Anomali ThreatStream

Anomali ThreatStream is a threat intelligence platform that aggregates and analyzes threat data to enhance security operations.

Anomali ThreatStream is a leading threat intelligence platform that aggregates and analyzes threat data from various sources to provide actionable insights. The integration with Swimlane Turbine allows users to automate the retrieval and analysis of threat intelligence data, enhancing security operations. By leveraging this connector, users can efficiently assess email reputations, retrieve observable records, import observables for analysis, and search threat intelligence data, all within the Swimlane platform. This integration empowers security teams to streamline threat detection and response processes, reducing manual effort and improving overall security posture.

Prerequisites

Before you can use the Anomali ThreatStream connector for Turbine, you'll need access to the Anomali ThreatStream API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing Anomali ThreatStream services.

API Key: A unique key provided by Anomali for authenticating API requests.

API User: The username associated with the API Key for identification purposes.

Capabilities

The Anomali ThreatStream connector has the following capabilities:

Search Indicator

Import Indicator

Get Email Reputation

Get Observable ID

Search Observable

expiration_ts is in ISO format. For example, 2017-01-26T00:00:00. By default, UTC time is used. You can specify your local time by appending your timezone to the value. For example, to specify PST: 2019-04-28T14:00:00-08:00 If a global or a local value is not specified for this attribute, by default 90 days is configured.

To avoid long run time, use the limit input to limit the number of records returned.

Get Observable ID

Retrieve observable records by value and type. Use the returned id from an observable record in actions that require an Anomali ThreatStream observable ID. Use the optional limit input to restrict the number of matching records returned.

Import Observable

Fields that must contain data vary based on the type of observable. The following table lists the mandatory fields for each observable type.

Observable Type	Required Fields
Domain	Domain, Indicator Type
Email	Email, Indicator Type, Confidence
Hash	MD5, Indicator Type, Confidence
IP	Source IP, Indicator Type
URL	URL, Indicator Type

Indicator Types

The following table lists all available indicator types in ThreatStream.

The severity values listed in the table below represent the default severity values that Anomali assigns to observables of a given indicator types. However, default values are not displayed in the following cases:

When severity value assigned to observable by the source are used

When users modify the assigned value while editing observables that belong to their organizations on ThreatStream

