threat_models

AQL Search supports the out-of-the box threat_models lookup table that contains ThreatStream threat model data from the last 90 days.

To search for these threat models, enter the following lookup table name into the AQL Search box: threat_models.

You can also access the threat_models table on the Lookup Tables page. See Using Lookup Tables for more information.

Threat model data is refreshed once daily.

Field Value Type Description Example
alias string Other names by which the entity is known (Actors, Attack Patterns, Campaigns, Infrastructure, Intrusion Sets, Malware, Tools, TTPs, Vulnerabilities only). user -> UserName
assignee_user_id double ID of the user assigned to the threat model. 393
c2_port array of strings Network port(s) used for C2 communications. Applicable to Malware only. [8080, 443]
c2_protocol array of strings Protocol(s) used for C2 traffic. Applicable to Malware only. [HTTP, HTTPS, DNS]
capabilities array of strings The functions and features of the malware. [Keylogging, Credential theft, File exfiltration]
created_ts bigint

Time stamp of when the entity was created on ThreatStream, in UTC format.

Date can be specified as follows:

  • In this format: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. T must be capitalized.

  • As a relative time unit, in this format: -<n><unit>, where n is a whole number and unit is w, d, h, m, s (for week, days, hour, minutes, and seconds, respectively). For example, -2w denotes two weeks, starting NOW. Units must be lowercase.

 2014-10-02T20:44:35
epss_percentile double

EPSS percentile.

When EPSS data is unavailable the field value is null.

The field works with sort and where clauses and supports the following operators: >, <, >=, and <=.

For example: 

threat_models
  | where tm_type == "vulnerability"
  | sort epss_percentile desc

  • 0.894

  • 1

  • null
epss_score double

EPSS score.

When EPSS data is unavailable the field value is null.

The field works with sort and where clauses and supports the following operators: >, <, >=, and <=.

For example: 

threat_models
 | where tm_type == "vulnerability" and epss_score > 0.5

  • 0.944

  • null

  • 0.754
cvss2_score double CVSS 2.0 Score (Vulnerability entities only). Scores range from 0-10.

  • 5

  • null
cvss3_score double CVSS 3.0 Score (Vulnerability entities only). Scores range from 0-10.

  • 9.8
end_date bigint When the campaign stopped (if applicable). 2024-12-15
event_time bigint UTC time stamp of when the observable was first created in ThreatStream. Jun 20, 2025 11:53:15.000 -07
execution_platforms array of strings OS or environments the malware runs on. Windows, Linux, macOS, Android
feed_id bigint Numeric ID of the threat feed that provided the Threat Model entity. 2017-01-26T00:00:00.
feed_name string Name of the feed from which the entity originates. MITRE ATT&CK PATTERN
first_seen bigint    
id bigint ID of the attack pattern entity. This ID is automatically assigned to the entity by ThreatStream at the time of creation. You can use this ID to associate the attack pattern entity with other Threat Model entities. 17
is_family boolean Indicates if this entry describes a malware family. true, false
is_mitre boolean Determines whethere the entries are directly sourced from MITRE ATT&CK true, false
locations array of strings Specific nation or geographical region to which data, materials, or information is being directed or delivered. us
modified_ts bigint

UTC time stamp of when the observable was last updated in ThreatStream.

Date can be specified as follows:

  • In this format: YYYY-MM-DDThh:mm:ss, where T denotes the start of the value for time. For example, 2014-10-02T20:44:35. T must be capitalized.

  • As a relative time unit, in this format: -<n><unit>, where n is a whole number and unit is w, d, h, m, s (for week, days, hour, minutes, and seconds, respectively). For example, -2w denotes two weeks, starting NOW. Units must be lowercase.

