Actor Activity Searches

Feedback:

Send email

Actor Activity Searches

Search the Actor index to examine Threat Actors provided by threat intelligence feeds that have matched event logs during the specified time period.

Search text box: Specify a keyword or field-based search expression.

Keyword searches match any of the following fields: name, feed source, and tags.

Specify field-based name-value pairs for more precise targeting.

Applied Filters: Review and clear filters.

ThreatStream Publication Timeline: Bars indicate when the threat entity publication was last modified in ThreatStream. Click a bar to filter by date. Click and drag over two or more bars to set a date range filter.

About Actor Searches

The Anomali Threat Model is STIX-compatible and supports workflows for developing threat intelligence using a commonly understood taxonomy of threat entities. Security Analytics has a search index for the following threat model entities: Actors, Attack Patterns, Campaigns, TTPs, Threat Bulletins, and Vulnerabilities.

An Actor is a threat entity that refers to the individuals and organizations reputed to operate with malicious intent.

When you search the Threat Model index, you search by threat model entity fields. When you view a Security Analytics result details page, the record includes event log details for the match.

Filter UI

You can use the filter UI to apply the following filters to your search:

Date Range
Select a time period, a relative expression, or a date range. The time period filter is based on the ThreatStream publication date (the timestamp for "Modified" in ThreatStream).
TLP
Select a TLP (Traffic Light Protocol) associated with the entity.
Publication Status
Select a publication status: New, Pending Review, Review Requested, Reviewed, or Published.
Stream/Source
Select the name of the Feed in ThreatStream.
Owner
Select the ThreatStream user who created the entity.
Assignee
Select the ThreatStream user assigned to investigate.

Note: You can use negation in search expressions by selecting the NOT operator next to the filter heading. For example, to use negation with TLP, select the values you do not want to search and toggle on the NOT operator next to the TLP filter heading.

Filter Examples

modified_ts > "2021-11-09T15:50:00"

publication_status=new and tags=test

(publication_status = published or new) and feed_name contains group

(publication_status != new) and (feed_name contains group or crowd)

modified_ts > "2021-11-09T15:50:00" and (publication_status != new) and (feed_name contains group or crowd)

tags in ["GENERAL_TTP:Bot", "ACTOR_TYPE:Nation State"] and (modified_ts > "2020-12-01")

Filter Operators

The following table describes the logical operators you can use to form complex field-based search expressions. Operator names are not case sensitive.

Field Type	Use this Operator
String	=, !=, contains, startswith, in (for lists) Notes: The `startswith` operator matches any token in the field that starts with the pattern. For example, the expression `name startswith spider` matches a source field that has the value `GRACEFUL SPIDER`. Use double quotes to escape special characters and spaces in searches with `=`, `!=`, and `in` operators. Examples: `name = "GRACEFUL SPIDER"`, `name != "GRACEFUL SPIDER"`, `tags in ["GENERAL_TTP:Bot", "ACTOR_TYPE:Nation State"]`
Numeric	=, !=, <, <=, >, >=, in (for lists) For example, `id in [312, 274]` Note: The `in` operator does not accept float and double types.
Date	=, !=, <, <=, >, >=
Logical	AND, OR, NOT, (specify a parenthetical expression)

Filter Fields

The following table describes all of the possible Actor search fields. The fields listed in the first column correspond with results table column names. The field names listed in the second column are the fields you specify when you form field-based name-value pair search expressions.

Note: Not all fields are included as columns in the results table. When you search by fields without column names, you can locate the matching values in the details page. All of the fields listed in this table can be selected when you export results.