Indicator Type	Name	Type	Severity	Description
actor_ip	Actor IP	IP	Low	IP address associated with a system involved in malicious activity. Example: itype="actor_ip"
actor_ipv6	Actor IPv6	IP	Low	IPv6 address associated with a system involved in malicious activity. Example: itype="actor_ipv6"
actor_subject	Actor Subject Line	String	High	Subject from an email associated with a threat actor. Example: itype="actor_subject"
adware_domain	Adware Domain	Domain	Low	A domain name associated with adware or other Potentially Unwanted Applications (PUA). Example: itype="adware_domain"
adware_registry_key	Adware Registry Key	String	Low	A registry key associated with adware or other Potentially Unwanted Applications (PUA). Example: itype="adware_registry_key"
anon_proxy	Anonymous Proxy IP	IP	Low	IP address of the system on which anonymous proxy software is hosted. Example: itype="anon_proxy"
anon_proxy_ipv6	Anonymous Proxy IPv6	IP	Low	IPv6 address of the system on which anonymous proxy software is hosted. Example: itype="anon_proxy_ipv6"
anon_vpn	Anonymous VPN IP	IP	Low	IP address associated with commercial or free Virtual Private Networks (VPN). Example: itype="anon_vpn"
anon_vpn_ipv6	Anonymous	IP	Low	IPv6 address associated with commercial or free Virtual Private Networks (VPN). Example: itype:"anon_vpn_ipv6"
apt_domain	APT Domain	Domain	Very-High	Domain name associated with a known Advanced Persistent Threat (APT) actor used for command and control, launching exploits, or data exfiltration. Example: itype=" apt_domain"
apt_email	APT Email	Email	High	Email address used by a known Advanced Persistent Threat (APT) actor for sending targeted, spear phishing emails. Example: itype="apt_email"
apt_email_subject_line	APT Email Subject Line	String	High	Subject from an email associated with an Advanced Persistent Threat (APT) actor. Example: itype="apt_email_subject_line"
apt_file_name	APT File Name	String	Very-High	Name of a file used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_file_name"
apt_file_path	APT File Path	String	Very-High	File path used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_file_path"
apt_ip	APT IP	IP	Very-High	IP address associated with known Advanced Persistent Threat (APT) actor for command and control, data exfiltration, or targeted exploitation. Example: itype="apt_ip"
apt_ipv6	APT IPv6	IP	Very-High	IPv6 address associated with known Advanced Persistent Threat (APT) actor for command and control, data exfiltration, or targeted exploitation. Example: itype="apt_ipv6"
apt_md5	APT File Hash	Hash	Very-High	MD5 or SHA hash of a malware sample used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_md5"
apt_mta	APT Mail Transfer Agent	String	Very-High	Mail transfer agent used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_mta"
apt_mutex	APT Mutex	String	Very-High	Mutex used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_mutex"
apt_registry_key	APT Registry	String	Very-High	Registry key used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_registry_key"
apt_service_description	APT Service Description	String	Very-High	Description used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_service_description"
apt_service_displayname	APT Service Display Name	String	Very-High	Service display name used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_service_displayname"
apt_service_name	APT Service Name	String	Very-High	Service name used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_service_name"
apt_ssdeep	APT SSDeep Hash	String	Very-High	SSDeep Hash used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_ssdeep"
apt_subject	APT Subject Line	String	High	Email subject line used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_subject"
apt_ua	APT User Agent	String	High	User agent string used by a known Advanced Persistent Threat (APT) actor. Example: itype="apt_ua"
apt_url	APT URL	URL	Very-High	URL used by a known Advanced Persistent Threat (APT) actor for command and control, launching web based exploits, or data exfiltration. Example: itype=" apt_url"
bot_ip	Infected Bot IP	IP	Low	IP address of an infected machine acting as an autonomous bot. Example: itype="bot_ip"
bot_ipv6	Infected Bot IPv6	IP	Low	IPv6 address of an infected machine acting as an autonomous bot. Example: itype="bot_ipv6"
brute_ip	Brute Force IP	IP	Low	IP address associated with password brute force activity. Example: itype="brute_ip"
brute_ipv6	Brute Force IPv6	IP	Low	IPv6 address associated with password brute force activity. Example: itype="brute_ipv6"
c2_domain	Malware C&C Domain Name	Domain	High	Domain name used by malware for command and control communication. Example: itype="c2_domain"
c2_ip	Malware C&C IP Address	IP	High	IP address used by malware for command and control communication. Example: itype="c2_ip"
c2_ipv6	Malw are C&C IPv6 Address	IP	High	IPv6 address used by malware for command and control communication. Example: itype="c2_ipv6"
