Campaigns

Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Campaigns. See Threat Model Search for details.

For example,

GET /api/v1/threat_model_search/?model_type=campaign

GET /api/v1/campaign/associated_with_intelligence/?value={value}

GET /api/v1/campaign/associated_with_intelligence/?ids={comma_separated_id_list}

For example,

GET /api/v1/campaign/associated_with_intelligence/?value=google.com returns all Campaigns associated with google.com.

GET /api/v1/campaign/{id}/<entity_type>/

For example,

GET /api/v1/campaign/234673/malware/ returns all malware objects associated with the specified campaign.

Actor names associated with the Campaign.

When creating a Campaign, specify the Actor ID. See Actors .

datetime

Time stamp of when the Campaign was created on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

The free-form text associated with the Campaign (as specified in the Description field in the UI).

Specify the time when this Campaign is known to have ended.

Date must be specified in this format: YYYYMMDDThhmmss and in UTC format.

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Incidents associated with the Campaign.

When creating a Campaign, specify the Incident ID. See Incidents.

Observables associated with the Campaign on the ThreatStream platform.

When creating a Campaign, specify the observable ID. See Intelligence.

Whether the Campaign is public or private (including belonging to a trusted circle).

False—if the Campaign is private or belongs to a Trusted Circle

True—if the Campaign is public

Default: False

The limit variable controls the number of results returned every time an API call is made; the total number of results may be much larger than returned in one API call.

If limit is not specified, 20 results are returned with each API call. Specifying limit=0 will return up to a maximum of 1000 results (if available).

Time stamp of when the Campaign was last updated on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Name of the Campaign.

Campaign name is associated with your organization. Therefore, the name must be unique within your organization. However, two Campaigns with the same name can exist on ThreatStream as long as they belong to different organizations.

The name can contain up to 255 characters.

A Campaign can be in new, pending_review, review_requested, reviewed, published statuses.

Whether the entity is remote (stored on Cloud).

Value returned for this attribute is true when the entity is remote.

Signatures associated with the Campaign.

When creating a Campaign, specify the Signature ID. See Signatures.

skip_associations

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/campaign/{id}/?skip_associations=true

skip_intelligence

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/campaign/{id}/?skip_intelligence=true

Specify the time when this Campaign was first known to be active.

Date must be specified in this format: YYYYMMDDThhmmss and in UTC format.

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Status of the Campaign.

When creating a Campaign, specify the Status ID. Use /api/v1/campaignstatus/ to obtain a list of Campaign statuses.

Tags assigned to the Campaign.

A tag is a meaningful name or any other string value assigned to identify the information.

For example, spear phishing,exploitation.

Traffic Light Protocol designation for the Campaign—red, amber, amber+strict, green, clear.

TTP (Threat Bulletins) associated with the Campaign.

When creating a Campaign, specify the TTP ID. See TTPs (Tactics, Techniques, and Procedures).

Victim type associated with the Campaign.

When creating a Campaign, specify the ID of the victim type. To obtain a list of victim types, make an API call to /api/v1/victimtype/.