Threat Intel fields

Threat intelligence Filebeat Module.

threat.indicator.file.hash.tlsh

The file's import tlsh, if available.

type: keyword

threat.indicator.file.hash.sha384

The file's sha384 hash, if available.

type: keyword

threat.feed.name

type: keyword

threat.feed.dashboard_id

type: keyword

Fields for AbuseCH Malware Threat Intel

abusech.malware.file_type

File type guessed by URLhaus.

type: keyword

abusech.malware.signature

Malware familiy.

type: keyword

abusech.malware.urlhaus_download

Location (URL) where you can download a copy of this file.

type: keyword

abusech.malware.virustotal.result

AV detection ration.

type: keyword

abusech.malware.virustotal.percent

AV detection in percent.

type: float

abusech.malware.virustotal.link

Link to the Virustotal report.

type: keyword

Fields for AbuseCH Malware Threat Intel

abusech.url.id

The ID of the url.

type: keyword

abusech.url.urlhaus_reference

Link to URLhaus entry.

type: keyword

abusech.url.url_status

The current status of the URL. Possible values are: online, offline and unknown.

type: keyword

abusech.url.threat

The threat corresponding to this malware URL.

type: keyword

abusech.url.blacklists.surbl

SURBL blacklist status. Possible values are: listed and not_listed

type: keyword

abusech.url.blacklists.spamhaus_dbl

Spamhaus DBL blacklist status.

type: keyword

abusech.url.reporter

The Twitter handle of the reporter that has reported this malware URL (or anonymous).

type: keyword

abusech.url.larted

Indicates whether the malware URL has been reported to the hosting provider (true or false)

type: boolean

abusech.url.tags

A list of tags associated with the queried malware URL

type: keyword

Fields for Anomali Threat Intel

anomali.limo.id

The ID of the indicator.

type: keyword

anomali.limo.name

The name of the indicator.

type: keyword

anomali.limo.pattern

The pattern ID of the indicator.

type: keyword

anomali.limo.valid_from

When the indicator was first found or is considered valid.

type: date

anomali.limo.modified

When the indicator was last modified

type: date

anomali.limo.labels

The labels related to the indicator

type: keyword

anomali.limo.indicator

The value of the indicator, for example if the type is domain, this would be the value.

type: keyword

anomali.limo.description

A description of the indicator.

type: keyword

anomali.limo.title

Title describing the indicator.

type: keyword

anomali.limo.content

Extra text or descriptive content related to the indicator.

type: keyword

anomali.limo.type

The indicator type, can for example be "domain, email, FileHash-SHA256".

type: keyword

anomali.limo.object_marking_refs

The STIX reference object.

type: keyword

Fields for Anomali ThreatStream

anomali.threatstream.classification

Indicates whether an indicator is private or from a public feed and available publicly. Possible values: private, public.

type: keyword

example: private

anomali.threatstream.confidence

The measure of the accuracy (from 0 to 100) assigned by ThreatStream's predictive analytics technology to indicators.

type: short

anomali.threatstream.detail2

Detail text for indicator.

type: text

example: Imported by user 42.

anomali.threatstream.id

The ID of the indicator.

type: keyword

anomali.threatstream.import_session_id

ID of the import session that created the indicator on ThreatStream.

type: keyword

anomali.threatstream.itype

Indicator type. Possible values: "apt_domain", "apt_email", "apt_ip", "apt_url", "bot_ip", "c2_domain", "c2_ip", "c2_url", "i2p_ip", "mal_domain", "mal_email", "mal_ip", "mal_md5", "mal_url", "parked_ip", "phish_email", "phish_ip", "phish_url", "scan_ip", "spam_domain", "ssh_ip", "suspicious_domain", "tor_ip" and "torrent_tracker_url".

type: keyword

anomali.threatstream.maltype

Information regarding a malware family, a CVE ID, or another attack or threat, associated with the indicator.

type: wildcard

anomali.threatstream.md5

Hash for the indicator.

type: keyword

anomali.threatstream.resource_uri

Relative URI for the indicator details.

type: keyword

anomali.threatstream.severity

Criticality associated with the threat feed that supplied the indicator. Possible values: low, medium, high, very-high.

type: keyword

anomali.threatstream.source

Source for the indicator.

type: keyword

example: Analyst

anomali.threatstream.source_feed_id

ID for the integrator source.

type: keyword

anomali.threatstream.state

State for this indicator.

type: keyword

example: active

anomali.threatstream.trusted_circle_ids

ID of the trusted circle that imported the indicator.

type: keyword

anomali.threatstream.update_id

Update ID.

type: keyword

anomali.threatstream.url

URL for the indicator.

type: keyword

anomali.threatstream.value_type

Data type of the indicator. Possible values: ip, domain, url, email, md5.

type: keyword

Fields for Malware Bazaar Threat Intel

abusech.malwarebazaar.file_type

File type guessed by Malware Bazaar.

type: keyword

abusech.malwarebazaar.signature

Malware familiy.

type: keyword

abusech.malwarebazaar.tags

A list of tags associated with the queried malware sample.

type: keyword

abusech.malwarebazaar.intelligence.downloads

Number of downloads from MalwareBazaar.

type: long

abusech.malwarebazaar.intelligence.uploads

Number of uploads from MalwareBazaar.

type: long

abusech.malwarebazaar.intelligence.mail.Generic

Malware seen in generic spam traffic.

type: keyword

abusech.malwarebazaar.intelligence.mail.IT

Malware seen in IT spam traffic.

type: keyword

abusech.malwarebazaar.anonymous

Identifies if the sample was submitted anonymously.

type: long

abusech.malwarebazaar.code_sign

Code signing information for the sample.

