Class IoCIndicatorDetailed

Additional domain-specific context from threat intelligence sources.

A container for additional, undeclared properties. This is a holder for any undeclared properties as specified with the 'additionalProperties' keyword in the OAS document.

Autonomous system CIDR block.

Geographic location information for an IP indicator.

Autonomous system number.

Autonomous system organization name.

Autonomous system type.

Threat intelligence sources that flagged this indicator as benign.

Threat categories associated with the indicator.

Critical assets associated with this indicator.

Timestamp when the indicator was first seen.

Hosts associated with this indicator.

Unique identifier for the indicator.

The indicator value (for example, an IP address or domain).

Type of indicator (for example, IP address or domain).

Timestamp when the indicator was last seen.

Number of logs that matched this indicator.

Log sources where this indicator was observed.

Effect of a scoring factor on the indicator's threat score.

Effect of a scoring factor on the indicator's threat score.

Effect of a scoring factor on the indicator's threat score.

Effect of a scoring factor on the indicator's threat score.

Threat intelligence sources that flagged this indicator as malicious.

Effect of a scoring factor on the indicator's threat score.

Threat score for the indicator (0-100).

Services where this indicator was observed.

Number of security signals that matched this indicator.

Breakdown of security signals by severity.

Signal tier level.

Threat intelligence sources that flagged this indicator as suspicious.

Tags associated with the indicator.

Users associated with this indicator, grouped by category.