Column Name	Field Name	Type	Description
Assignee	assignee_user	String	User name on ThreatStream who is assigned to investigate.
Created	created_ts	Date	Timestamp of when the entity was created on ThreatStream. Notes: In the results table, the time displayed is UTC time, adjusted for the browser time zone. When you form search expressions, specify UTC time in the following format: <YYYY><MM><DD>T<HH>:<MM>:<SS>. The date part and the time part are separated by a capital T. You do not need to include T and the time values if you intend to search by date only. The following is an example of UTC time format: `2022-01-05T00:00:00` You can also specify a time zone offset for searches where time zone precision is important. In the following example, the time zone offset is the `-08:00` at the end: `2022-01-05T00:00:00-08:00` In exported results, the date and time are displayed as epoch time values. The following example shows the previous date-time example in epoch format: `1641342478`
Stream/Source	feed_name	String	Name of the feed in ThreatStream.
ID	id	Numeric	Entity ID in ThreatStream.
Modified	modified_ts	Date	Timestamp of when the entity was last updated on ThreatStream. Notes: In the results table, the time displayed is UTC time, adjusted for the browser time zone. When you form search expressions, specify UTC time in the following format: <YYYY><MM><DD>T<HH>:<MM>:<SS>. The date part and the time part are separated by a capital T. You do not need to include T and the time values if you intend to search by date only. The following is an example of UTC time format: `2022-01-05T00:00:00` You can also specify a time zone offset for searches where time zone precision is important. In the following example, the time zone offset is the `-08:00` at the end: `2022-01-05T00:00:00-08:00` In exported results, the date and time are displayed as epoch time values. The following example shows the previous date-time example in epoch format: `1641342478`
Name	name	String	Name of the entity.
Owner	owner_user	String	Name of the user in the organization on Anomali ThreatStream that created the entity.
Publication Status	publication_status	String	`new` `pending_review` `review_requested` `reviewed` `published`
Tags	tags	String	Tags associated with the entity that can be used to search for the entity.
TLP	tlp	String	TLP (Traffic Light Protocol) color to associate with the Actor. The TLP color provides a mechanism to communicate to consumers of the information whether further dissemination of this information is allowed; if yes, how freely can this information be distributed. To learn more about TLP, search for "Traffic Light Protocol" in your favorite search engine. Possible values: white, yellow, green, red

Actor Match Results Table

The following figure identifies the UI elements that you use to manipulate the displayed results to find information about Actor matches.

	Review and reset applied filters.
	Select a number of rows per page.
	Click the column header to sort the rows in ascending or descending order according to values in the column. Click a column header divider and drag it to make a column wider or more narrow.
	Go to the next page of results or another page by page number.
	Export the results table. See Export Search Results.
	Display the Details page for the matched event. See View Details.
	Perform an action related to the selected row. See Perform Actions.
	Create a Saved Search configuration. See Saved Searches.

Perform Actions

The Action menu above the results table allows you to perform the following actions.

Action	Description
Configure Fields	Select this option to configure the fields (columns) that appear in the results table.
Retrospective Search	Select this option to perform a retrospective search for the indicator correlated with the event.

View Details

Click the Details icon in the right-most column to display the details page.

The following figure summarizes the Actor Details page sections.

	Review key summary details. Click Open in ThreatStream to view the record in ThreatStream.
	Total Match count.
	Tags and other key details from ThreatStream.
	Use the tabs to learn more: Description: View the description from ThreatStream. See Actor Description. IOC Matches: View an IOC Match results table. See Matches. MITRE ATT&CK: View the MITRE technique matrix from ThreatStream. See MITRE ATT&CK.

Actor Description

The following figure shows the Description tab. The description is populated by the ThreatStream intel source.

Matches

The details page has a tab for IOC matches.

The matches results tables can be used just like the IOC Match activity search results table. For details, see IOC Match Results Table.

MITRE ATT&CK

The following figure shows the MITRE ATT&CK tab. This tab identifies MITRE ATT&CK associations (if any). The intel for the MITRE ATT&CK matrix is maintained by your ThreatStream organization.

You can click an associated technique and select view technique or Open in ThreatStream to go to additional details hosted on attack.mitre.org or ThreatStream.

Note: MITRE associations are based on your organization's MITRE release version setting in ThreatStream:

MITRE ATT&CK techniques associated with MITRE v6 and earlier are classified as TTPs in the Anomali Threat Model, and MITRE TTPs are used to identify associated attacks.
MITRE ATT&CK techniques and sub-techniques associated with MITRE v7 and later are classified as attack patterns in the Anomali Threat Model, and MITRE attack patterns are used to identify associated attacks.