SecurityResult

Security related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.

JSON representation 
{
  "about": {
    object (Noun)
  },
  "category": [
    enum (SecurityCategory)
  ],
  "categoryDetails": [
    string
  ],
  "threatName": string,
  "ruleSet": string,
  "ruleSetDisplayName": string,
  "rulesetCategoryDisplayName": string,
  "ruleId": string,
  "ruleName": string,
  "ruleVersion": string,
  "ruleType": string,
  "ruleAuthor": string,
  "ruleLabels": [
    {
      object (Label)
    }
  ],
  "alertState": enum (AlertState),
  "detectionFields": [
    {
      object (Label)
    }
  ],
  "outcomes": [
    {
      object (Label)
    }
  ],
  "variables": {
    string: {
      object (FindingVariable)
    },
    ...
  },
  "summary": string,
  "description": string,
  "action": [
    enum (Action)
  ],
  "actionDetails": string,
  "severity": enum (ProductSeverity),
  "confidence": enum (ProductConfidence),
  "priority": enum (ProductPriority),
  "riskScore": number,
  "confidenceScore": number,
  "analyticsMetadata": [
    {
      object (AnalyticsMetadata)
    }
  ],
  "severityDetails": string,
  "confidenceDetails": string,
  "priorityDetails": string,
  "urlBackToProduct": string,
  "threatId": string,
  "threatFeedName": string,
  "threatIdNamespace": enum (Namespace),
  "threatStatus": enum (ThreatStatus),
  "attackDetails": {
    object (AttackDetails)
  },
  "firstDiscoveredTime": string,
  "associations": [
    {
      object (Association)
    }
  ],
  "campaigns": [
    string
  ],
  "reports": [
    string
  ],
  "verdict": {
    object (Verdict)
  },
  "lastUpdatedTime": string,
  "verdictInfo": [
    {
      object (VerdictInfo)
    }
  ],
  "threatVerdict": enum (ThreatVerdict),
  "lastDiscoveredTime": string,
  "detectionDepth": string,
  "threatCollections": [
    {
      object (ThreatCollectionItem)
    }
  ]
}
Fields
about

object (Noun)

If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
category[]

enum (SecurityCategory)

The security category. This field is not populated when the SecurityResult appears in a detection.
categoryDetails[]

string

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
threatName

string

A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.
ruleSet

string

The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
ruleSetDisplayName

string

The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
rulesetCategoryDisplayName

string

The curated detection rule set category display name. (for example, if ruleSetDisplayName is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
ruleId

string

A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
ruleName

string

Name of the security rule (e.g. "BlockInboundToOracle").
ruleVersion

string

Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
ruleType

string

The type of security rule.
ruleAuthor

string

Author of the security rule. This field is not populated when the SecurityResult appears in a detection.
ruleLabels[]

object (Label)

A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
alertState

enum (AlertState)

The alerting types of this security result. This is primarily set for rule-generated detections and alerts.
detectionFields[]

object (Label)

An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

This is only populated when the SecurityResult appears in a detection.
outcomes[]

object (Label)

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection.
variables

map (key: string, value: object (FindingVariable))

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
summary

string

A short human-readable summary (e.g. "failed login occurred")
description

string

A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
action[]

enum (Action)

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
actionDetails

string

The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.
severity

enum (ProductSeverity)

The severity of the result.
confidence

enum (ProductConfidence)

The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.
priority

enum (ProductPriority)

The priority of the result. This field is not populated when the SecurityResult appears in a detection.
riskScore

number

The risk score of the security result.
confidenceScore

number

The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.
analyticsMetadata[]

object (AnalyticsMetadata)

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
severityDetails

string

Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.
confidenceDetails

string

Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.
priorityDetails

string

Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.
urlBackToProduct

string

URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.
threatId

string

Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.
threatFeedName

string

Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.
threatIdNamespace

enum (Namespace)

The attribute threatIdNamespace qualifies threatId with an id namespace to get an unique id. The attribute threatId by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.
threatStatus

enum (ThreatStatus)

Current status of the threat This field is not populated when the SecurityResult appears in a detection.
attackDetails

object (AttackDetails)

MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.
firstDiscoveredTime

string (Timestamp format)

First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
associations[]

object (Association)

Associations related to the threat.
campaigns[]
(deprecated)

string

Campaigns using this IOC threat. This is deprecated. Use threatCollections instead.
reports[]
(deprecated)

string

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threatCollections instead.
verdict
(deprecated)

object (Verdict)

Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
lastUpdatedTime

string (Timestamp format)

Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictInfo[]

object (VerdictInfo)

Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
threatVerdict

enum (ThreatVerdict)

GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.
lastDiscoveredTime

string (Timestamp format)

Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
detectionDepth

string (int64 format)

The depth of the detection chain. Applies only to composite detections.
threatCollections[]

object (ThreatCollectionItem)

GTI collections associated with the security result.

