Security Center:ThreatIntelligence component

Parameter

Description

Intelligences

The threat intelligence event information, which is a JSON string. The following table describes the fields in the JSON value:

• source: The source of the threat intelligence event.

• first_find_time: The time when the event was first discovered.

• last_find_time: The last active time.

• threat_type_l2: Detailed threat intelligence tags, which can be family group tags, such as Mykings, or attack methods, such as SQL injection, describing the basic threat tags of this IP.

Whois

The Whois information of the IP address.

RequestId

The unique identifier that Alibaba Cloud generates for this request.

AttackPreferenceTop5

The Top 5 industry distribution of attack targets for this IP.

• event_cnt: The number of attacks.

• industry_name: The industry category of the attack.

• gmt_last_attack: The last active time of the attack.

Confidence

The confidence level in the determination result. The higher the confidence value, the more confidence in the determination result (the determination result is the ThreatLevel field). Generally, results with a confidence level greater than 90 can be considered accurate results. For malicious indicators with high threat levels, interception can be performed. For normal results (ThreatLevel equals 0), traffic can be allowed.

Value range 0-100:

• [90-100): The intelligence is considered highly reliable and can be used as a basis for interception or allowing traffic. If ThreatLevel indicates high risk (ThreatLevel=3), interception can be performed. If ThreatLevel indicates normal (ThreatLevel=0), traffic can be allowed.

• [60-90): The intelligence is considered somewhat reliable but does not reach the interception indicator. It is typically an IP address with some malicious behavior. It can be used as an auxiliary basis for security analysis operations.

• Others: The confidence level of threat-related information in the threat intelligence is considered low.

ThreatTypes

The risk tags generated by analyzing threat intelligence and security events, such as remote control, malware, etc. This parameter is a JSON string. The following table describes the fields in the JSON value:

• threat_type: The threat type.

  Common threat types

  • IDC: IDC server

  • Tor: Dark web

  • Proxy: Proxy

  • NAT: Public exit

  • Miner Pool: Mining pool

  • C&C Server: Command and control server

  • Brute Force: Brute-force attacks

  • Malicious Login: Malicious logon

  • WEB Attack: WEB attack

  • Malicious Source: Malicious download source

  • Network Service Scanning: Network service scanning

  • Exploit: Vulnerability exploits

  • Network Share Discovery: Network sharing discovery

  • Scheduled Task: Windows scheduled task

  • BITS Jobs: BITS job

  • Command-Line Interface: Malicious command

  • Mshta execution: Mshta execution

  • Regsvr32: Regsvr32 execution

  • Signed Binary Proxy Execution: Signed binary proxy execution

  • Local Job Scheduling: Linux scheduled task

  • Rundll32: Rundll32 execution

  • Web Shell: WebShell communication

  • SQL Injection: SQL injection attack

  • XSS Attack: XSS attack

• threat_type_desc: The meaning of the tag.

• risk_type: The threat level (3 high risk, 2 medium risk, 1 suspicious, 0 normal, -1 unknown).

• scenario: The applicable security scenario (attack indicator, compromise indicator).

• first_find_time: The time when the tag was first marked.

• last_find_time: The last time the tag was marked.

• attck_stage: The ATT&CK attack stage to which it belongs.

Scenario

The attack scenario applicable to this IP.

• Attack indicator: This IP actively initiates attack traffic and can be matched by security devices such as firewalls and WAF for sources that actively initiate from outside to inside, and can be intercepted according to tags.

• Compromise indicator: Scripts or malicious code planted by attackers will communicate with this IP for communication and data transmission. If this IP is found in traffic or logs, it means that the current host has been compromised.

• Information data: Types such as whitelists. This field is information data and does not have a risk scenario.

