulletins created as a result of phishing email imports from the list. When you select the Tools filter, you can select additional tool type filters. When you select the Signatures filter, additional Signature type filters are available, thus enabling you to search by Signature type. When you select the Malware filter, additional Malware type filters are available, thus enabling you to search by Malware type. When you select the Vulnerabilities filter, additional CVSS 2.0 score, CVSS 2.03 score, EPSS score, and EPSS percentile filters are available, thus enabling you to filter by Vulnerability severity, EPSS score, and EPSS percentile.
Key Filters	To view only entities created by your organization, select Created by My Organization. To view only entities which you requested to review, select Review Requested by Me. To view only entities provided by open source intelligence streams, select Open Source.
Visibility	Filter entities by visibility: Anomali Community or My Organization. When you select My Organization, entities shared with Trusted Circles are also included in the results.
TLP	Filter entities by TLP color.
Modified	Filter entities by those modified in the Last 30 Days, Last 90 Days, This Year, or a Custom Date Range.
Tags	Filter entities based on Tags.
Source Locations	Filter entities based on source countries, regions, or administrative areas (US and Washington DC only).
Target Locations	Filter entities based on target countries, regions, or administrative areas (US States and Washington DC only).
Target Industry	Filter entities based on target industries or sub-industries.
Publication Status	Filter entities based on Publication Status. See Reviewing Threat Model Entities for Publication for more information.
Feeds	Filter entities based on feeds from which they originated.
Source	Filter entities based on Source. Sources include Trusted Circles and APP Store feeds.
Workgroups	Filter entities that are visible only to specific workgroups. See Restricting Threat Model Entities to Workgroups for more information.
Assignee	Filter entities based on Assignee users in your organization.
Owner	Filter entities based on Owner. An Owner is the user who created the entity. For entities created by your organization, specific users are displayed. "Analyst" is displayed for all entities shared through Trusted Circles. For entities shared with the Anomali Community or anonymously through Trusted Circles, no value is shown. Note: The Owner column is not displayed by default. You must select it from the Table Settings. See item for more information.

To reset filters, click Reset Filters. To close all filters, click Close all.

View selected filters.

Type: Threat model type

Name: Name of the threat model entity.

Publication status: Current publication status of the entity.

Source: Source of the threat model entity.

Visibility: Visibility setting for the entity displays what group of users can see the threat model entity.

Owner: Threat model entity owner.

Modified: Most recent date the threat model entity was modified.

Source Locations: Source locations assigned to a threat model entity. To view all assigned source locations, click the arrow corresponding with the threat model entity of your interest.

Target Locations: Target locations assigned to a threat model entity. To view all assigned target locations, click the arrow corresponding with the threat model entity of your interest.

Target Industry: Target industries assigned to a threat model entity. To view all assigned target industries, click the arrow corresponding with the threat model entity of your interest.

Tags: Tags associated with the threat model entity. To view all tags, click the corresponding arrow in the Tags column or next to the threat model entity of your interest.

Table Settings: Select the columns you want to be displayed. Available columns include Type, Name, Publication Status, Source, Visibility, Assignee, Owner, Modified, Created, Date Published, Source Created, Source Modified, Source Locations, Target Locations, Target Industry, CVSS 2.0, CVSS 3.0, and Tags. Additionally, you can change the order of columns in the table by using the drag-and-drop functionality, specify the number of rows to be displayed per page, and enable or disable horizontal scrolling.

From the Threat Model list view page, you can also take the following actions:

Create a new threat model entity. See Adding New Threat Model Entities for more information.
Summarize selected threat model entities. See Summarizing Threat Model Entities with Anomali Copilot for more details.

Note: An active Anomali Copilot suite subscription is required to use this feature. Contact your Anomali account Sales representative for details.

Edit tags of selected threat model entities. See Bulk Tag Management of Threat Models for more information.
Add selected threat model entities to a new or existing investigation. When you add entities to an investigation you can additionally add any observables associated with the entities to the investigation. See Adding Threat Model Entities to Investigations for more information.
Share selected threat model entities with ThreatStream users (within or outside your organization) or non-ThreatStream users through email. See Sharing Threat Model Entities via Email for more information.
Delete selected threat model entities. See Deleting Threat Model Entities for more information.

Performing Basic Threat Model Searches

Basic searches enable you to quickly locate threat model entities of interest by a keyword entered.

When you perform a basic search, ThreatStream queries the following fields:

Entity	Fields Searched
Actors	Aliases, Description, Name, Tags
Attack Patterns	Aliases, Description, Name, Tags
Campaigns	Aliases, Description, Name, Tags
Courses of Action	Description, Name, Tags
Incidents	Description, Name, Tags
Infrastructure	Aliases, Description, Name, Tags
Identities	Description, Name, Tags
Intrusion Sets	Aliases, Description, Name, Tags
Malware	Aliases, Description, Name, Tags
Signatures	Description, Name, Tags
Threat Bulletins	Description, Name, Tags
Tools	Aliases, Description, Name, Tags
TTPs	Aliases, Description, Name, Tags
Vulnerabilities	Aliases, Description, Name, Tags

When performing threat model searches, follow these guidelines:

There is an implied AND operator between keywords in multi-word queries. Words do not need to be contained in the same field for an entity to appear in the search results.

For example, an entity containing foo in its description and bar in its name would be returned for the query foo bar.
To search for complete phrases, enclose your query in double quotes.

For example, to search for the phrase foo bar, enter "foo bar".
All special characters, except periods (.) and commas (,) are treated as joins between the words preceding and succeeding them. Therefore, simply enter a search string with special characters, such as a name, an email address, domain name, or URL.

Note that queries containing special characters may return additional search results because the special characters in the search string are not matched exactly but treated as joins between the words of the search string.

For example, searching for APT-28 will return matches for APT-28, APT+28, APT 28, APT/28, APT#28 and so on.
Periods and commas are matched exactly when an alphanumeric character precedes and succeeds the character. Therefore, to search for an IP address, simply enter the IP address in the dotted-decimal form.

For example, to search for the IP address 1.2.3.4, enter 1.2.3.4
When you search for a specific text in the Basic search, the advanced search query associated with it uses the = operator to search through the body (the body field) of the threat model. The = operator searches for results that are identical to the value after the operator.