TTPs (Tactics, Techniques, and Procedures)

To create, update or retrieve TTPs from the ThreatStream platform.

Request

/api/v1/ttp/

HTTP Methods: GET, POST, PATCH

Create a new TTP	POST /api/v1/ttp/
Update the specified TTP	PATCH /api/v1/ttp/{id}/
Get details of the specified TTP	GET /api/v1/ttp/{id}/
Get a list of TTPs	Anomali recommends to use the /api/v1/threat_model_search endpoint to retrieve a list of TTPs. See Threat Model Search for details. For example, GET /api/v1/threat_model_search/?model_type=ttp
Get a list of TTPs associated with the specified observable value or observable ID	GET /api/v1/ttp/associated_with_intelligence/?value={value} GET /api/v1/ttp/associated_with_intelligence/?ids={comma_separated_id_list} For example, GET /api/v1/ttp/associated_with_intelligence/?value=google.com returns all TTPs associated with google.com.
Get a list of the specified entity type (such as Malware, Actor, Campaign, and so on) associated with the specified TTP	GET /api/v1/ttp/{id}/<entity_type>/ For example, GET /api/v1/ttp/234673/actor/ returns all actors associated with the specified TTP.
Get a list of observables associated with the specified TTP	GET /api/v1/ttp/{id}/intelligence/

Response

Format: JSON

Attributes: See the table below

Attributes

Attribute	Type	Description
actors	related (see item 1 in the Notes above)	Actor names associated with the TTP. When creating a TTP, specify the Actor ID. See Actors .
circles	related (see item 1 in the Notes above)	All Trusted Circles to which the TTP belongs.
created_ts	datetime	Time stamp of when the TTP was created on ThreatStream, in UTC format. Date is in this format: YYYYMMDDThhmmss where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. Note: This attribute is returned in the response to a GET call and is set by ThreatStream; it cannot be configured.
description	string	The free-form text associated with the TTP (as specified in the Description field in the UI).
intelligence	related (see item 1 in the Notes above)	Observables associated with the TTP on the ThreatStream platform. When creating a TTP, specify the indicator ID. See Intelligence.
is_public	boolean	Whether the TTP is public or private (including belonging to a trusted circle). False—if the TTP is private or belongs to a Trusted Circle True—if the TTP is public Default: False
limit	numeric	The limit variable controls the number of results returned every time an API call is made; the total number of results may be much larger than returned in one API call. If limit is not specified, 20 results are returned with each API call. Specifying limit=0 will return up to a maximum of 1000 results (if available).
modified_ts	datetime	Time stamp of when the TTP was last updated on ThreatStream, in UTC format. Date is in this format: YYYYMMDDThhmmss where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. Note: This attribute is returned in the response to a GET call and is set by ThreatStream; it cannot be configured.
name	string	Name of the TTP. TTP name is associated with your organization. Therefore, the name must be unique within your organization. However, two TTPs with the same name can exist on ThreatStream as long as they belong to different organizations. The name can contain up to 255 characters. Note: This is a required parameter.
publication_status	string	A TTP can be in new, pending_review, review_requested, reviewed, published statuses. Note: A TTP must be in published status for it to be visible to other users outside your organization.
remote_api (for ThreatStream OnPrem only)	boolean	Whether the entity is remote (stored on Cloud). Value returned for this attribute is true when the entity is remote.
signatures	related (see item 1 in the Notes above)	Signatures associated with the TTP. When creating a TTP, specify the Signature ID. See Signatures.
skip_associations (On ThreatStream OnPrem only)	boolean	By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_associations parameter to true. This parameter is only applicable to ThreatStream OnPrem. For example, GET /api/v1/ttp/{id}/?skip_associations=true
skip_intelligence (On ThreatStream OnPrem only)	boolean	By default, up to 1000 threat model and observable associations are returned with GET requests for details of a threat model entity on ThreatStream OnPrem. When a threat model entity has a large number of associations, association retrieval can take a long time and impact performance. Therefore, Anomali recommends setting the skip_intelligence parameter to true. This parameter is only applicable to ThreatStream OnPrem. For example, GET /api/v1/ttp/{id}/?skip_intelligence=true
source_created	datetime	Time stamp of when the TTP was created by its original source.
source_modified	datetime	Time stamp of when the TTP was last updated by its original source.
tags	list	Tags assigned to the TTP. A tag is a meaningful name or any other string value assigned to identify the information. For example, spear phishing,exploitation.
tlp	string	Traffic Light Protocol designation for the TTP—red, amber, amber+strict, green, clear. Note: The value is case-sensitive and must be specified in lower case.

Examples

1. To create a private TTP associated with the observable whose ID is 165546 and Signature whose ID is 10:

   Copy

   curl --request POST --data '{"name": "dummy test ttp", "tlp": "red", "tags": ["big ttp", "dummy tag"], "intelligence": [165546], "signatures": [10], "publication_status": "published"}'  'https://api.threatstream.com/api/v1/ttp/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json'

2. To update an existing TTP whose ID is 1774:

   Copy

   curl --request PATCH --data '{"name": "another dummy test ttp", "tlp": "orange"}' 'https://api.threatstream.com/api/v1/ttp/1774/' -H 'Authorization: apikey <username>:<api_key>' -H 'Content-Type:application/json'

3. To get details of the existing TTP whose ID is 1774:

   Copy

   curl 'https://api.threatstream.com/api/v1/ttp/1774/?skip_associations=true&skip_intelligence=true' -H 'Authorization: apikey <username>:<api_key>'

4. To get the first 10 TTPs from ThreatStream:

   Copy

   curl 'https://api.threatstream.com/api/v1/ttp/?limit=10&skip_associations=true&skip_intelligence=true' -H 'Authorization: apikey <username>:<api_key>'

5. (Only on ThreatStream OnPrem) To get details of the remote TTP whose ID is 1775:

   Copy

   curl 'https://<ThreatStream_OnPrem_IP_or_FQDN>/api/v1/ttp/1775/?remote_api=true' -H 'Authorization: apikey <username>:<api_key>'

6. (Only on ThreatStream OnPrem) To skip associations when retrieving details of the local TTP with ID 234678:

   Copy

   curl 'https://<ThreatStream_OnPrem_IP_or_FQDN>/api/v1/ttp/234678/?skip_associations=true' -H 'Authorization: apikey <username>:<api_key>'