tmmatch

The tmmatch lookup table is generated by the Anomali Security Analytics threat model correlation feature. The threat model correlation feature produces a summary of threat model matches found in your event logs.

Name	Value Type	Description	Example
event_time	timestamp	Time when the event was recorded on the originating device, in UNIX timestamp milliseconds.	1706309472445
ioc_match_id	string	Unique ID, having format {orgid}_{event_id}_0_{ioc_id}.	1773_79618005142_0_59324653376
timestamp	timestamp	Time when the event was received by Security Analytics, in UNIX timestamp milliseconds.	1706309472445
tm_id	number	Threat model ID in ThreatStream.	1459204
tm_match_id	string	Unique ID, having format {orgid}_{event_id}_0_{ioc_id}_{tm_id}.	1773_427842772067_3_60760916306_1459204
tm_name	string	Threat model name.	T1071 - Application Layer Protocol
tm_type	string	Threat model type.	actor, attackpattern, campaign, tb, ttp or vulnerability