SecurityCategory

SecurityCategory is used to standardize security categories across products so one event is not categorized as "malware" and another as a "virus".

Enums
UNKNOWN_CATEGORY The default category.
SOFTWARE_MALICIOUS Malware, spyware, rootkit.
SOFTWARE_SUSPICIOUS Below the conviction threshold; probably bad.
SOFTWARE_PUA Potentially Unwanted App (such as adware).
NETWORK_MALICIOUS Includes C&C or network exploit.
NETWORK_SUSPICIOUS Suspicious activity, such as potential reverse tunnel.
NETWORK_CATEGORIZED_CONTENT Non-security related: URL has category like gambling or porn.
NETWORK_DENIAL_OF_SERVICE DoS, DDoS.
NETWORK_RECON Port scan detected by an IDS, probing of web app.
NETWORK_COMMAND_AND_CONTROL If we know this is a C&C channel.
ACL_VIOLATION Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
AUTH_VIOLATION Authentication failed (e.g. bad password or bad 2-factor authentication).
EXPLOIT Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
DATA_EXFILTRATION DLP: Sensitive data transmission, copy to thumb drive.
DATA_AT_REST DLP: Sensitive data found at rest in a scan.
DATA_DESTRUCTION Attempt to destroy/delete data.
TOR_EXIT_NODE TOR Exit Nodes.
MAIL_SPAM Spam email, message, etc.
MAIL_PHISHING Phishing email, chat messages, etc.
MAIL_SPOOFING Spoofed source email address, etc.
POLICY_VIOLATION Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
SOCIAL_ENGINEERING Threats which manipulate to break normal security procedures.
PHISHING Phishing pages, pops, https phishing etc.

AlertState

The type of alerting set up for a security result.

Enums
UNSPECIFIED The security result type is not known.
NOT_ALERTING The security result is not an alert.
ALERTING The security result is an alert.

FindingVariable

A structure that holds the value and associated metadata for values extracted while producing a Finding.

JSON representation 
{
  "type": enum (Type),
  "value": string,
  "sourcePath": string,

  // Union field typed_value can be only one of the following:
  "boolVal": boolean,
  "bytesVal": string,
  "doubleVal": number,
  "int64Val": string,
  "uint64Val": string,
  "stringVal": string,
  "timestampTime": string,
  "nullVal": boolean,
  "boolSeq": {
    object (BoolSequence)
  },
  "bytesSeq": {
    object (BytesSequence)
  },
  "doubleSeq": {
    object (DoubleSequence)
  },
  "int64Seq": {
    object (Int64Sequence)
  },
  "uint64Seq": {
    object (Uint64Sequence)
  },
  "stringSeq": {
    object (StringSequence)
  }
  // End of list of possible types for union field typed_value.
}
Fields
type

enum (Type)

The type of the variable.
value

string

The value in string form.
sourcePath

string

The UDM field path for the field which this value was derived from. Example: principal.user.username
Union field typed_value. The typed value of the variable. typed_value can be only one of the following:
boolVal

boolean

The value in boolean format.
bytesVal

string (bytes format)

The value in bytes format.

A base64-encoded string.
doubleVal

number

The value in double format.
int64Val

string (int64 format)

The value in int64 format.
uint64Val

string

The value in uint64 format.
stringVal

string

The value in string format. Enum values are returned as strings.
timestampTime

string (Timestamp format)

The value in timestamp format.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
nullVal

boolean

Whether the value is null.
boolSeq

object (BoolSequence)

The value in boolsequence format.
bytesSeq

object (BytesSequence)

The value in bytessequence format.
doubleSeq

object (DoubleSequence)

The value in doublesequence format.
int64Seq

object (Int64Sequence)

The value in int64sequence format.
uint64Seq

object (Uint64Sequence)

The value in uint64sequence format.
stringSeq

object (StringSequence)

The value in stringsequence format.

Type

Type options for Finding variables.

