investigation_elements

The Investigation Elements table contains elements that have been added to investigations, enriched with the full entity data from the underlying threat model or observable. Each row represents a single investigation element joined with its referenced entity, for example, an actor, malware, or vulnerability.

Field	Value Type	Description	Example
id	integer	Unique ID of the investigation element.	42
tlp	integer	Numeric TLP level assigned to the investigation element.	2
score	integer	Score assigned to the investigation element.	85
investigation_id	integer	ID of the investigation this element belongs to.	117
investigation_name	string	Name of the investigation this element belongs to.	Q4 Phishing Campaign Analysis
entity_id	bigint	ID of the referenced entity.	9591
entity_type	string	Data type of the referenced entity. Possible values: ip, domain, email, md5, url.	ip
entity_value	string	Value of the referenced entity.	52.233.72.222
entity_ip	string	IP address associated with the entity.	52.233.72.222
entity_rdns	string	Reverse DNS name associated with the IP of the entity.	mail.example.com
entity_owner_organization_id	bigint	ID of the organization that owns the entity.	2
entity_feed_id	bigint	Numeric ID of the threat feed that provided the entity.	145
entity_country	string	Two-letter ISO country code for the IP associated with the entity.	US
entity_latitude	double	Latitude of the geo location associated with the entity's IP.	12.975
entity_longitude	double	Longitude of the geo location associated with the entity's IP.	-80.193
entity_org	string	Organization name associated with the entity's IP.	T-Mobile USA
entity_asn	string	Autonomous System Number for the IP associated with the entity.	37963
entity_status	string	Current state of the entity. Possible values: active, inactive, falsepos, ongoing, historic, future.	active
entity_is_public	string	Whether the entity is publicly visible.	true
entity_confidence	integer	ThreatStream-assigned confidence score of the entity being malicious (0 – 100).	75
entity_tags	string	Tags associated with the entity.	apt, phishing
entity_meta	string	Additional metadata associated with the entity.
entity_import_session_id	bigint	ID of the import session that created the entity.	20145
entity_created_ts	timestamp	UTC timestamp of when the entity was created in ThreatStream.	2024-10-02T20:44:35
entity_modified_ts	timestamp	UTC timestamp of when the entity was last updated in ThreatStream.	2025-01-15T08:30:00
entity_itype	string	ThreatStream indicator type. Possible values include: c2_ip, compromised_email, apt_md5, mal_md5.	c2_ip
entity_source_reported_confidence	integer	Confidence score as reported by the original source (0 – 100).	82
entity_retina_confidence	integer	Confidence score calculated by ThreatStream's ML scoring engine. -1 indicates a score could not be calculated.	67
entity_update_id	bigint	Update identifier for the entity record.	5012
entity_expiration_ts	timestamp	Timestamp of when the entity's intelligence expires.	2025-06-01T00:00:00
entity_uuid	string	Universally unique identifier for the entity.	550e8400-e29b-41d4-a716-446655440000
entity_is_anonymous	string	Whether the entity was submitted anonymously.	false
entity_tlp	string	TLP color of the entity. Possible values: white, clear, green, amber+strict, red.	green
entity_import_source	string	Original source of the entity. Only displayed for entities manually imported by your organization.	manual_import
entity_created_by	string	Email address of the user who created the entity.	analyst@example.com
entity_subtype	string	Further categorization of the entity. Values vary by entity type (e.g., md5/sha1/sha256 for hash observables; backdoor/ransomware/trojan for malware).	ransomware
entity_source_created	timestamp	Timestamp of when the entity was created by its original source.	2024-09-15T12:00:00
entity_source_modified	timestamp	Timestamp of when the entity was last updated by its original source.	2024-12-01T09:30:00
entity_name	string	Name of the entity.	T1027.001 - Obfuscated Files or Information: Binary Padding
entity_description	string	Description text of the entity.	Remote access trojan used in targeted campaigns.
entity_avatar_s3_url	string	S3 URL of the entity's avatar image.
