tmmatch_ocsf

The tmmatch_ocsf lookup table is generated by the Anomali Security Analytics threat model correlation feature and stores threat model match data in the OCSF schema format. The threat model correlation feature produces a summary of threat model matches found in your event logs.

See OCSF Schema Overview for more information.

Field	Value Type	Description	Example
_date	string	Partition key, format YYYY-MM-DD.	2024-01-18
event_time	number	Event time on the originating device, in UNIX timestamp milliseconds.	1705557025030
indexed_time	number	Time when the event was received by Match, in UNIX timestamp milliseconds.	1705557025030
ioc_match_id	string	Unique match ID linking to the corresponding iocmatch_ocsf row, format {orgid}_{event_id}_0_{ioc_id}.	1773_79618005142_0_59324653376
tm_id	number	Threat model ID in ThreatStream.	8472
tm_match_id	string	Unique ID for the threat model match, format {orgid}_{event_id}_0_{ioc_id}_{tm_id}.	1773_79618005142_0_59324653376_8472
tm_name	string	Threat model name in ThreatStream.	APT29 Campaign
tm_type	string	Threat model type in ThreatStream.	actor, campaign, ttp