File Threat Intelligence

File Threat Intelligence is a searchable entity at the top of Query's UI.

file_intelligence

Insights from threat intelligence platforms about files

Contents

Attributes

Caption Name Type Is Array Default Description
Details details String Details about the IP address.
Filenames filenames String The names a file is known by.
Findings findings Finding The findings from threat intelligence platforms
Fingerprints fingerprints Fingerprint An array of known fingerprints for the file.
First Seen first_seen_time Timestamp The initial detection time of the activity or object. See specific usage
Labels labels String The labels or tags in the intelligence.
Last Seen last_seen_time Timestamp The most recent detection time of the activity or object. See specific usage.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Additional references for more information. references String A list of reference URLs supporting the finding/detection.
Reputations reputations Reputation Reputation score as reported by provider
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
Vendor Name vendor_name String The vendor that provided the intelligence.

References

Referenced By

Context

File Threat Intelligence

JSON

            
{
  "description": "Insights from threat intelligence platforms about files",
  "caption": "File Threat Intelligence",
  "name": "file_intelligence",
  "extends": "_base_threat_intelligence",
  "attributes": {
    "fingerprints": {
      "description": "An array of known fingerprints for the file.",
      "requirement": "optional",
      "caption": "Fingerprints",
      "type": "fingerprint",
      "is_array": true
    },
    "filenames": {
      "description": "The names a file is known by.",
      "requirement": "optional",
      "caption": "Filenames",
      "type": "string_t",
      "is_array": true
    },
    "first_seen_time": {
      "requirement": "optional",
      "caption": "First Seen",
      "description": "The initial detection time of the activity or object. See specific usage",
      "type": "timestamp_t"
    },
    "last_seen_time": {
      "requirement": "optional",
      "caption": "Last Seen",
      "description": "The most recent detection time of the activity or object. See specific usage.",
      "type": "timestamp_t"
    },
    "vendor_name": {
      "description": "The vendor that provided the intelligence.",
      "requirement": "optional",
      "caption": "Vendor Name",
      "type": "string_t"
    },
    "references": {
      "caption": "Additional references for more information.",
      "requirement": "optional",
      "description": "A list of reference URLs supporting the finding/detection.",
      "type": "string_t",
      "is_array": true
    },
    "reputations": {
      "description": "Reputation score as reported by provider",
      "requirement": "optional",
      "caption": "Reputations",
      "is_array": true,
      "type": "reputation"
    },
    "findings": {
      "description": "The findings from threat intelligence platforms",
      "requirement": "optional",
      "caption": "Findings",
      "type": "finding",
      "is_array": true
    },
    "labels": {
      "description": "The labels or tags in the intelligence.",
      "requirement": "optional",
      "caption": "Labels",
      "type": "string_t",
      "is_array": true
    },
    "details": {
      "description": "Details about the IP address.",
      "requirement": "optional",
      "caption": "Details",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "extension": "query"
}