Actors

Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Actors. See Threat Model Search for details.

For example,

GET /api/v1/threat_model_search/?model_type=actor

GET /api/v1/actor/associated_with_intelligence/?value={value}

GET /api/v1/actor/associated_with_intelligence/?ids={comma_separated_id_list}

For example,

GET /api/v1/actor/associated_with_intelligence/?value=google.com returns all Actors associated with google.com.

GET /api/v1/actor/{id}/<entity_type>/

For example,

GET /api/v1/actor/234673/malware/ returns all malware objects associated with the specified actor.

Campaigns associated with the Actor.

When creating an Actor, specify the Campaign ID. See Campaigns.

datetime

Time stamp of when the Actor was created on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Free-form text associated with the Actor.

Incidents associated with the Actor.

When creating an Actor, specify the Incident ID. See Incidents.

Observables associated with the Actor on the ThreatStream platform.

When creating an Actor, specify the observable ID. See Intelligence.

Whether the Actor is public or private (including belonging to a trusted circle).

False—if the Actor is private or belongs to a Trusted Circle

True—if the Actor is public

Default: False

Whether the Actor is a team or known to work as an individual (as specified in the Team check box in the UI).

True—Actor is a team

False—Actor is an individual

Default: False

The limit variable controls the number of results returned every time an API call is made; the total number of results may be much larger than returned in one API call.

If limit is not specified, 20 results are returned with each API call. Specifying limit=0 will return up to a maximum of 1000 results (if available).

Time stamp of when the Actor was last updated on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Name of the Actor.

Actor name is associated with your organization. Therefore, the name must be unique within your organization. However, two Actors with the same name can exist on ThreatStream as long as they belong to different organizations.

The name can contain up to 255 characters.

An Actor can be in new, pending_review, review_requested, reviewed, published statuses.

remote_api (for ThreatStream OnPrem only)

Whether the entity is remote (stored on Cloud).

Value returned for this attribute is true when the entity is remote.

Signatures associated with the Actor.

When creating an Actor, specify the Signature ID. See Signatures.

skip_associations

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/actor/{id}/?skip_associations=true

skip_intelligence

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/actor/{id}/?skip_intelligence=true

IDs of the sophistication type associated with the Actor. To obtain a list of IDs for sophistication type, make an API call to /api/v1/actorsophisticationtype/

This attribute specifies the level of sophistication observed about the Actor. The Sophistication levels available on ThreatStream follow the Threat Actor Sophistication Vocabulary for STIX.

Specify the time when this Actor was first known to be active.

Date must be specified in this format: YYYYMMDDThhmmss and in UTC format.

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Tags assigned to the Actor.

A tag is a meaningful name or any other string value assigned to identify the information.

For example, spear phishing,exploitation.

Traffic Light Protocol designation for the Actor—red, amber, amber+strict, green, clear.

TTP (Threat Bulletins) associated with the Actor.

When creating an Actor, specify the TTP ID. See TTPs (Tactics, Techniques, and Procedures).

Victim type associated with the Actor.

When creating an Actor, specify the ID of the Victim type. To obtain a list of Victim types, make an API call to /api/v1/victimtype/.