Ip

The basic information of the IP. This parameter is a JSON string. The following table describes the fields in the JSON value:

• ip: The IP address

• idc_name: The IDC server name

• isp: The Internet service provider

• country: The country

• province: The province

• city: The city

• asn: ASN (Autonomous System Numbers)

• asn_label: The ASN name

ThreatLevel

The risk level, which indicates the level of harm caused after a hit. There are five levels: high risk, medium risk, low risk, normal, and unknown. When using this field, you can combine it with the confidence level (Confidence field) to intercept data with high risk and high confidence. For normal types (i.e., whitelists), traffic can be allowed.

• -1: Unknown

• 0: Normal, i.e., whitelist, traffic can be allowed

• 1: Low risk

• 2: Medium risk

• 3: High risk

AttackCntByThreatType

The number of attacks in different attack stages. This parameter is represented as a JSON array. The following table describes the fields in the array:

• event_cnt: The number of attacks.

• threat_type: The ATT&CK stage to which the attack belongs.

Parameter

Description

Intelligences

The threat intelligence event, which is a JSON array. The elements in the array can be DDoS Trojans, mining programs, network layer intrusions, network service scans, network sharing and discovery, mining pools, exploits, dark webs, malicious logons, malicious download sources, C&C servers, web shells, and web attacks.

RequestI

The unique identifier that Alibaba Cloud generates for this request.

FileHash

The file hash value.

ThreatTypes

The risk tags and server tags that are generated by analyzing threat intelligence and security events. This parameter is represented as an array. Each array element has the following values:

• threat_type_desc: The threat type. Values include the following: Rootkit, backdoor program, suspicious program, mining program, DDoS Trojan, malware, worms, suspicious hacking tool Trojan program, contaminated basic software (implanted with malicious code), infectious virus, exploit program, ransomware, self-mutating Trojan, high-risk program, hacking tool.

• last_find_time: The most recent discovery time.

• risk_type: Indicates whether it is a malicious tag. 0 indicates a non-malicious tag, 1 indicates a malicious tag, -1 indicates unknown.

• threat_type: The threat type. The value is an array. The elements in the array can be network layer intrusions, network service scans, network sharing and discovery, mining pools, exploits, dark webs, malicious logons, malicious download sources, C&C servers, web shells, and web attacks.

Basic

The basic information. This parameter is a JSON string. The following table describes the fields in the JSON value:

• md5: The MD5 value of the file.

• sha1: The SHA1 value of the file.

• sha256: The SHA256 value of the file.

• sha512: The SHA512 value of the file.

• virus_result: The static scan result of the file. 0 indicates normal, 1 indicates malicious, -1 indicates unknown.

• sandbox_result: The dynamic sandbox running result of the file. 0 indicates normal, 1 indicates malicious, -1 indicates unknown.

• source: The source of the file. The only value is aegis, indicating that the file was detected by Security Center.

ThreatLevel

The risk level.

• -1: Unknown

• 0: Normal

• 1: Suspicious

• 2: Medium risk

• 3: High risk

Parameter

Description

Intelligences

Detailed threat intelligence events, represented as a JSON array. The following table describes the fields in the JSON value:

• source: The source of the threat intelligence data.

• first_find_time: The time when the event was first discovered.

• last_find_time: The last active time.

• threat_type_l2: Detailed threat intelligence tags, which can be family group tags such as mykings, apt32, or attack methods such as bits job, describing the method used to connect to the domain.

• threat_type: The primary tag corresponding to the detailed threat intelligence tag, which is the major categorization tag of the threat.

• refer: Related references.

Domain

The domain name.

SslCert

The SSL certificate information bound to the domain name, represented as a JSON string.

AttackPreferenceTop5

The Top 5 industries to which the attacked websites belong. This parameter is represented as a JSON array. The following table describes the fields in the JSON value:

• event_cnt: The number of attacks.

• industry_name: The industry category of the attack.

• gmt_last_attack: The last active time of the attack.

ThreatTypes

Detailed threat intelligence data related to this domain name, represented as a JSON array. The following table describes the fields in each array element:

• threat_type: The threat type.