c2_url	Malware C&C URL	URL	High	URL used by malware for command and control communication. Example: itype="c2_url"
comm_proxy_domain	Commercial Webproxy Domain	Domain	Low	Domain of the system on which commercial proxy software is hosted. Example: itype="comm_proxy_domain"
comm_proxy_ip	Commercial Webproxy IP	IP	Low	IP address of the system on which commercial proxy software is hosted. Example: itype="comm_proxy_ip"
compromised_domain	Compromised Domain	Domain	Low	Domain name of website or server that has been compromised. Example: itype="compromised_domain"
compromised_email	Compromised Account Email	Email	Low	Email address that has been compromised and/or taken over by a threat actor. Example: itype="compromised_email"
compromised_email_subject	Compromised Email Subject	String	Low	Email subject from a known compromised email address. Example: itype="compromised_email_subject"
compromised_ip	Compromised IP	IP	Low	IP address of website or server that has been compromised. Example: itype="compromised_ip"
compromised_ipv6	Compromised IPv6	IP	Low	IPv6 address of website or server that has been compromised. Example: itype="compromised_ipv6"
compromised_serv_account	Compromised Service Account	String	Low	Account information associated with a service account that has been compromised and/or taken over by a threat actor. Example: itype="compromised_serv_account"
compromised_url	Compromised URL	URL	Medium	URL of the website or server that has been compromised. Example: itype="compromised_url"
crypto_hash	Cryptocurrency Mining Software	Hash	High	File hash for cryptocurrency mining software. Example: itype="crypto_hash"
crypto_ip	Cryptocurrency IP	IP	High	IP address associated with cryptocurrency mining software. Example: itype="crypto_ip"
crypto_pool	Cryptocurrency Pool Domain	Domain	High	Domain for cryptocurrency pool. Example: itype="crypto_pool"
crypto_url	Cryptocurrency URL	URL	High	URL where cryptocurrency mining software is hosted. Example: itype="crypto_url"
crypto_wallet	Cryptocurrency Wallet Address	String	Very-High	Public or private cryptocurrency wallet key. Example: itype="crypto_wallet"
ddos_ip	DDOS IP	IP	Low	IP address associated with Distributed Denial of Service (DDoS) attacks. Example: itype="ddos_ip"
ddos_ipv6	DDOS IPv6	IP	Low	IPv6 address associated with Distributed Denial of Service (DDoS) attacks. Example: itype="ddos_ipv6"
disposable_email_domain	Disposable Email Domain	Domain	Low	Domain associated with disposable email activity. Example: itype="disposable_email_domain"
dyn_dns	Dynamic DNS	Domain	Low	Domain name used for hosting Dynamic DNS services. Example: itype="dyn_dns"
email_attachment_subject	Email Attachment Subject	String	Low	Email subject from a known compromised email attachment. Example: itype="email_attachment_subject"
exfil_domain	Data Exfiltration Domain	Domain	High	Domain name associated with the infrastructure used for data exfiltration. Example: itype="exfil_domain"
exfil_ip	Data Exfiltration IP	IP	High	IP address used for data exfiltration. Example: itype="exfil_ip"
exfil_ipv6	Data Exfiltration IP	IP	High	IPv6 address used for data exfiltration. Example: itype="exfil_ipv6"
exfil_url	Data Exfiltration URL	URL	High	URL used for data exfiltration. Example: itype="exfil_url"
exploit_domain	Exploit Kit Domain	Domain	Very-High	Domain name associated with the web server hosting an exploit kit or launching web-based exploits. Example: itype="exploit_domain"
exploit_ip	Exploit Kit IP	IP	High	IP address associated with the web server hosting an exploit kit or launching web-based exploits. Example: itype="exploit_ip"
exploit_ipv6	Exploit Kit IPv6	IP	High	IPv6 address associated with the web server hosting an exploit kit or launching web-based exploits. Example: itype="exploit_ipv6"
exploit_url	Exploit Kit URL	URL	Very-High	URL used for launching web- based exploits. Example: itype="exploit_url"
fraud_domain	Fraud Hash	Domain	High	Domain associated with fraudulent activity. Example: itype="fraud_domain"
fraud_email	Fraud Email	Email	Low	Email address associated with fraudulent activity. Example: itype="fraud_email"
fraud_email_subject	Fraud Email Subject	String	Medium	Subject from an email associated with fraud activity. Example: itype="fraud_ip"
fraud_ip	Fraud IP Address	IP	High	IP address associated with fraudulent activity. Example: itype="fraud_email_subject"
fraud_md5	Fraud Hash	Hash	Very-High	Hash associated with fraudulent activity. Example: itype="fraud_md5"
fraud_url	Fraud URL	URL	Medium	URL associated with fraudulent activity. Example: itype="fraud_url"
free_email_domain	Free Email Domain	Domain	Low	Domain associated with free email service activity. Example: itype="free_email_domain"
geolocation_url	IP Geolocation URL	URL	Low	URL that can be used to provide IP Geo location services. Example: itype="geolocation_url"
hack_tool	Hacking Tool	String	High	Name of general hacking software tools used by threat actors. Example: itype="hack_tool"
hack_tool_md5	Hack Tool File Hash	Hash	Very-High	MD5 or SHA hash of general hacking software tools used by threat actors. Example: itype="hack_tool_md5"
