Incidents

Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Incidents. See Threat Model Search for details.

For example,

GET /api/v1/threat_model_search/?model_type=incident

GET /api/v1/incident/associated_with_intelligence/?value={value}

GET /api/v1/incident/associated_with_intelligence/?ids={comma_separated_id_list}

For example,

GET /api/v1/incident/associated_with_intelligence/?value=google.com returns all Incidents associated with google.com.

GET /api/v1/incident/{id}/<entity_type>/

For example,

GET /api/v1/incident/234673/malware/ returns all malware objects associated with the specified Incident.

Actor names associated with the Incident.

When creating an Incident, specify the Actor ID. See Actors .

datetime

Time stamp of when the Incident was created on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

The free-form text associated with the Incident (as specified in the Description field in the UI).

Specify the time when this Incident is known to have ended.

Date must be specified in this format: YYYYMMDDThhmmss and in UTC format.

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Indicators associated with the Incident on the ThreatStream platform.

When creating an Incident, specify the observable ID. See Intelligence.

Whether the Incident is public or private (including belonging to a trusted circle).

False—if the Incident is private or belongs to a Trusted Circle

True—if the Incident is public

Default: False

The limit variable controls the number of results returned every time an API call is made; the total number of results may be much larger than returned in one API call.

If limit is not specified, 20 results are returned with each API call. Specifying limit=0 will return up to a maximum of 1000 results (if available).

Time stamp of when the Incident was last updated on ThreatStream, in UTC format.

Date is in this format: YYYYMMDDThhmmss

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Name of the Incident.

Incident name is associated with your organization. Therefore, the name must be unique within your organization. However, two Incidents with the same name can exist on ThreatStream as long as they belong to different organizations.

The name can contain up to 255 characters.

Whether the entity is remote (stored on Cloud).

Value returned for this attribute is true when the entity is remote.

Sandbox reports associated with the Incident.

When creating an Incident, specify the Sandbox report ID. See Sandbox.

Signatures associated with the Incident.

When creating an Incident, specify the Signature ID. See Signatures.

skip_associations

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/incident/{id}/?skip_associations=true

skip_intelligence

(On ThreatStream OnPrem only)

By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem.

For example,

GET /api/v1/incident/{id}/?skip_intelligence=true

Specify the time when this Incident was first known to be active.

Date must be specified in this format: YYYYMMDDThhmmss and in UTC format.

where T denotes the start of the value for time.

For example, 2014-10-02T20:44:35.

Status of the Incident.

When creating an Incident, specify the Status ID. Use /api/v1/incidentstatustype/ to obtain a list of Incident statuses.

Tags assigned to the Incident.

A tag is a meaningful name or any other string value assigned to identify the information.

For example, spear phishing,exploitation.

Traffic Light Protocol designation for the Incident—red, amber, amber+strict, green, clear.

TTP (Threat Bulletins) associated with the Incident.

When creating an Incident, specify the TTP ID. See TTPs (Tactics, Techniques, and Procedures).

Victim type associated with the Incident.

When creating an Incident, specify the ID of the victim type. To obtain a list of victim types, make an API call to /api/v1/victimtype/.