Edit

Share via

ThreatIntelligenceIndicator

  • Article

Threat Intelligence Indicator

Table attributes

Attribute Value
Resource types -
Categories Security
Solutions SecurityInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
Action string Action to take on indicator match.
Active bool Indicates whether indicator is active.
ActivityGroupNames string Activity groups associated with indicator.
AdditionalInformation string Free text additional information for indicator.
_BilledSize real The record size in bytes
ConfidenceScore real Confidence rating of the indicator, from 0 to 100.
Description string Description of the indicator.
DiamondModel string Diamond model value for the indicator, one of adversary, capability, infrastructure or victim.
DomainName string The domain name observable.
EmailEncoding string The email encoding observable.
EmailLanguage string The email language observable.
EmailRecipient string The email recipient observable.
EmailSenderAddress string The email sender address observable.
EmailSenderName string The email sender name observable.
EmailSourceDomain string The email source domain observable.
EmailSourceIpAddress string The email source IP address observable.
EmailSubject string The email subject observable.
EmailXMailer string The email X-Mailer observable.
ExpirationDateTime datetime Time of indicator expiration.
ExternalIndicatorId string Identifier for indicator from submitting system.
FileCompileDateTime datetime The file compilation time observable.
FileCreatedDateTime datetime The file creation time observable.
FileHashType string The file hash type observable.
FileHashValue string The file hash value observable.
FileMutexName string The file mutex name observable.
FileName string The file name observable.
FilePacker string The file packer observable.
FilePath string The file path observable.
FileSize int The file size observable.
FileType string The file type observable.
IndicatorId string Unique identifier for indicator, calculated by receiving system.
IndicatorProvider string The name of the entity that provided the indicator.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
KillChainActions bool Indicates whether kill chain value 'actions' is set.
KillChainC2 bool Indicates whether kill chain value 'C2' is set.
KillChainDelivery bool Indicates whether kill chain value 'delivery' is set.
KillChainExploitation bool Indicates whether kill chain value 'exploitation' is set.
KillChainReconnaissance bool Indicates whether kill chain value 'reconniassance' is set.
KillChainWeaponization bool Indicates whether kill chain value 'weaponization' is set.
KnownFalsePositives string Text describing situations where indicator may cause false positives.
MalwareNames string List of malware names associated with indicator
NetworkCidrBlock string The network CIDR block observable.
NetworkDestinationAsn int The network destination autonomous system number observable.
NetworkDestinationCidrBlock string The network destination CIDR block observable.
NetworkDestinationIP string The network destination IP address.
NetworkDestinationPort int The network destination port observable.
NetworkIP string The network IP address observable.
NetworkPort int The network port observable.
NetworkProtocol int The network protocol observable.
NetworkSourceAsn int The network source autonomous system number observable.
NetworkSourceCidrBlock string The network source CIDR block observable.
NetworkSourceIP string The network source IP address observable.
NetworkSourcePort int The network source port observable.
PassiveOnly bool Indicates whether the indicator should trigger an event that is visible to a user.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Tags string Free form tags.
TenantId string The Log Analytics workspace ID
ThreatSeverity int Indicator severity rating from 0 to 5. Higher value indicates greater severity.
ThreatType string Threat type of indicator.
TimeGenerated datetime Time of indicator ingestion.
TrafficLightProtocolLevel string Industry standard traffic light protocol level, one of white, green, amber or red.
Type string The name of the table
Url string The url observable.
UserAgent string The user agent observable.