Enums
TYPE_UNSPECIFIED An unspecified variable type.
MATCH A variable coming from the match conditions.
OUTCOME A variable representing significant data that was found in the detection logic.

BoolSequence

BoolSequence represents a sequence of bools.

JSON representation 
{
  "boolVals": [
    boolean
  ]
}
Fields
boolVals[]

boolean

bool sequence.

BytesSequence

BytesSequence represents a sequence of bytes.

JSON representation 
{
  "bytesVals": [
    string
  ]
}
Fields
bytesVals[]

string (bytes format)

bytes sequence.

A base64-encoded string.

DoubleSequence

DoubleSequence represents a sequence of doubles.

JSON representation 
{
  "doubleVals": [
    number
  ]
}
Fields
doubleVals[]

number

double sequence.

Int64Sequence

Int64Sequence represents a sequence of int64s.

JSON representation 
{
  "int64Vals": [
    string
  ]
}
Fields
int64Vals[]

string (int64 format)

int64 sequence.

Uint64Sequence

Uint64Sequence represents a sequence of uint64s.

JSON representation 
{
  "uint64Vals": [
    string
  ]
}
Fields
uint64Vals[]

string

uint64 sequence.

StringSequence

StringSequence represents a sequence of string.

JSON representation 
{
  "stringVals": [
    string
  ]
}
Fields
stringVals[]

string

string sequence.

Action

Enum representing different possible actions taken by the product that created the event.

Enums
UNKNOWN_ACTION The default action.
ALLOW Allowed.
BLOCK Blocked.
ALLOW_WITH_MODIFICATION Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
QUARANTINE Put somewhere for later analysis (does NOT imply block).
FAIL Failed (e.g. the event was allowed but failed).
CHALLENGE Challenged (e.g. the user was challenged by a Captcha, 2FA).

ProductPriority

A product priority level.

Enums
UNKNOWN_PRIORITY Default priority level.
LOW_PRIORITY Low priority.
MEDIUM_PRIORITY Medium priority.
HIGH_PRIORITY High priority.

AnalyticsMetadata

Stores information about an analytics metric used in a rule.

JSON representation 
{
  "analytic": string
}
Fields
analytic

string

Name of the analytic.

ThreatStatus

Vendor-specific information about the status of a threat (ITW).

Enums
THREAT_STATUS_UNSPECIFIED Default threat status
ACTIVE Active threat.
CLEARED Cleared threat.
FALSE_POSITIVE False positive.

AttackDetails

MITRE ATT&CK details.

JSON representation 
{
  "version": string,
  "tactics": [
    {
      object (Tactic)
    }
  ],
  "techniques": [
    {
      object (Technique)
    }
  ]
}
Fields
version

string

ATT&CK version (e.g. 12.1).
tactics[]

object (Tactic)

Tactics employed.
techniques[]

object (Technique)

Techniques employed.

Tactic

Tactic information related to an attack or threat.

JSON representation 
{
  "id": string,
  "name": string
}
Fields
id

string

Tactic ID (e.g. "TA0043").
name

string

Tactic Name (e.g. "Reconnaissance")

Technique

Technique information related to an attack or threat.

JSON representation 
{
  "id": string,
  "name": string,
  "subtechniqueId": string,
  "subtechniqueName": string
}
Fields
id

string

Technique ID (e.g. "T1595").
name

string

Technique Name (e.g. "Active Scanning").
subtechniqueId

string

Subtechnique ID (e.g. "T1595.001").
subtechniqueName

string

Subtechnique Name (e.g. "Scanning IP Blocks").

Association

Associations represents different metadata about malware and threat actors involved with an IoC.

JSON representation 
{
  "id": string,
  "countryCode": [
    string
  ],
  "type": enum (AssociationType),
  "name": string,
  "description": string,
  "role": string,
  "sourceCountry": string,
  "alias": [
    {
      object (AssociationAlias)
    }
  ],
  "firstReferenceTime": string,
  "lastReferenceTime": string,
  "industriesAffected": [
    string
  ],
  "associatedActors": [
    {
      object (Association)
    }
  ],
  "regionCode": {
    object (Location)
  },
  "sponsorRegion": {
    object (Location)
  },
  "targetedRegions": [
    {
      object (Location)
    }
  ],
  "tags": [
    string
  ]
}
Fields
id

string

Unique association id generated by mandiant.
countryCode[]

string

Country from which the threat actor/ malware is originated.
type

enum (AssociationType)

