iocmatch_ocsf

The iocmatch_ocsf lookup table is generated by the Anomali Security Analytics IOC correlation engine and stores correlated event data in the OCSF schema format. The IOC correlation engine correlates your event logs with your ThreatStream IOCs.

See OCSF Schema Overview for more information.

Field	Value Type	Description	Example
_date	string	Partition key, format YYYY-MM-DD.	2024-01-18
action	string	Caption of action_id.	Allowed, Blocked
action_id	number	Normalized action taken by a control or policy.	1
activity_id	number	Normalized activity that triggered the event.	6
activity_name	string	Caption of activity_id.	Allowed
actor	object	Actor that performed the activity.	{"user": {"name": "admin"}}
actor_ids	list	Associated actor IDs in ThreatStream.	[2342, 2313]
age	number	Event time minus intel first seen.	49
answers	list	DNS answers.	[{"hostname": "93.184.216.34", "type": "A"}]
api	object	API-call details.	{"operation": "GetObject", "service": {"name": "s3"}}
asn	string	Autonomous System Number.	15802
attackpattern_ids	list	Associated attack pattern IDs in ThreatStream.	[2342, 2313]
campaign_ids	list	Associated campaign IDs in ThreatStream.	[2342, 2313]
category_name	string	Caption of category_uid.	Network Activity
category_uid	number	OCSF category identifier.	4
class_name	string	Caption of class_uid.	Network Activity
class_uid	number	OCSF class identifier that describes the attribute shape of the event.	4001
classification	string	Classification of an intel.	private
cloud	object	Cloud environment where the event originated.	{"provider": "AWS", "region": "us-east-1"}
confidence	number	Confidence score assigned to the indicator.	75
connection_info	object	Network connection protocol, direction, and related details.	{"direction": "incoming", "direction_id": 1, "protocol_num": 6, "session": {"uid": "82791871"}}
count	number	Number of logically-grouped events in the aggregate.	23
country	string	Country associated with the indicator.	US
created_ts	number	First seen on ThreatStream, in UNIX timestamp milliseconds.	1774382999000
device	object	Addressable device or host.	{"hostname": "workstation01", "ip": "192.168.1.10"}
disposition	string	Caption of disposition_id.	Blocked
disposition_id	number	Outcome taken by a security control.	2
dst_endpoint	object	Destination network endpoint.	{"interface_name": "wan2", "ip": "1.2.3.4", "port": 52058}
duration	number	end_time minus start_time in milliseconds.	125
email	object	Email object.	{"from": "sender@example.com", "subject": "Invoice"}
end_time	number	End of an aggregated event window, in UNIX timestamp milliseconds.	1705557026030
enrichments	list	External-source enrichments attached to the event.	[{"name": "GeoIP", "value": "US"}]
event_seq_id	number	Event sequence identifier.	79618005142
event_size	number	Event size in bytes.	1821
event_time	number	Normalized event occurrence time, in UNIX timestamp milliseconds.	1778696793119
feed_id	number	Source feed ID in ThreatStream.	0
feed_name	string	Source of the indicator.	johndoe@acme.com
file	object	Target file object.	{"name": "malware.exe", "path": "C:\\Windows\\Temp"}
http_request	object	HTTP request details.	{"method": "GET", "url": "https://example.com"}
id	number	ID of an indicator.	41008949
import_session_id	number	Import session ID.	93821
indexed_time	number	When the event was indexed, in UNIX timestamp milliseconds.	1778696793119
indicator	string	Value of an indicator.	50.207.148.140
intel_severity	string	Severity assigned to the indicator.	low, medium, high, very-high
ioc_match_id	string	Unique match ID, format {orgid}_{event_id}_0_{ioc_id}.	1773_79618005142_0_59324653376
ioc_status	string	Status assigned to the indicator.	active, inactive, falsepos
ioc_type	string	Indicator value type.	ip, domain, url, email, md5
itype	string	Indicator type.	mal_ip
latitude	double	Latitude of the IP address.	29.397
longitude	double	Longitude of the IP address.	-94.92
message	string	Event description from the source.	Malicious IP matched IOC indicator
metadata	object	Event metadata including product, log source, correlation uid, and data classification.	{"correlation_uid": null, "data_classification": {...}, "product": {"name": "Fortigate Firewall", "vendor_name": "Fortinet"}, "version": "1.1.0"}
modified_ts	number	Last updated on ThreatStream, in UNIX timestamp milliseconds.	1774384127000
observables	list	Observables tied to the event.	[{"name": "evil.com", "type": "Hostname"}]
org	string	Registered owner (org) of the IP.	Comcast Business
original_event_time	number	Original timestamp from the source system, in UNIX timestamp milliseconds.	1778696340000
originator	number	Network directionality.	0 (inbound), 1 (outbound)
query	object	DNS query details.	{"hostname": "example.com", "type": "A"}
raw_data	string	Raw event data from the source.	date=2021-11-30 time=22:22:24 devname="nap9-alex00va-100d-1" type="utm" subtype="ips" level="alert" srcip=50.207.148.140 dstip=221.223.35.118 action="dropped" proto=6 attack="TCP.Bad.Flags"
raw_data_size	number	Size of the original raw data in bytes.	760
resource_uri	string	URI for the indicator.	/api/v1/intelligence/41008949
session	object	Authenticated session details.	{"uid": "abc123"}
severity	string	Caption of severity_id.	Low, Medium, High, Critical
severity_id	number	Normalized severity (lower = less severe).	3
src_endpoint	object	Source network endpoint.	{"ip": "192.168.1.10", "port": 443}
start_time	number	Start of an aggregated event window, in UNIX timestamp milliseconds.	1705557025030
status	string	Caption of status_id.	Success, Failure
status_code	string	Source-reported status code.	200, 404
status_detail	string	Additional outcome details.	Connection established
status_id	number	Normalized status identifier.	1
tags	list	Additional comments and context.	["popularity=low", "malware"]
timezone_offset	number	Source timezone offset in minutes.	-480
tipreport_ids	list	Associated threat bulletin IDs in ThreatStream.	[2342, 2313]
trusted_circle_ids	list	Trusted-circle IDs assigned to the indicator.	[1, 45]
trusted_circle_names	list	Trusted-circle names.	["circle1", "circle45"]
ttp_ids	list	Associated TTP IDs in ThreatStream.	[5473, 34724]
type_name	string	Caption of type_uid.	Detection Finding: Allowed
type_uid	number	Computed as class_uid × 100 + activity_id.	400101
unmapped	string	Source-specific attributes not mapped to OCSF.	{"custom_field": "custom_value"}
user	struct	User being discovered or targeted.	{"name": "john.doe", "email": "john.doe@example.com"}
volume	number	Allocated event volume in bytes.	2048
vulnerability_ids	list	Associated vulnerability IDs in ThreatStream.	[5473, 34724]