Enumerations.
Every closed value set in the API, in one place. Pass an unrecognised value to a filter
and you get a 400 naming the field rather than an empty page, so this is the list to
check against when a filter behaves unexpectedly. See
Pagination and errors.
IOC kinds
Field: kind.
ip · domain · url · url-path · md5 · sha1 · sha256 · filename · other
IOC verdicts
Field: verdict.
| Value | Meaning |
|---|---|
MALICIOUS | At least one vendor positively identifies the indicator as malicious |
SUSPICIOUS | Vendors report something concerning without calling it outright malicious |
BENIGN | A vendor recognises the indicator as known-good |
UNKNOWN | No vendor has an opinion on it yet |
The value is the worst reading across your enrichment vendors, on the principle that one credible vendor calling something malicious matters more than several never having seen it.
IOC confidence
Field: confidence, an integer from 0 to 100, or null.
Derived at read time, and the same number the platform shows. It starts from how clearly
the indicator was stated in the source text, rises as independent vendors confirm it
malicious, and is capped low if any vendor calls it benign. It is null, and empty in
CSV, when there is genuinely no signal, rather than a misleading middling value.
Confidence is distinct from an indicator's decaying score, which reflects freshness and reputation. See IOC enrichment and decay scoring.
TLP markings
Field: tlp.
TLP:CLEAR · TLP:GREEN · TLP:AMBER · TLP:AMBER+STRICT · TLP:RED
The value returned is the effective handling marking: the most restrictive of the
marking stored on the indicator and the one implied by its provenance. Indicators
extracted from reports you uploaded yourself come back as TLP:RED.
Report enrichment status
Field: enrichment_status on /events/. Poll this after ingesting a report.
new · in_progress · enriched_for_user · enriched_for_billing_account · complete · failed
An unrecognised value passed to the ?enrichment_status= filter is a 400. It previously
returned an empty page with a 200, which read as "nothing matches" when the truth was
"that is not a status".
Intelligence package status
Field: status on /reports/.
GENERATING · DRAFT · STAGED · SENT · FAILED
See Intelligence Packages for what each state means in the platform.
Package artifact types
Query value: ?type= on GET /reports/{id}/download/.
| Value | Artifact |
|---|---|
pdf | The formatted, branded PDF. The default |
md | The written intelligence narrative |
csv | Indicators of compromise |
stix | STIX 2.1 bundle |
sigma | SIGMA detection rules |
Threat library entity types
Path segment on /threat-library/{entity_type}/.
threat-actors · malware · vulnerabilities · clusters
The first three read the canonical catalogue: global, deduplicated entries shared across
the platform, with a per-account tracking object telling you whether you track that entry
and at what criticality.
Clusters are account-local groupings with no canonical record behind them, so the
techniques, threat-events, and related sub-resources return 400 for a cluster
rather than an empty result.
Criticality
baseline · low · medium · high · severe · emergency
Verification stage
Field: verification on a Threat Event.
auto · corroborated · verified · disputed · rejected · merged
A merged occurrence names its survivor in merged_into. Full definitions are on
Threat Events, and the platform-side explanation is in
verification stages.
Credibility
Field: credibility, an integer band from 1 to 6 where lower is better, with the word
in credibility_label. Both are null on an occurrence that has not been scored.
| Band | Label |
|---|---|
| 1 | Confirmed |
| 2 | Probably True |
| 3 | Possibly True |
| 4 | Doubtful |
| 5 | Improbable |
| 6 | Cannot be judged |
The min_credibility filter returns bands at least this good, so min_credibility=2
gives you bands 1 and 2.
Source reliability
Grade on each source attached to a Threat Event.
A Completely reliable · B Usually reliable · C Fairly reliable · D Not usually
reliable · E Unreliable · F Reliability cannot be judged
Stance
What a given report does with respect to an occurrence, on each entry in sources.
claims · corroborates · updates · mentions · disputes
See Source reliability, credibility, and confidence for how these three trust judgements differ and how each is set.
Frequently asked questions
What values can an IOC verdict take?
MALICIOUS, SUSPICIOUS, BENIGN, or UNKNOWN. The value is the worst reading across
your enrichment vendors, on the principle that one credible vendor calling something
malicious matters more than several never having seen it.
Why is an IOC's confidence null instead of a number?
Because there is genuinely no signal to compute one from: no extraction confidence, no vendor enrichment, and no explicit verdict. A null is honest where a middling default would be misleading.
Which TLP marking does the API return?
The effective one: the most restrictive of the marking stored on the indicator and the
marking implied by its provenance. Indicators from your own uploaded reports come back as
TLP:RED.