REST Resource: projects.locations.instances.iocAssociations

Resource: IocAssociation

Associations represents different metadata about malware and threat actors involved with an IoC. NEXT TAG: 16

JSON representation 
{
  "name": string,
  "id": string,
  "countryCode": [
    string
  ],
  "regionCode": {
    object (AssociationLocation)
  },
  "type": enum (AssociationType),
  "threatDisplayName": string,
  "description": string,
  "alias": [
    {
      object (IocAssociationAlias)
    }
  ],
  "firstReferenceTime": string,
  "lastReferenceTime": string,
  "industriesAffected": [
    string
  ],
  "associatedActors": [
    {
      object (IocAssociation)
    }
  ],
  "roles": [
    string
  ],
  "operatingSystems": [
    string
  ],
  "iocs": [
    string
  ]
}
Fields
name

string

Output only. Identifier. The resource name of this IocAssociation. Format: projects/{project}/locations/{location}/instances/{instance}/ iocAssociations/{iocAssociation}
id

string

Output only. Association identifier. This can be used to request details of the IocAssociation from the Google Threat Intelligence API (https://gtidocs.virustotal.com/reference/get-threat)
countryCode[]
(deprecated)

string

Output only. Deprecated. Use regionCode instead. Country from which the threat actor originated.
regionCode

object (AssociationLocation)

Output only. Name of the country the threat is originating from.
type

enum (AssociationType)

Output only. Signifies the type of association.
threatDisplayName

string

Output only. Name of the threat actor/malware.
description

string

Output only. Human readable description about the association.
alias[]

object (IocAssociationAlias)

Output only. Different aliases of the threat actor given by different sources.
firstReferenceTime

string (Timestamp format)

Output only. First time the threat actor was referenced or seen.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastReferenceTime

string (Timestamp format)

Output only. Last time the threat actor was referenced or seen.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
industriesAffected[]

string

Output only. List of industries the threat actor affects.
associatedActors[]
(deprecated)

object (IocAssociation)

Output only. List of associated threat actors for a malware. Not applicable for threat actors.
roles[]

string

Output only. List of roles associated with the malware. Not applicable for threat actors.
operatingSystems[]

string

Output only. List of operating systems that associated with the malware. Not applicable for threat actors.
iocs[]

string

Output only. The resource names of the Iocs that are related to this IocAssociation. Format: projects/{project}/locations/{location}/instances/{instance}/iocs/{ioc}

AssociationLocation

Information about a location.

JSON representation 
{
  "city": string,
  "state": string,
  "countryOrRegion": string,
  "location": string,
  "desk": string,
  "floor": string,
  "regionCoordinates": {
    object (LatLng)
  }
}
Fields
city

string

Output only. The city.
state

string

The state.
countryOrRegion

string

The country or region.
location

string

Custom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
desk

string

Desk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
floor

string

Floor name, number or a combination of the two for a building. (e.g. "1-A").
regionCoordinates

object (LatLng)

Coordinates for the associated region.

AssociationType

Represents different possible Association types. Can be threat or malware. Used to represent Mandiant threat intelligence.

Enums
ASSOCIATION_TYPE_UNSPECIFIED The default Association Type.
THREAT_ACTOR Association type Threat actor.
MALWARE Association type Malware.

IocAssociationAlias

Association Alias Used to represent Mandiant Threat intel.

JSON representation 
{
  "associationName": string,
  "provider": string
}
Fields
associationName

string

Output only. Name of the alias.
provider

string

Output only. Name of the provider who gave the association's name.

Methods

batchGet

 Gets a batch (list) of IocAssociations given a list of names and a parent.

fetchRelatedIocAssociations

 List related Ioc Associations for a given Ioc Association.

fetchRelatedThreatCollections

 List related threat collections for an IocAssociation.

get

 Get an Ioc Association by resource name.