Signatures

To create, update or retrieve Signatures from the ThreatStream platform.

Request

/api/v1/signature/

HTTP Methods: GET, POST, PATCH

Create a new Signature	POST /api/v1/signature/
Update the specified Signature	PATCH /api/v1/signature/{id}/
Get details of the specified Signature	GET /api/v1/signature/{id}/
Get a list of Signatures	Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of Signatures. See Threat Model Search for details. For example, GET /api/v1/threat_model_search/?model_type=signature
Get a list of signatures associated with the specified observable value or observable ID	GET /api/v1/signature/associated_with_intelligence/?value={value} GET /api/v1/signature/associated_with_intelligence/?ids={comma_separated_id_list} For example, GET /api/v1/signature/associated_with_intelligence/?value=google.com returns all Signatures associated with google.com.
Get a list of the specified entity type (such as Malware, Actor, Campaign, and so on) associated with the specified Signature	GET /api/v1/signature/{id}/<entity_type>/ For example, GET /api/v1/signature/234673/actor/ returns all actors associated with the specified Signature.
Get a list of observables associated with the specified Signature	GET /api/v1/signature/{id}/intelligence/

Response

Format: JSON

Attributes: See the table below

Attributes

Attribute	Type	Description
circles	related (see item 1 in the Notes above)	All Trusted Circles to which the Signature belongs.
created_ts	datetime	Time stamp of when the signature was created on ThreatStream, in UTC format. Date is in this format: YYYYMMDDThhmmss where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. Note: This attribute is returned in the response to a GET call and is set by ThreatStream; it cannot be configured.
is_public	boolean	Whether the Signature is public or private (including belonging to a trusted circle). False—if the Signature is private or belongs to a Trusted Circle True—if the Signature is public Default: False
limit	numeric	The limit variable controls the number of results returned every time an API call is made; the total number of results may be much larger than returned in one API call. If limit is not specified, 20 results are returned with each API call. Specifying limit=0 will return up to a maximum of 1000 results (if available).
modified_ts	datetime	Time stamp of when the Signature was last updated on ThreatStream, in UTC format. Date is in this format: YYYYMMDDThhmmss where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. Note: This attribute is returned in the response to a GET call and is set by ThreatStream; it cannot be configured.
name	string	Name of the Signature. Signature name is associated with your organization. Therefore, the name must be unique within your organization. However, two Signatures with the same name can exist on ThreatStream as long as they belong to different organizations. The name can contain up to 255 characters. Note: This is a required parameter.
notes	string	Free-form text description and any other significant information about the signature.
publication_status	string	A signature can be in new, pending_review, review_requested, reviewed, published statuses. Note: A signature must be in published status for it to be visible to other users outside your organization.
remote_api (for ThreatStream OnPrem only)	boolean	Whether the entity is remote (stored on Cloud). Value returned for this attribute is true when the entity is remote.
s_type	string	Signature type such as Snort, YARA, OpenIOC, Suricata. When creating a Signature, specify the ID of the signature type. To obtain a list of Signature type IDs, make an API call to /api/v1/signature_type/. Note: This is a required parameter.
skip_associations (On ThreatStream OnPrem only)	boolean	By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem. For example, GET /api/v1/signature/{id}/?skip_associations=true
skip_intelligence (On ThreatStream OnPrem only)	boolean	By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem. For example, GET /api/v1/signature/{id}/?skip_intelligence=true
source_created	datetime	Time stamp of when the Signature was created by its original source.
source_modified	datetime	Time stamp of when the Signature was last updated by its original source.
tags	list	Tags assigned to the Signature. A tag is a meaningful name or any other string value assigned to identify the information. For example, spear phishing,exploitation.
tlp	string	Traffic Light Protocol designation for the Signature—red, amber, amber+strict, green, clear. Note: The value is case-sensitive and must be specified in lower case.

Examples

1. To create a private Signature whose s_type ID is 3 (for CybOX):

   Copy

   curl --request POST --data '{"name": "dummy test signature", "tlp": "red", "s_type": 3, "tags": ["big signature", "dummy tag"], "intelligence": [165546], "publication_status": "published", "notes": "the definition of this CybOX signature"}'  'https://api.threatstream.com/api/v1/signature/' -H 'Content-Type:application/json' -H 'Authorization: apikey <username>:<api_key>'

2. To update the existing Signature whose ID is 10:

   Copy

   curl --request PATCH --data '{"name": "another dummy test signature", "tlp": "orange"}' 'https://api.threatstream.com/api/v1/signature/10/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json'

3. To get the details of an existing Signature whose ID is 10:

   Copy

   curl 'https://api.threatstream.com/api/v1/signature/10/' -H 'Authorization: apikey <username>:<api_key>'

4. To get the first 10 Signatures from ThreatStream:

   Copy

   curl 'https://api.threatstream.com/api/v1/signature/?limit=10' -H 'Authorization: apikey <username>:<api_key>'

5. (Only on ThreatStream OnPrem) To get the details of the remote Signature whose ID is 11:

   Copy

   curl 'https://<ThreatStream_OnPrem_IP_or_FQDN>/api/v1/signature/11/?remote_api=true' -H 'Authorization: apikey <username>:<api_key>'

6. (Only on ThreatStream OnPrem) To skip associations when retrieving details of the local Signature with ID 234678:

   Copy

   curl 'https://<ThreatStream_OnPrem_IP_or_FQDN>/api/v1/signature/234678/?skip_associations=true' -H 'Authorization: apikey <username>:<api_key>'