Signifies the type of association.
name

string

Name of the threat actor/malware.
description

string

Human readable description about the association.
role

string

Role of the malware. Not applicable for threat actor.
sourceCountry
(deprecated)

string

Name of the country the threat originated from.
alias[]

object (AssociationAlias)

Different aliases of the threat actor given by different sources.
firstReferenceTime

string (Timestamp format)

First time the threat actor was referenced or seen.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastReferenceTime

string (Timestamp format)

Last time the threat actor was referenced or seen.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
industriesAffected[]

string

List of industries the threat actor affects.
associatedActors[]

object (Association)

List of associated threat actors for a malware. Not applicable for threat actors.
regionCode

object (Location)

Name of the country, the threat is originating from.
sponsorRegion

object (Location)

Sponsor region of the threat actor.
targetedRegions[]

object (Location)

Targeted regions.
tags[]

string

Tags.

AssociationType

Represents different possible Association types. Can be threat or malware. Used to represent Mandiant threat intelligence.

Enums
ASSOCIATION_TYPE_UNSPECIFIED The default Association Type.
THREAT_ACTOR Association type Threat actor.
MALWARE Association type Malware.

AssociationAlias

Association Alias used to represent Mandiant Threat Intelligence.

JSON representation 
{
  "name": string,
  "company": string
}
Fields
name

string

Name of the alias.
company

string

Name of the provider who gave the association's name.

Verdict

Deprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.

JSON representation 
{
  "sourceCount": integer,
  "responseCount": integer,
  "neighbourInfluence": string,
  "verdict": {
    object (ProviderMLVerdict)
  },
  "analystVerdict": {
    object (AnalystVerdict)
  }
}
Fields
sourceCount

integer

Number of sources from which intelligence was extracted.
responseCount

integer

Total response count across all sources.
neighbourInfluence

string

Describes the neighbour influence of the verdict.
verdict

object (ProviderMLVerdict)

ML Verdict provided by sources like Mandiant.
analystVerdict

object (AnalystVerdict)

Human analyst verdict provided by sources like Mandiant.

ProviderMLVerdict

Deprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.

JSON representation 
{
  "sourceProvider": string,
  "benignCount": integer,
  "maliciousCount": integer,
  "confidenceScore": integer,
  "mandiantSources": [
    {
      object (Source)
    }
  ],
  "thirdPartySources": [
    {
      object (Source)
    }
  ]
}
Fields
sourceProvider

string

Source provider giving the ML verdict.
benignCount

integer

Count of responses where this IoC was marked benign.
maliciousCount

integer

Count of responses where this IoC was marked malicious.
confidenceScore

integer

Confidence score of the verdict.
mandiantSources[]

object (Source)

List of mandiant sources from which the verdict was generated.
thirdPartySources[]

object (Source)

List of third-party sources from which the verdict was generated.

Source

Deprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.

JSON representation 
{
  "name": string,
  "benignCount": integer,
  "maliciousCount": integer,
  "quality": enum (ProductConfidence),
  "responseCount": integer,
  "sourceCount": integer,
  "threatIntelligenceSources": [
    {
      object (Source)
    }
  ]
}
Fields
name

string

Name of the IoC source.
benignCount

integer

Count of responses where this IoC was marked benign.
maliciousCount

integer

Count of responses where this IoC was marked malicious.
quality

enum (ProductConfidence)

Quality of the IoC mapping extracted from the source.
responseCount

integer

Total response count from this source.
sourceCount

integer

Number of sources from which intelligence was extracted.
threatIntelligenceSources[]

object (Source)

Different threat intelligence sources from which IoC info was extracted.

AnalystVerdict

Verdict provided by the human analyst. These fields are used to model Mandiant sources.

JSON representation 
{
  "confidenceScore": integer,
  "verdictTime": string,
  "verdictResponse": enum (VerdictResponse)
}
Fields
confidenceScore

integer

Confidence score of the verdict.
verdictTime

string (Timestamp format)

Timestamp at which the verdict was generated.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictResponse

enum (VerdictResponse)

Details of the verdict.

VerdictResponse

Represents different verdict types. Used to represent Mandiant threat intelligence.

Enums
VERDICT_RESPONSE_UNSPECIFIED The default verdict response type.
MALICIOUS VerdictResponse resulted a threat as malicious.
BENIGN VerdictResponse resulted a threat as benign.