type: nested

Fields for MISP Threat Intel

misp.id

Attribute ID.

type: keyword

misp.orgc_id

Organization Community ID of the event.

type: keyword

misp.org_id

Organization ID of the event.

type: keyword

misp.threat_level_id

Threat level from 5 to 1, where 1 is the most critical.

type: long

misp.info

Additional text or information related to the event.

type: keyword

misp.published

When the event was published.

type: boolean

misp.uuid

The UUID of the event object.

type: keyword

misp.date

The date of when the event object was created.

type: date

misp.attribute_count

How many attributes are included in a single event object.

type: long

misp.timestamp

The timestamp of when the event object was created.

type: date

misp.distribution

Distribution type related to MISP.

type: keyword

misp.proposal_email_lock

Settings configured on MISP for email lock on this event object.

type: boolean

misp.locked

If the current MISP event object is locked or not.

type: boolean

misp.publish_timestamp

At what time the event object was published

type: date

misp.sharing_group_id

The ID of the grouped events or sources of the event.

type: keyword

misp.disable_correlation

If correlation is disabled on the MISP event object.

type: boolean

misp.extends_uuid

The UUID of the event object it might extend.

type: keyword

misp.org.id

The organization ID related to the event object.

type: keyword

misp.org.name

The organization name related to the event object.

type: keyword

misp.org.uuid

The UUID of the organization related to the event object.

type: keyword

misp.org.local

If the event object is local or from a remote source.

type: boolean

misp.orgc.id

The Organization Community ID in which the event object was reported from.

type: keyword

misp.orgc.name

The Organization Community name in which the event object was reported from.

type: keyword

misp.orgc.uuid

The Organization Community UUID in which the event object was reported from.

type: keyword

misp.orgc.local

If the Organization Community was local or synced from a remote source.

type: boolean

misp.attribute.id

The ID of the attribute related to the event object.

type: keyword

misp.attribute.type

The type of the attribute related to the event object. For example email, ipv4, sha1 and such.

type: keyword

misp.attribute.category

The category of the attribute related to the event object. For example "Network Activity".

type: keyword

misp.attribute.to_ids

If the attribute should be automatically synced with an IDS.

type: boolean

misp.attribute.uuid

The UUID of the attribute related to the event.

type: keyword

misp.attribute.event_id

The local event ID of the attribute related to the event.

type: keyword

misp.attribute.distribution

How the attribute has been distributed, represented by integer numbers.

type: long

misp.attribute.timestamp

The timestamp in which the attribute was attached to the event object.

type: date

misp.attribute.comment

Comments made to the attribute itself.

type: keyword

misp.attribute.sharing_group_id

The group ID of the sharing group related to the specific attribute.

type: keyword

misp.attribute.deleted

If the attribute has been removed from the event object.

type: boolean

misp.attribute.disable_correlation

If correlation has been enabled on the attribute related to the event object.

type: boolean

misp.attribute.object_id

The ID of the Object in which the attribute is attached.

type: keyword

misp.attribute.object_relation

The type of relation the attribute has with the event object itself.

type: keyword

misp.attribute.value

The value of the attribute, depending on the type like "url, sha1, email-src".

type: keyword

misp.context.attribute.id

The ID of the secondary attribute related to the event object.

type: keyword

misp.context.attribute.type

The type of the secondary attribute related to the event object. For example email, ipv4, sha1 and such.

type: keyword

misp.context.attribute.category

The category of the secondary attribute related to the event object. For example "Network Activity".

type: keyword

misp.context.attribute.to_ids

If the secondary attribute should be automatically synced with an IDS.

type: boolean

misp.context.attribute.uuid

The UUID of the secondary attribute related to the event.

type: keyword

misp.context.attribute.event_id

The local event ID of the secondary attribute related to the event.

type: keyword

misp.context.attribute.distribution

How the secondary attribute has been distributed, represented by integer numbers.

type: long

misp.context.attribute.timestamp

The timestamp in which the secondary attribute was attached to the event object.

type: date

misp.context.attribute.comment

Comments made to the secondary attribute itself.

type: keyword

misp.context.attribute.sharing_group_id

The group ID of the sharing group related to the specific secondary attribute.

type: keyword

misp.context.attribute.deleted

If the secondary attribute has been removed from the event object.

type: boolean

misp.context.attribute.disable_correlation

If correlation has been enabled on the secondary attribute related to the event object.

type: boolean

misp.context.attribute.object_id

The ID of the Object in which the secondary attribute is attached.

type: keyword

misp.context.attribute.object_relation

The type of relation the secondary attribute has with the event object itself.

type: keyword

misp.context.attribute.value

The value of the attribute, depending on the type like "url, sha1, email-src".

type: keyword

Fields for OTX Threat Intel

otx.id

The ID of the indicator.

type: keyword

otx.indicator

The value of the indicator, for example if the type is domain, this would be the value.

type: keyword

otx.description

A description of the indicator.

type: keyword

otx.title

Title describing the indicator.

type: keyword

otx.content

Extra text or descriptive content related to the indicator.

type: keyword

otx.type

The indicator type, can for example be "domain, email, FileHash-SHA256".

type: keyword

Fields for ThreatQ Threat Library

threatq.updated_at

Last modification time

type: date

threatq.created_at

Object creation time

type: date

threatq.expires_at

Expiration time

type: date

threatq.expires_calculated_at

Expiration calculation time

type: date

threatq.published_at

Object publication time

type: date

threatq.status

Object status within the Threat Library

type: keyword

threatq.indicator_value

Original indicator value

type: keyword

threatq.adversaries

Adversaries that are linked to the object

type: keyword

threatq.attributes

These provide additional context about an object

type: flattened