i2p_ip	I2P IP Address	IP	Low	IP address observed to be connecting to the I2P (Invisible Internet Project) network. Example: itype="i2p_ip"
i2p_ipv6	I2P IPv6 Address	IP	Low	IPv6 address observed to be connecting to the I2P (Invisible Internet Project) network. Example: itype="i2p_ipv6"
ipcheck_url	IP Check URL	URL	Low	URL that can be used to provide IP checking services, such as echoing the Internet facing IP address of the client. Example: itype="ipcheck_url"
mal_domain	Malware Domain	Domain	Very-High	Domain contacted by malware sample, could be for command and control commands, or to check if the client is online. Example: itype="mal_domain"
mal_email	Malware Email	Email	Low	Email address used to send malware through malicious links or attachments. Example: itype="mal_email"
mal_email_subject	Malware Email Subject	String	Medium	Subject from an email associated with malware activity. Example: itype="mal_email_subject"
mal_file_name	Malware File Name	String	Very-High	File name of malware sample. Example: itype="mal_file_name"
mal_file_path	Malware File Path	String	Very-High	File path of malware sample. Example: itype="mal_file_path"
mal_ip	Malware C&C IP	IP	Very-High	IP address contacted by malware sample, could be for command and control commands, or to check if the client is online. Example: itype="mal_ip"
mal_ipv6	Malware C&C IPv6	IP	Very-High	IPv6 address contacted by malware sample command and control commands, or to check if the client is online. Example: itype="mal_ipv6"
mal_md5	Malware File Hash	Hash	Very-High	MD5 or SHA hash of malware sample. Example: itype="mal_md5"
mal_mutex	Malware Mutex	String	Very-High	Mutex of malware sample. Example: itype="mal_mutex"
mal_registry_key	Malware Registry Key	String	High	Registry key of malware sample. Example: itype="mal_registry_key"
mal_service_description	Malware Service Description	String	Very-High	Service description associated with the malware sample. Example: itype="mal_service_description"
mal_service_displayname	Malware Service Display Name	String	Very-High	Service display name associated with the malware sample. Example: itype="mal_service_displayname"
mal_service_name	Malware Service Name	String	Very-High	Service name associated with the malware sample. Example: itype="mal_service_name"
mal_ssdeep	Malware SSDeep Hash	String	Very-High	SSDeep Hash associated with the malware sample. Example: itype="mal_ssdeep"
mal_sslcert_sh1	SSL Certificate Hash	Hash	High	MD5 or SHA hash of SSL certificate associated with malware or botnet activities. Example: itype="mal_sslcert_sh1"
mal_ua	Malware User Agent	String	Low	User agent string used by malware sample when communicating via HTTP. Example: itype="mal_ua"
mal_url	Malware URL	URL	Very-High	URL contacted by malware sample when run on an infected host. Example: itype="mal_url"
p2pcnc	Peer-to-Peer C&C IP Address	IP	Medium	IP addressed associated with a peer-to-peer command and control infrastructure. Example: itype="p2pcnc"
p2pcnc_ipv6	Peer-to-Peer C&C IPv6 Address	IP	Medium	IPv6 addressed associated with a peer-to-peer command and control infrastructure. Example: itype="p2pcnc_ipv6"
parked_domain	Parked Domain	Domain	Low	A domain name of a website which is currently parked. Example: itype="parked_domain"
parked_ip	Domain Parking IP	IP	Low	An IP addressed used for parking newly registered or inactive domain names. Example: itype="parked_ip"
parked_ipv6	Domain Parking IPv6	IP	Low	An IPv6 addressed used for parking newly registered or inactive domain names. Example: itype="parked_ipv6"
parked_url	Parked URL	URL	Low	A URL of a website that is currently parked. Example: itype="parked_url"
pastesite_url	Paste Site URL	URL	Low	A URL that can be used for sharing pastes or text content anonymously. Example: itype="pastesite_url"
phish_domain	Phishing Domain	Domain	Very-High	A domain used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_domain"
phish_email	Phishing Email Address	Email	Very-High	An email address associated with sending phishing or spear phishing emails to victims. Example: itype="phish_email"
phish_email_subject	Phishing Email Subject	String	High	Subject from an email associated with phishing activity. Example: itype="phish_email_subject"
phish_ip	Phishing IP Address	IP	Very-High	IP Address that has been used to perform phishing or spear phishing or is contained in a phishing email. Example: itype="phish_ip"
phish_ipv6	Phishing IPv6 Address	IP	Very-High	IPv6 Address that has been used to perform phishing or spear phishing or is contained in a phishing email. Example: itype="phish_ipv6"
phish_md5	Phishing File Hash	Hash	Very-High	Hash related to a file used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_md5"
phish_url	Phishing URL	URL	Very-High	A URL used to perform phishing or spear phishing attacks or contained in a phishing email. Example: itype="phish_url"
