Managing Threat Model Associations

ThreatStream enables you to create bidirectional associations between Threat Model entities, which are displayed in the Associations tab on Threat Model entity details pages.

You can use the information in this section to add and remove Threat Model entity associations through the API.

Bulk Add

To create associations between Threat Model entities on the ThreatStream platform.

Request

/api/v1/<entity_type>/<entity_id>/<associated_entity_type>/bulk_add/

where <entity_type> is the type of threat model entity on which you are adding the association (actor, attackpattern, campaign, courseofaction, identity, infrastructure, intrusionset, incident, malware, signature, tipreport (Threat Bulletin), tool, ttp, vulnerability)

<entity_id> is the ID of the threat model entity on which you are adding the association

<associated_entity_type> is the type of threat model entity with which you are associating the initial entity (actor, attackpattern, campaign, courseofaction, identity, infrastructure, intrusionset, incident, malware, signature, tipreport (Threat Bulletin), tool, ttp, vulnerability)

HTTP Method: POST

Attribute

Attribute	Description
ids	Unique IDs of the threat model entities or observables with which you are associating the initial entity.

Example

To associate the Threat Bulletin whose ID is 744 with observables whose IDs are 54 and 67:

Copy

curl --request POST --data '{"ids":[54,67]}' 'https://api.threatstream.com/api/v1/tipreport/744/intelligence/bulk_add/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json' -v

Bulk Remove

To remove associations between threat model entities on the ThreatStream platform.