| active |
boolean |
Whether ThreatStream is currently receiving data from the feed. |
| allow_unresolved_domain |
N/A |
This attribute is for internal use and can be ignored.
|
| allow_update |
N/A |
This attribute is for internal use and can be ignored. |
| child_page_url_template |
N/A |
This attribute is for internal use and can be ignored. |
| circles |
list |
Trusted circles with which data from streams is shared. |
| classification |
string |
Classification of the data from the feed—public or private. By default, for feeds, data classification is private.
|
| confidence |
numeric |
Confidence score that reflects the likelihood that an observable exhibits or is connected to malicious behavior. This score is derived from a combination of factors, including source-reported confidence, source confidence weight (in percentage), and the score generated by ThreatStream's machine learning-based engine.
Confidence scores range from 0-100, in increasing order of confidence.
|
| config |
array |
Configuration settings for the feed.
|
| created_ts |
datetime |
Time stamp of when the feed was created, in UTC format.
|
| description |
string |
Short description of the feed. |
| disable_notifications |
N/A |
This attribute is for internal use and can be ignored. |
| engine |
N/A |
This attribute is for internal use and can be ignored. |
| expiry_date |
N/A |
This attribute is for internal use and can be ignored. |
| expiry_source |
N/A |
This attribute is for internal use and can be ignored. |
| expiry_time_in_days |
integer |
Length of time after import that observables remain active. |
| feed_category |
N/A |
This attribute is for internal use and can be ignored.
|
| feed_type |
N/A |
This attribute is for internal use and can be ignored.
|
| feedgroups |
N/A |
This attribute is for internal use and can be ignored. |
| fields |
string |
List of fields that come through the feed. |
| fields_mapping |
string |
List of fields that is saved to the database. |
| hidden |
N/A |
This attribute is for internal use and can be ignored. |
| id |
integer |
Unique ID for the feed. |
| id_regex |
N/A |
This attribute is for internal use and can be ignored. |
| imap_host |
N/A |
This attribute is for internal use and can be ignored. |
| imap_port |
N/A |
This attribute is for internal use and can be ignored. |
| imap_subject_regexp |
N/A |
This attribute is for internal use and can be ignored. |
| interval |
string |
Interval at which ThreatStream scrapes the feed for new data. |
| is_autoprov |
N/A |
This attribute is for internal use and can be ignored. |
| is_cloneable |
N/A |
This attribute is for internal use and can be ignored. |
| is_owner |
N/A |
This attribute is for internal use and can be ignored. |
| itype |
string |
Default indicator type assigned to observables imported from the feed. |
| last_imported |
datetime |
Timestamp of when new data was actually imported to ThreatStream. |
| last_scraped |
datetime |
Timestamp of when ThreatStream last scraped the feed for new data. |
| last_updated |
datetime |
Timestamp of when feed settings were last changed. |
| name |
string |
Name of the feed. |
| notes |
N/A |
This attribute is for internal use and can be ignored.
|
| organization |
array |
Organization which owns the feed. Contains id, name, and resource_uri attributes. |
| reference_url |
N/A |
This attribute is for internal use and can be ignored. |
| resource_uri |
string |
Internal URL for the feed within ThreatStream. |
| severity |
N/A |
This attribute is for internal use and can be ignored. |
| should_reactivate_intel |
N/A |
This attribute is for internal use and can be ignored. |
| sleep_time |
N/A |
This attribute is for internal use and can be ignored. |
| source_confidence_weight |
numeric |
Ratio between the amount of the source-reported confidence and the confidence score of ThreatStream's machine-learning scoring engine.
For example, if this setting = 30%, when calculating the final confidence, 30% weight is given to the source-reported confidence value specified by the source of the observable and 70% weight is given to the confidence value deemed by ThreatStream.
|
| state |
string |
Current state (health) of the feed. Possible values: success, no results, errors, no run. |
| tags |
list |
Additional comments and context associated with the observable when it was imported from its original threat feed. |
| url |
string |
URL where the feed is hosted. |
| use_proxy |
N/A |
This attribute is for internal use and can be ignored. |