proxy_ip	Open Proxy IP	IP	Low	IP address hosting open or anonymous proxy software. Allows user to hide their IP address from target. Example: itype="proxy_ip"
proxy_ipv6	Open Proxy IPv6	IP	Low	IPv6 address hosting open or anonymous proxy software. Allows user to hide their IP address from target. Example: itype="proxy_ipv6"
scan_ip	Scanning IP	IP	Medium	IP address observed to perform port scanning and vulnerability scanning activities. Example: itype="scan_ip"
scan_ipv6	Scanning IPv6	IP	Medium	IPv6 address observed to perform port scanning and vulnerability scanning activities. Example: itype="scan_ipv6"
sinkhole_domain	Sinkhole Domain	Domain	Low	A domain name that researchers or security companies typically sinkhole. Example: itype="sinkhole_domain"
sinkhole_ip	Sinkhole IP	IP	Low	An IP address that is known to be used to sinkhole malicious domain names. Example: itype="sinkhole_ip"
sinkhole_ipv6	Sinkhole IPv6	IP	Low	An IPv6 address that is known to be used to sinkhole malicious domain names. Example: itype="sinkhole_ipv6"
social_media_url	Social Media URL	URL	Medium	URL related to social media activity. This indicator type is provided by select feeds and cannot be imported through the ThreatStream user interface. Example: itype="social_media_url"
spam_domain	Spam Domain	Domain	Low	A malicious domain name contained in the SPAM email messages. Example: itype="spam_domain"
spam_email	Spammer Email Address	Email	Low	Email address that has been observed sending SPAM emails. Example: itype="spam_email"
spam_email_subject	Spam Email Subject	String	Low	Subject from an email associated with spam activity. Example: itype="spam_email_subject"
spam_ip	Spammer IP	IP	Low	An IP address that is known to send SPAM emails. Example: itype="spam_ip"
spam_ipv6	Spammer IPv6	IP	Low	An IPv6 address that is known to send SPAM emails. Example: itype="spam_ipv6"
spam_mta	Spam Mail Transfer Agent	String	Low	Mail transfer agent known to be associated with SPAM emails. Example: itype="spam_mta"
spam_url	Spam URL	URL	Low	A malicious URL contained in the SPAM email messages. Example: itype="spam_url"
speedtest_url	Speed Test URL	URL	Low	A URL that can be used to run internet speed tests or bandwidth measurements of the client's network connection. Example: itype="speedtest_url"
ssh_ip	SSH Brute Force IP	IP	Low	IP addresses associated with SSH brute force attempts. Example: itype="ssh_ip"
ssh_ipv6	SSH Brute Force IPv6	IP	Low	IPv6 addresses associated with SSH brute force attempts. Example: itype="ssh_ipv6"
ssl_cert_serial_number	SSL Certificate Serial Number	String	Low	Serial number unique to the TLS certificate issuer that identifies the entity being signed. Example: itype="ssl_cert_serial_number"
suppress	Suppress	n/a	n/a	Not a true indicator type. Used by Arcsight for suppressing false positives. Default Severity: n/a Example: itype="suppress"
suspicious_domain	Suspicious Domain	Domain	Medium	A domain name that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_domain"
suspicious_email	Suspicious Email	Email	Low	An email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_email"
suspicious_email_subject	Suspicious Email Subject	String	Low	Email subject from a suspicious email address.
suspicious_ip	Suspicious IP	IP	Medium	An IP address that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_ip"
suspicious_reg_email	Suspicious Registrant Email	Email	Low	A registrant email address that appears to be used for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_reg_email"
suspicious_url	Suspicious URL	URL	Medium	A URL that appears to be registered for suspect reasons, but may not be associated with known malicious activity yet. Example: itype="suspicious_url"
tor_ip	TOR Node IP	IP	Low	An IP address operating as part of The Onion Router (TOR) Network, also know as a TOR exit node. Example: itype="tor_ip"
tor_ipv6	TOR Node IPv6	IP	Low	An IPv6 address operating as part of The Onion Router (TOR) Network, also know as a TOR exit node. Example: itype="tor_ipv6"
torrent_tracker_url	Torrent Tracker URL	URL	Low	A URL used for tracking bittorrent file transfer activity. Example: itype="torrent_tracker_url"
vpn_domain	Anonymous VPN Domain	Domain	Low	A domain name associated with commercial or free Virtual Private Networks (VPN). Example: itype="vpn_domain"
vps_ip	Cloud Server IP	IP	Low	An IP address that is used for hosting Virtual Private Servers (VPS) or other server rentals. Example: itype="vps_ip"
vps_ipv6	Cloud Server IPv6	IP	Low	An IPv6 address that is used for hosting Virtual Private Servers (VPS) or other server rentals. Example: itype="vps_ipv6"
whois_bulk_reg_email	Whois Bulk Registrant Email	Email	Low	A registrant email address associated with privacy domain purchased from Whois. Example: itype="whois_bulk_reg_email"
whois_privacy_domain	Whois Privacy Email Domain	Domain	Low	Privacy domain purchased from Whois. Example: itype="whois_privacy_domain"
whois_privacy_email	Whois Privacy Email	Email	Low	Email address associated with privacy domain purchased from Whois. Example: itype="whois_privacy_email"