entity_organization_id	integer	ID of the organization that owns the entity.	2
entity_is_team	string	Whether the entity is associated with a team.	false
entity_soph_type_id	integer	Numeric ID representing the sophistication level of the entity.	3
entity_soph_desc	string	Description of the sophistication level. Possible values: Novice, Innovator, Expert, Practitioner, Aspirant.	Expert
entity_start_date	timestamp	Start date of the entity.	2024-01-01T00:00:00
entity_publication_status	string	Publication status of the entity.	published
entity_is_cloneable	string	Whether the entity can be cloned.	true
entity_parent_id	integer	ID of the parent entity, if this entity is a child/sub-entity.	9591
entity_body_content_type	string	Content type of the entity body.	richtext
entity_published_ts	timestamp	Timestamp of when the entity was published.	2024-11-01T10:00:00
entity_owner_user_id	integer	ID of the ThreatStream user that created the entity.	305
entity_assignee_user_id	integer	ID of the user assigned to the entity.	410
entity_tags_v2	string	JSON array of structured tags associated with the entity.	["T1556.009", "phishing"]
entity_embedded_content_url	string	URL of embedded content.
entity_embedded_content_type	string	Type of embedded content.
entity_threat_actor_types	string	Categorization of the entity's operational profile.	Nation-state
entity_roles	string	Roles associated with the entity.
entity_goals	string	Goals of the threat actor.
entity_resource_level	string	Resource level of the threat actor.
entity_primary_motivation	string	Primary motivation behind the entity.	financial-gain
entity_secondary_motivations	string	Additional goals of the entity.	Destruction
entity_personal_motivations	string	Personal motivations of the entity.
entity_extra_fields	string	Additional fields stored as JSON.
entity_is_mitre	string	Whether the entity is sourced from MITRE ATT&CK.	true
entity_c_description_last_version	string	Version identifier of the last description update.
entity_c_description_text	string	Full text description of the entity.
entity_aliases	string	Other names by which the entity is known.	APT29, Cozy Bear
entity_killchainstages	string	Kill chain stages associated with the entity (deprecated format).
entity_kill_chain_phases	string	Kill chain phases associated with the entity (STIX 2.1 format).
entity_status_id	integer	Numeric ID of the entity's status.	1
entity_status_desc	string	Description of the entity's status.	ongoing
entity_end_date	timestamp	End date of the entity.	2024-12-15T00:00:00
entity_first_seen	timestamp	Timestamp of when the entity was first observed.	2024-06-01T00:00:00
entity_last_seen	timestamp	Timestamp of when the entity was last observed.	2025-01-10T00:00:00
entity_malware_types	string	Types of malware. Possible values: adware, backdoor, bot, ransomware, trojan, worm, etc.	ransomware
entity_execution_platforms	string	OS or environments the malware runs on.	Windows, Linux
entity_capabilities	string	Functions and features of the malware.	Keylogging, Credential theft
entity_implementation_languages	string	Programming languages used to build the malware.	C++, Python
entity_c2_protocol	string	Protocol(s) used for C2 traffic.	HTTP, HTTPS
entity_c2_port	string	Network port(s) used for C2 communications.	8080, 443
entity_is_family	string	Whether the entry describes a malware family.	true
entity_owner_org_id	integer	ID of the organization that owns the entity.	2
entity_assignee_org_id	integer	ID of the organization assigned to the entity.	5
entity_threat_actor	string	Associated threat actor name.	APT29
entity_campaign	string	Associated campaign name.
entity_ttp	string	Associated TTP name.
entity_source	string	Source of the entity.	Anomali Labs
entity_original_source	string	Original upstream source of the entity.
entity_original_source_id	string	ID of the entity in the original source system.
entity_is_email	string	Whether the entity is email-related.	false
entity_is_category	string	Whether the entity is a category entry.	false
entity_producer	string	Producer of the entity.
entity_cvss2_score	double	CVSS 2.0 score. Range: 0 – 10.	7.5
entity_cvss3_score	double	CVSS 3.0 score. Range: 0 – 10.	9.8
entity_is_system	string	Whether the entity is a system-generated entry.	false
entity_vendors	string	Vendor(s) affected by the entity.	Microsoft, Cisco