  Common types

  • Botnet: Botnets

  • Trojan: Trojan

  • Worm: Worm

  • Malware: Malware

  • Ransomware: Ransomware

  • APT: Advanced Persistent Threat attack

  • RAT: Remote control

  • C&C Server: Command and control server

  • Miner Pool: Mining pool

  • Malicious Source: Malicious download source

  • Scheduled Task: Windows scheduled task

  • BITS Jobs: BITS job

  • Command-Line Interface: Malicious command

  • Mshta execution: Mshta execution

  • Regsvr32: Regsvr32 execution

  • Signed Binary Proxy Execution: Signed binary proxy execution

  • Local Job Scheduling: Linux scheduled task

  • Rundll32: Rundll32 execution

• threat_type_desc: The Chinese description of the tag.

• first_find_time: The time when the tag was first marked.

• last_find_time: The last time the tag was marked.

• risk_type: Indicates whether it is a malicious tag. 0 indicates a non-malicious tag, 1 indicates a low-risk tag, 2 indicates a medium-risk tag, 3 indicates a high-risk tag, -1 indicates unknown.

• scenario: The scenario to which the domain name belongs, either a compromise indicator or an attack indicator.

• attck_stage: The ATT&CK attack stage to which the malicious behavior belongs.

Confidence

The confidence level in the determination result. The higher the confidence value, the more confidence in the determination result (the determination result is the ThreatLevel field). Generally, results with a confidence level greater than 90 can be considered accurate results. For malicious indicators with high threat levels, interception can be performed. For normal results (ThreatLevel equals 0), traffic can be allowed.

Value range 60-100:

• [90-100): The intelligence is considered highly reliable and can be used as a basis for interception or allowing traffic. If ThreatLevel indicates high risk (ThreatLevel=3), interception can be performed. If ThreatLevel indicates normal (ThreatLevel=0), traffic can be allowed.

• [60-90): The intelligence is considered somewhat reliable but does not reach the interception indicator. It is typically a domain name with some malicious behavior. It can be used as an auxiliary basis for security analysis operations.

• Others: The confidence level of threat-related information in the threat intelligence is considered low.

ThreatLevel

The risk level, which indicates the level of harm caused after a hit. There are five levels of maliciousness: high risk, medium risk, low risk, normal, and unknown. When using this field, you can combine it with the confidence level (Confidence field) to intercept data with high risk and high confidence. For normal types (i.e., whitelists), traffic can be allowed.

• -1: Unknown

• 0: Normal, i.e., whitelist, traffic can be allowed

• 1: Low risk

• 2: Medium risk

• 3: High risk

AttackCntByThreatType

The number of attacks in different attack stages. This parameter is represented as a JSON array. The following table describes the fields in the array:

• event_cnt: The number of attacks.

• threat_type: The ATT&CK stage to which the attack belongs.

Whois

The Whois information of the domain name.

RequestId

The unique identifier that Alibaba Cloud generates for this request.

Scenario

The attack scenario applicable to this domain name. It can take one or more of the following values:

• Attack indicator: Domain names are typically not attack indicators.

• Compromise indicator: Scripts or malicious code planted by attackers will communicate with this domain name for communication and data transmission. If this domain name is found in traffic or logs, it means that the current host has been compromised. C2 connection outward after compromise.

• Information data: Types such as whitelists. This field is information data and does not have a risk scenario.

Basic

The basic information of the domain name. This parameter is represented in JSON format. The following table describes the fields:

• domain: The domain name

• sld_domain: The SLD domain name

• reg_date: The domain registration time

• expire_date: The domain expiration time

• child_domain_cnt: The number of subdomains

• malicious_child_domain_cnt: The number of malicious subdomains

• ip_cnt: The number of resolved IPs for this domain name in the past year

• malicious_ip_cnt: The number of resolved IPs for this domain name that are malicious IPs in the past year