 Jun 20, 2025 11:53:15.000 -07
mitre_data_sources array of strings Types of telemetry or logs that can be used to detect the technique. [Malware reverse engineering, Process monitoring]
mitre_defense_bypassed array of strings Identifies the defensive controls that the technique is known to circumvent. [Signature-based detection]
mitre_detection string Ways in which an org detects the use of a technique. This usually contains hints on the relevant behaviors, artifacts, or anomalies. Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool. When executed, the resulting process from padded files may also exhibit other behavior characteristics of being used to conduct an intrusion such as system and network information Discovery or Lateral Movement, which could be used as event indicators that point to the source file.
mitre_name string Name of the ATT&CK technique or sub-technique, including its ID. T1027.001 - Obfuscated Files or Information: Binary Padding
mitre_id string The MITRE ATT&CK technique or sub-technique identifier. T1027.001
mitre_parent_name string If the entry is a sub-technique, this field stores the parent technique’s name. T1027 - Obfuscated Files or Information
mitre_parent_id string The MITRE ATT&CK ID of the parent technique for a sub-technique. T1027
mitre_parent_attackpattern integer An internal or database-specific numeric ID representing the parent technique in the dataset. 9591
mitre_tactic array of strings Signifies the higher-level adversary objective. defense-evasion
mitre_type string Type of the MITRE ATT&CK. enterprise-attack
name string Name of the entity. T1027.001 - Obfuscated Files or Information: Binary Padding
owner_user_id bigint ID of the ThreatStream user that created the entity. T-Mobile USA
organization_id bigint ID of the organization that owns the entity. 2
primary_motivation string Primary reason, motivation, or purpose behind the Actor. The motivation is why the Actor wishes to achieve the goal. This field is relevant only to Actors and Intrusion Sets.  
product_name string Identifies which product(s) from the listed vendors are impacted. Exchange Server 2016
publication_status string Current stage in the publishing workflow.

  • new

  • review_requested

  • reviewed

  • published
secondary_motivation array of strings The additional, secondary goals of a threat actor. This field is relevant only to Actors and Intrusion Sets. Destruction
sophistication string Assessment of skill, resources, and operational maturity. This field is relevant only to Actors. No Type (Default), Novice, Innovator, Expert, Practitioner, Aspirant.
source_locations array of strings

Source locations associated with the Threat Model entity.

Possible values include letter codes of regions, countries, and administrative areas (US States and Washington DC only) as defined by STIX 2.1.

Here are some examples:

  • easternafrica

  • central-asia

  • europe

  • africa

  • NL

  • GB

  • US-FL

  • US-MO

start_date bigint

Time when a campaign was known to have started.

Date (in UTC) must be specified in this format: YYYYMMDDThhmmss, where T denotes the start of the value for time.

  
status string Current state of the observable in ThreatStream.

  • ongoing

  • historic

  • future
subtype array of strings

Provides further categorization of threat model information, as per the following threat model types:

  • Actor

  • Infrastructure

  • Malware

  • Signature

  • Tool

  • Actor

    activist, competitor, crime-syndicate, criminal, hacker, insider-accidental, insider-disgruntled, nation-state, sensationalist, spy, terrorist, unknown

  • Infrastructure

    amplification, anonymization, botnet, command-and-control, exfiltration, hosting-malware, hosting-target-lists, phishing, reconnaissance, staging, undefined

  • Malware

    adware, backdoor, bot, bootkit, ddos, downloader, dropper, exploit-kit, keylogger, ransomware, remote-access-trojan, resource-exploitation, rogue-security-software, rootkit, screen-capture, spyware, trojan, unknown, virus, webshell, wiper, worm

  • Signature

    Snort, YARA, CybOX, OpenIOC, ClamAV, Suricata, Bro, Carbon Black Query, Custom, Splunk Query, RSA NetWitness, Sigma

  • Tool

    denial-of-service, exploitation, information-gathering, network-capture, credential-exploitation, remote-access, vulnerability-scanning, unknown
tags array of strings Additional comments and context associated with the observable when it was imported from its original threat feed. [T1556.009, attack-pattern--ceaeb6d8-95ee-4da2-9d42-dc6aa6ca43ae]
target_industry array of strings Target industries associated with the Threat Model entity. Possible values are defined by the STIX 2.1 Industry Sector vocabulary

  • chemical

  • financial-services

  • government-regional
tcid integer Unique reference of a MITRE ATT&CK technique, sub-technique, or related object. 145
threat_actor_types array of strings Categorizes the type of Actor based on operational profile. Nation-state
tlp string

TLP color associated with the Threat Model Entity.

The TLP color provides a mechanism to communicate to consumers of the information whether further dissemination of this information is allowed; if yes, how freely can this information be distributed.

  • white

  • clear

  • green

  • red

  • amber+strict
tm_type string Type of the threat model.

tipreport

vulnerability
trusted_circle_ids array of integers ID of the trusted circle with which the observable is shared. These IDs can be used for querying entities associated with specified trusted circles. [145]
trusted_circle_names array of integers Names of trusted circles. [Anomali Threat Research Premium]
vendors string Vendor(s) affected by the Vulnerability. [Microsoft, Cisco]