VerdictInfo

Describes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.

JSON representation 
{
  "sourceCount": integer,
  "responseCount": integer,
  "neighbourInfluence": string,
  "verdictType": enum (VerdictType),
  "sourceProvider": string,
  "benignCount": integer,
  "maliciousCount": integer,
  "confidenceScore": integer,
  "iocStats": [
    {
      object (IoCStats)
    }
  ],
  "verdictTime": string,
  "verdictResponse": enum (VerdictResponse),
  "globalCustomerCount": integer,
  "globalHitsCount": integer,
  "pwn": boolean,
  "categoryDetails": string,
  "pwnFirstTaggedTime": string
}
Fields
sourceCount

integer

Number of sources from which intelligence was extracted.
responseCount

integer

Total response count across all sources.
neighbourInfluence

string

Describes the near neighbor influence of the verdict.
verdictType

enum (VerdictType)

Type of verdict.
sourceProvider

string

Source provider giving the machine learning verdict.
benignCount

integer

Count of responses where this IoC was marked as benign.
maliciousCount

integer

Count of responses where this IoC was marked as malicious.
confidenceScore

integer

Confidence score of the verdict.
iocStats[]

object (IoCStats)

List of IoCStats from which the verdict was generated.
verdictTime

string (Timestamp format)

Timestamp when the verdict was generated.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictResponse

enum (VerdictResponse)

Details about the verdict.
globalCustomerCount

integer

Global customer count over the last 30 days
globalHitsCount

integer

Global hit count over the last 30 days.
pwn

boolean

Whether one or more Mandiant incident response customers had this indicator in their environment.
categoryDetails

string

Tags related to the verdict.
pwnFirstTaggedTime

string (Timestamp format)

The timestamp of the first time a pwn was associated to this entity.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

VerdictType

Category of the verdict.

Enums
VERDICT_TYPE_UNSPECIFIED Verdict category not specified.
PROVIDER_ML_VERDICT MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
ANALYST_VERDICT Verdict provided by the human analyst. These fields are used to model Mandiant sources.

IoCStats

Information about the threat intelligence source. These fields are used to model Mandiant sources.

JSON representation 
{
  "iocStatsType": enum (IoCStatsType),
  "firstLevelSource": string,
  "secondLevelSource": string,
  "benignCount": integer,
  "quality": enum (ProductConfidence),
  "maliciousCount": integer,
  "responseCount": integer,
  "sourceCount": integer
}
Fields
iocStatsType

enum (IoCStatsType)

Describes the source of the IoCStat.
firstLevelSource

string

Name of first level IoC source, for example Mandiant or a third-party.
secondLevelSource

string

Name of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
benignCount

integer

Count of responses where the IoC was identified as benign.
quality

enum (ProductConfidence)

Level of confidence in the IoC mapping extracted from the source.
maliciousCount

integer

Count of responses where the IoC was identified as malicious.
responseCount

integer

Total number of response from the source.
sourceCount

integer

Number of sources from which information was extracted.

IoCStatsType

Type of IoCStat based on source.

Enums
UNSPECIFIED_IOC_STATS_TYPE IoCStat source is unidentified.
MANDIANT_SOURCES IoCStat is from a Mandiant Source.
THIRD_PARTY_SOURCES IoCStat is from a third-party source.
THREAT_INTELLIGENCE_IOC_STATS IoCStat is from a threat intelligence feed.

ThreatVerdict

GCTI threat verdict levels.

Enums
THREAT_VERDICT_UNSPECIFIED Unspecified threat verdict level.
UNDETECTED Undetected threat verdict level.
SUSPICIOUS Suspicious threat verdict level.
MALICIOUS Malicious threat verdict level.

ThreatCollectionItem

Threat Collection that is either a threat campaign or a threat report.

JSON representation 
{
  "id": string,
  "type": enum (ThreatCollectionType),
  "altNames": [
    string
  ]
}
Fields
id

string

The ID of the threat collection.
type

enum (ThreatCollectionType)

The type of threat collection (e.g., "campaign").
altNames[]

string

The name of the threat collection.

ThreatCollectionType

Different Types of threat collections currently supported.

Enums
THREAT_COLLECTION_TYPE_UNSPECIFIED Threat collection type is unspecified.
CAMPAIGN Threat collection type is campaign.
REPORT Threat collection type is report.