Threat Type

During the import process, ThreatStream uses machine learning to assign indicator types to imported observables based on the threat type you select. The following table lists all available threat types in ThreatStream, in addition to the indicator types with which they are associated.

Threat Type	Name	Example	Associated Indicator Types
adware	Adware	threat_type="adware"	adware_domain
anomalous	Anomalous	threat_type="anomalous"	geolocation_url,ipcheck_url,speedtest_url
anonymization	Anonymization	threat_type="anonymization"	anon_proxy, anon_proxy_ipv6, anon_vpn, anon_vpn_ipv6,proxy_ip, proxy_ipv6,vpn_domain
apt	APT	threat_type="apt"	apt_domain, apt_email, apt_email_subject, apt_file_name, apt_file_path,apt_ip, apt_ipv6, apt_md5, apt_mta, apt_mutex, apt_registry_key, apt_service_description, apt_service_displayname, apt_service_name, apt_ssdeep, apt_subject,apt_ua apt_url
bot	Bot	threat_type="bot"	bot_ip, bot_ipv6
brute	Brute	threat_type="brute"	brute_ip , brute_ipv6, ssh_ip, ssh_ipv6
c2	C2	threat_type="c2"	c2_domain, c2_ip,c2_ipv6, c2_url
compromised	Compromised	threat_type="compromised"	compromised_domain,compromised_email,compromised_email_subject,compromised_ip,compromised_ipv6,compromised_url
crypto	Crypto	threat_type="crypto"	crypto_hash, crypto_ip, crypto_pool,crypto_url, crypto_wallet
data_leakage	Data Leakage	threat_type="data_leakage"	pastesite_url
ddos	DDOS	threat_type="ddos"	ddos_ip, ddos_ipv6
dyn_dns	Dynamic DNS	threat_type="dyn_dns"	dyn_dns
exfil	Exfil	threat_type="exfil"	exfil_domain, exfil_ip, exfil_ipv6, exfil_url
exploit	Exploit	threat_type="exploit"	exploit_domain,exploit_ip, exploit_ipv6, exploit_url
fraud	Fraud	threat_type="fraud"	fraud_domain, fraud_email, fraud_email_subject, fraud_ip,fraud_md5, fraud_url
hack_tool	Hacking Tool	threat_type="hack_tool"	hack_tool
i2p	I2P	threat_type="i2p"	i2p_ip, i2p_ipv6
informational	Informational	threat_type="informational"	comm_proxy_domain, comm_proxy_ip,disposable_email_domain, free_email_domain, passphrase,ssl_cert_serial_number, whois_bulk_reg_email, whois_privacy_domain,whois_privacy_email
malware	Malware	threat_type="malware"	mal_domain, mal_email, mal_email_subject, email_attachment_subject,mal_file_name, mal_file_path, mal_ip,mal_ipv6, mal_md5,mal_mutex, mal_registry_key, mal_service_description,mal_service_displayname, mal_service_name, mal_ssdeep, mal_sslcert_sha1, mal_ua, mal_url
p2p	P2P	threat_type="p2p"	actor_ip actor_ipv6,actor_subject,p2pcnc, p2pcnc_ipv6, torrent_tracker_url
parked	Parked	threat_type="parked"	parked_domain,parked_ip, parked_ipv6, parked_url
phish	Phish	threat_type="phish"	phish_domain,phish_email, phish_email_subject,phish_ip, phish_ipv6,phish_url
scan	Scan	threat_type="scan"	scan_ip, scan_ipv6
sinkhole	Sinkhole	threat_type="sinkhole"	sinkhole_domain,sinkhole_ip,sinkhole_ipv6
spam	Spam	threat_type="spam"	adware_registry_key,spam_domain,spam_email, spam_email_subject,spam_ip, spam_ipv6,spam_mta spam_url
suppress	Suppress	threat_type="suppress"	suppress
suspicious	Suspicious	threat_type="suspicious"	suspicious_domain, suspicious_email,suspicious_email_subject, suspicious_ip, suspicious_reg_email, suspicious_url
tor	TOR	threat_type="tor"	tor_ip, tor_ipv6
vps	VPS	threat_type="vps"	vps_ip, vps_ipv6

Additional Documentation

Anomali ThreatStream Connector Documentation

Anomali ThreatStream API Documentation

Configurations

Anomali ThreatStream API Key Authentication

Authenticates using an API Key.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
x-apikey	API key.	string	Required
verify_ssl	Verify SSL certificate.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
api_user	API User used for authentication.	string	Required

Actions

Get Email Reputation

Retrieve the highest confidence score indicator for an email's reputation from Anomali ThreatStream using a specified value parameter.

