Attack Patterns

Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Attack Patterns. See Threat Model Search for details.

For example,

GET /api/v1/threat_model_search/?model_type=attackpattern

GET /api/v1/attackpattern/associated_with_intelligence/?value={value}

GET /api/v1/attackpattern/associated_with_intelligence/?ids={comma_separated_id_list}

For example,

GET /api/v1/attackpattern/associated_with_intelligence/?value=google.com returns all Attack Patterns associated with google.com.

For example,

GET /api/v1/attackpattern/234673/malware/ returns all malware objects associated with the Attack Pattern.

Actors associated with the Attack Pattern.

When creating an Attack Pattern, specify the Actor ID. See Actors .

Attack Pattern entities associated with the Attack Pattern.

Format used for the body text of the description: markdown or richtext

Default: markdown

Campaigns associated with the Attack Pattern.

When creating an Attack Pattern, specify the Campaign ID. See Campaigns .

Course of action entities associated with the Attack Pattern.

When creating an Attack Pattern, specify the Course of Action ID.

datetime

Time stamp of when the Attack Pattern was created on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

The free-form text associated with the Attack Pattern (as specified in the Description field in the UI).

Identities associated with the Attack Pattern.

When creating an Attack Pattern, specify the Identity ID.

Incidents associated with the Attack Pattern.

When creating an Attack Pattern, specify the Incident ID.

Infrastructure entities associated with the Attack Pattern.

When creating an Attack Pattern, specify the Infrastructure ID.

Observables associated with the Attack Pattern on the ThreatStream platform.

When creating an Attack Pattern, specify the observable ID. See Intelligence.

Intelligence Initiatives associated with the Attack Pattern.

Intrusion sets associated with the Attack Pattern.

When creating an Attack Pattern, specify the Intrusion Set ID.

Whether the Attack Pattern user and organization information is anonymized.

True—if information is anonymized

False—if information is not anonymized

Whether the Attack Pattern entity can be cloned.

Whether the Attack Pattern is described in the MITRE list.

True—if the Attack Pattern is described

False—if the Attack Pattern is not described

Whether the Attack Pattern is public or private (including belonging to a trusted circle).

False—if the Attack Pattern is private or belongs to a Trusted Circle

True—if the Attack Pattern is public

Default: False

Name of the attack structure model.

Value: {"lockheed-martin": ["action-on-objectives", "command-and-control", "delivery", "exploitation", "installation", "reconnaissance", "weaponization"]}

List of attack structure phases.

Values: "action-on-objectives", "command-and-control", "delivery", "exploitation", "installation", "reconnaissance", "weaponization"

Malware entities associated with the Attack Pattern.

Time stamp of when Attack Pattern was last updated on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Name of the Attack Pattern.

Attack Pattern name is associated with your organization. Therefore, the name must be unique within your organization. However, two Attack Patterns with the same name can exist on ThreatStream as long as they belong to different organizations.

The name can contain up to 255 characters.

Attack Pattern entities can be in new, pending_review, review_requested, reviewed, or published statuses.

Time stamp of when Attack Pattern was published on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Whether the entity is remote (stored on Cloud).

Value returned for this attribute is true when the entity is remote.

Signatures associated with the Attack Pattern.

When creating an Attack Pattern, specify the Signature ID. See Signatures.

skip_associations

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/attackpattern/{id}/?skip_associations=true

skip_intelligence

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/attackpattern/{id}/?skip_intelligence=true

Time stamp of when the Attack Pattern was originally created by the source, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Time stamp of when the Attack Pattern was last modified by the source, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Whether the user has starred the Attack Pattern—added it to their favorites.

True—if the Attack Pattern is starred

False—if the Attack Pattern is not starred

Tags assigned to the Attack Pattern.

A tag is a meaningful name or any other string value assigned to identify the information.

For example, spear phishing,exploitation.

Threat bulletins associated with the Attack Pattern.

When creating an Attack Pattern, specify the ID of the threat bulletin.

Traffic Light Protocol designation for the Attack Pattern—red, amber, amber+strict, green, clear.

Tools associated with the Attack Pattern.

TTP (Threat Bulletins) associated with the Attack Pattern.

When creating an Attack Pattern, specify the TTP ID. See TTPs (Tactics, Techniques, and Procedures).

Vulnerabilities associated with the Attack Pattern.

When creating an Attack Pattern, specify the ID of the vulnerability.

Whether the Attack Pattern is watched by the user.

True—if the Attack Pattern is watched

False—if the Attack Pattern is not watched