Get Threat Data List

Returns a list of threat data objects from Intel Exchange using a CQL query. You can retrieve a maximum of 500,000 threat data objects using this API.

Use the following field mapping and operator references to write accurate CQL queries for this endpoint.

The following table maps UI field labels and their associated values to the corresponding API field keys and values used in the CQL module. Use this mapping to write accurate CQL queries in the API. UI Label API Query Key Accepted Values (UI label -> API Query Key) Object Type type

• Indicator → indicator
• Malware → malware
• Threat Actor → threat-actor
• Vulnerability → vulnerability
• Attack Pattern → attack-pattern
• Campaign → campaign
• Course of Action → course-of-action
• Identity → identity
• Infrastructure → infrastructure
• Intrusion Set → intrusion-set
• Location → location
• Malware Analysis → malware-analysis
• Observed Data → observed-data
• Opinion → opinion
• Tool → tool
• Report → report IOC type ioc_type
• Artifact → artifact
• Autonomous system → autonomous-system
• Directory → directory
• Domain → domain-name
• Email addr → email-addr
• Email message → email-message
• File → file
• Ipv4 addr → ipv4-addr
• Ipv6 addr → ipv6-addr
• Mac addr → mac-addr
• MD5 → MD5
• Mutex → mutex
• Network traffic → network-traffic
• Process → process
• SHA1 → SHA-1
• SHA224 → SHA-224
• SHA384 → SHA-384
• SHA512 → SHA-512
• Software → software
• SSDEEP → SSDEEP
• URL → url
• User account → user-account
• Windows registry key → windows-registry-key
• X509 certificate → x509-certificate
• YARA → yara Custom Object Type custom_object_type Custom object types are platform-defined. For example, text will appear as x-test in API queries. Source source Each source in the UI maps to a unique source ID in the API. These IDs vary based on the sources configured in your instance. Source Type source_type
• STIX → CUSTOM_STIX_SOURCES
• APIs → API_FEEDS
• Email → EMAIL_ACCOUNTS
• RSS → RSS_FEED
• X (Twitter) → TWITTER_FEEDS
• Web Scraper → WEB_SCRAPPER
• Sandbox → MALWARE_SANDBOX
• Miscellaneous → MISCELLANEOUS Source Collections source_collection Each source collection maps to a unique ID used in API queries. These values vary based on the collections configured in your instance. Source Confidence source_confidence
• High → HIGH
• Medium → MEDIUM
• Low → LOW
• None → NONE Source Confidence Value source_confidence_value Pass an integer value representing the confidence score in the API. Source Created source_created Use an EPOCH timestamp to filter results by the created date in your API query. Source Modified source_modified Use an EPOCH timestamp to filter results by the modified date in your API query. Value value Pass a custom string to match or filter against user-defined input. Published Collection published_collection Use the collection’s unique ID to filter by a specific published collection. Published Date published_on Pass an EPOCH timestamp to filter indicators by their published date. Imported File Date imported_file_on Pass an EPOCH timestamp to filter indicators by their imported file date. Imported File imported_file Provide any string value as the label for the imported file. System Created Date ctix_created Use an EPOCH timestamp to filter by the system creation date in API queries. System Modified Date ctix_modified Use an EPOCH timestamp to filter by the system modification date in API queries. Risk Score confidence_score Provide an integer value to represent the risk or confidence level in your API query. TLP tlp
• Red → RED
• Amber+Strict → AMBER_STRICT
• Amber → AMBER
• Green → GREEN
• Clear → CLEAR
• None → NONE Valid Until valid_until Pass an EPOCH timestamp to specify the expiry date of the indicator in your API query Valid From valid_from Pass an EPOCH timestamp to define when the indicator becomes valid in your API query. Tag Category tag_type
• Source → source
• User → user
• System → system
• Privileged Access → privileged
• Group → group Tags tags Pass the unique tag ID in your API query. Each tag in the UI corresponds to a specific ID. Analyst Score analyst_score Provide an integer value in the API to indicate the analyst-assigned score. Analyst CVSS Score analyst_cvss_score Pass an integer value to represent the analyst-assigned CVSS score. Countries countries Use the exact country name as shown in the UI. The API expects the same value without any change in casing or format. First Seen first_seen Pass the date as an EPOCH timestamp when querying through the API. Last Seen last_seen Pass the date as an EPOCH timestamp when querying through the API. Deprecation Status is_deprecated
• Deprecated → true
• Not Deprecated → false False Positive Status is_false_positive
• True → true
• False → false Review Status is_reviewed
• Reviewed → true
• Not Reviewed → false Revoke Status is_revoked
• Revoked → true
• Not Revoked → false Manual Review is_under_review
• Yes → true
• No → false Included in Allowed Indicators is_whitelisted
• Yes → true
• No → false Actioned By actioned_by Pass the system-generated user ID when querying through the API. Actioned Date actioned_on Use an EPOCH timestamp to filter results by actioned date in the API. Action Medium action_type
• Manual → manual
• Rule → automatic Actioned App Type aapp_type
• CTIX → ctix
• 3rd Party → third_party Actioned App app_name Use the app name exactly as shown in the UI. The API expects the value with the same casing and format, without any changes. Relation Created Date relation_created Pass the date as an EPOCH timestamp in the API. Relation Modified Date relation_modified Pass the date as an EPOCH timestamp in the API. Relation Type relationship_type Pass either predefined or custom relationship types in the API. Common default types include duplicate-of, derived-from, and related-to. Related Object Property related_object_property Values are populated dynamically based on platform configuration for related object properties. Related Object related_object Use this key in your API queries. Values are the same as those used in the Object Type field. Has Relations has_relations
• Yes → true
• No → false Sighting Located sighting_located
• Yes → true
• No → false Sighting Observed sighting_observed
• Yes → true
• No → false Sighting First Seen sighting_first_seen Pass an EPOCH timestamp in your API query to specify when the sighting was first observed. Sighting Last Seen sighting_last_seen Pass an EPOCH timestamp in your API query to specify when the sighting was last observed. Sighting Source Created sighting_source_created Pass an EPOCH timestamp in your API query to define when the source created the sighting. Sighting Source Modified sighting_source_modified Pass an EPOCH timestamp in your API query to define when the source last modified the sighting.

CQL Conditions: Learn about conditional operators used in CQL expressions.

CQL Operators: Understand the supported comparison and logical operators in CQL.

For more information, see CQL documentation.