Endpoint

URL: /api/v2/intelligence

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	The email address to check.
parameters.threshold	string	Optional	If the confidence is greater than the threshold the email address is considered malicious, otherwise it is considered good. This argument overrides the default email threshold defined as a parameter.
parameters.include_inactive	boolean	Optional	Whether to include results with an inactive status. Possible values are True, False.
parameters.status	string	Optional	Parameters for the Get Email Reputation action
parameters.limit	number	Optional	Parameters for the Get Email Reputation action

Input Example

{"parameters":{"value":"[email protected]","threshold":"None","include_inactive":true,"status":"status","limit":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
DBotScore	object	Score value
DBotScore.Indicator	string	Output field: DBotScore.Indicator
DBotScore.Reliability	string	Output field: DBotScore.Reliability
DBotScore.Score	number	Score value
DBotScore.Type	string	Type of the resource
DBotScore.Vendor	string	Output field: DBotScore.Vendor
Email	object	Output field: Email
Email.Address	string	Output field: Email.Address
ThreatStream	object	Output field: ThreatStream
ThreatStream.EmailReputation	object	Output field: ThreatStream.EmailReputation
ThreatStream.EmailReputation.Confidence	number	Unique identifier
ThreatStream.EmailReputation.Email	string	Output field: ThreatStream.EmailReputation.Email
ThreatStream.EmailReputation.Modified	string	Output field: ThreatStream.EmailReputation.Modified
ThreatStream.EmailReputation.Severity	string	Output field: ThreatStream.EmailReputation.Severity
ThreatStream.EmailReputation.Source	string	Output field: ThreatStream.EmailReputation.Source
ThreatStream.EmailReputation.Status	string	Status value
ThreatStream.EmailReputation.Tags	array	Output field: ThreatStream.EmailReputation.Tags
ThreatStream.EmailReputation.Type	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 19 Dec 2023 20:37:23 GMT"},"reason":"OK","json_body":{"DBotScore":{"Indicator":"[email protected]","Reliability":"B - Usually reliable","Score":3,"Type":"email","Vendor":"Anomali ThreatStream v3"},"Email":{"Address":"[email protected]"},"ThreatStream":{"EmailReputation":{}}}}

Get Observable ID

Retrieve observable records by value and type to obtain their Anomali ThreatStream IDs.

Endpoint

URL: /api/v2/intelligence/

Method: GET

Input

Argument Name	Type	Required	Description
parameters.value	string	Required	Value of the observable to retrieve.
parameters.type	string	Required	Type of the observable to retrieve.
parameters.limit	number	Optional	Maximum number of observable records to return.

Input Example

{"parameters":{"value":"string","type":"string","limit":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
objects	array	Output field: objects
objects.id	number	Unique identifier
objects.value	string	Value for the parameter
objects.type	string	Type of the resource
meta	object	Output field: meta
meta.limit	number	Output field: meta.limit
meta.offset	number	Output field: meta.offset
meta.total_count	number	Count value

Output Example

{"objects":[{"id":123,"value":"string","type":"string"}],"meta":{"limit":123,"offset":123,"total_count":123}}

Import Observable

Import observables into Anomali ThreatStream using a specified JSON body to structure data for effective threat analysis.

Endpoint

URL: /api/v1/intelligence

Method: PATCH

Input

Argument Name	Type	Required	Description
meta	object	Optional	Parameter for Import Observable
meta.allow_unresolved	boolean	Optional	Parameter for Import Observable
objects	object	Optional	Parameter for Import Observable
objects.classification	string	Optional	Parameter for Import Observable
objects.confidence	number	Optional	Unique identifier
objects.source_confidence_weight	number	Optional	Unique identifier
objects.expiration_ts	string	Optional	Parameter for Import Observable
objects.severity	string	Optional	Parameter for Import Observable
objects.tags	array	Optional	Parameter for Import Observable
objects.trustedcircles	array	Optional	Parameter for Import Observable
objects.srcip	string	Optional	Parameter for Import Observable
objects.itype	string	Required	Type of the resource
objects.domain	string	Optional	Parameter for Import Observable
objects.url	string	Optional	URL endpoint for the request
objects.email	string	Optional	Parameter for Import Observable
objects.md5	string	Optional	Parameter for Import Observable

Input Example

{"json_body":{"meta":{"allow_unresolved":true},"objects":{"classification":"private","confidence":60,"source_confidence_weight":100,"expiration_ts":"2023-07-30 22:00:00","severity":"medium","tags":["malware","Windows-XP","DSL"],"trustedcircles":[13],"srcip":"1.2.3.4","itype":"bot_ip","domain":"idfsdszqylwjzq.biz","url":"http://malicious.pl/wp-content/themes/credenza-wp/cr_mss3.exe","email":"[email protected]","md5":"1d37556b8aeb5cb5fbf08cd5b4790075"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Search Observable

Retrieve threat intelligence data on observables from Anomali ThreatStream to enhance security analysis.

Endpoint

URL: /api/v2/intelligence

Method: GET

Input

Argument Name	Type	Required	Description
parameters.limit	number	Optional	Parameters for the Search Observable action
parameters.asn	string	Optional	Autonomous System (AS) number associated with the indicator.
parameters.asn__exact	string	Optional	Autonomous System (AS) number associated with the indicator.
parameters.asn__startswith	string	Optional	Autonomous System (AS) number associated with the indicator.
parameters.asn__contains	string	Optional	Autonomous System (AS) number associated with the indicator.
parameters.confidence	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.confidence__exact	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.confidence__lt	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.confidence__gt	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.confidence__lte	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.confidence__gte	number	Optional	Level of certainty that an observable is of the reported indicator type. Confidence scores range from 0-100, in increasing order of confidence, and is assigned by ThreatStream based on several factors.
parameters.country	string	Optional	Country associated with the indicator.
parameters.country__exact	string	Optional	Country associated with the indicator.
parameters.country__startswith	string	Optional	Country associated with the indicator.
parameters.country__contains	string	Optional	Country associated with the indicator.
parameters.created_ts	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.created_ts__exact	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.created_ts__lt	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.created_ts__lte	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.created_ts__gte	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.created_ts__gt	string	Optional	When the indicator was first seen on the ThreatStream cloud platform. Date must be specified in this format - YYYYMMDDThhmmss where T denotes the start of the value for time, in UTC time. For example, 2014-10-02T20:44:35.
parameters.expiration_ts	string	Optional	Time stamp of when intelligence will expire on ThreatStream, in UTC time.
parameters.expiration_ts__exact	string	Optional	Time stamp of when intelligence will expire on ThreatStream, in UTC time.
parameters.expiration_ts__lt	string	Optional	Time stamp of when intelligence will expire on ThreatStream, in UTC time.
parameters.expiration_ts__lte	string	Optional	Time stamp of when intelligence will expire on ThreatStream, in UTC time.

Input Example

{"parameters":{"limit":123,"asn":"string","asn__exact":"string","asn__startswith":"string","asn__contains":"string","confidence":123,"confidence__exact":123,"confidence__lt":123,"confidence__gt":123,"confidence__lte":123,"confidence__gte":123,"country":"string","country__exact":"string","country__startswith":"string","country__contains":"string","created_ts":"string","created_ts__exact":"string","created_ts__lt":"string","created_ts__lte":"string","created_ts__gte":"string","created_ts__gt":"string","expiration_ts":"string","expiration_ts__exact":"string","expiration_ts__lt":"string","expiration_ts__lte":"string","expiration_ts__gte":"string","expiration_ts__gt":"string","feed_id":123,"feed_id__exact":123,"id":"12345678-1234-1234-1234-123456789abc","import_session_id":123,"import_session_id__exact":123,"ip":"string","ip__exact":"string","ip__startswith":"string","ip__contains":"string","is_anonymous":true,"is_anonymous__exact":true,"is_public":true,"is_public__exact":true,"itype":"string","itype__exact":"string","itype__startswith":"string","itype__contains":"string","latitude":123,"latitude__exact":123,"latitude__lt":123,"latitude__lte":123,"latitude__gte":123,"latitude__gt":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
objects	array	Output field: objects
objects.target_industry	array	Output field: objects.target_industry
objects.source	string	Output field: objects.source
objects.threatscore	number	Score value
objects.threat_type	string	Type of the resource
objects.trusted_circle_ids	array	Unique identifier
objects.description	object	Output field: objects.description
objects.workgroups	array	Output field: objects.workgroups
objects.sort	array	Output field: objects.sort
objects.resource_uri	string	Output field: objects.resource_uri
objects.update_id	number	Unique identifier
objects.country	string	Output field: objects.country
objects.type	string	Type of the resource
objects.uuid	string	Unique identifier
objects.feed_id	number	Unique identifier
objects.created_ts	string	Output field: objects.created_ts
objects.id	number	Unique identifier
objects.longitude	number	Output field: objects.longitude
objects.ip	string	Output field: objects.ip
objects.expiration_ts	string	Output field: objects.expiration_ts
objects.owner_organization_id	number	Unique identifier
objects.meta	object	Output field: objects.meta
objects.meta.severity	string	Output field: objects.meta.severity

Output Example

{"objects":[{"target_industry":[],"source":"string","threatscore":123,"threat_type":"string","trusted_circle_ids":[],"description":{},"workgroups":[],"sort":[],"resource_uri":"string","update_id":123,"country":"string","type":"string","uuid":"12345678-1234-1234-1234-123456789abc","feed_id":123,"created_ts":"string"}],"meta":{"offset":123,"limit":123,"total_count":123,"next":{},"took":123}}

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 19 Dec 2023 20:37:23 GMT