Security Center:Threatbook component

Parameter

Description

Example

userId

The associated Alibaba Cloud account ID.

XXX

cloudUserId

The ThreatBook account ID. For details, see Prerequisites.

7f7c*************7fcca4

resource

The file hash for retrieving the analysis report. Supported algorithms: SHA256, SHA1, MD5.

44d88612*************1278abb02f

Parameter

Description

multiengines

Antivirus scan engine detection results. A JSON object with the following fields:

• result: detection result for each scan engine:

  No threat detected: displayed as safe.

  Threat detected: displays the specific virus label.

• scan_time: the time the multi-engine scan was performed, for example 2019-10-22 16:17:48.

summary

Summary information. A JSON object with the following fields:

• threat_level: threat level, a comprehensive assessment based on static analysis, multi-engine antivirus scans, and multi-sandbox dynamic analysis.

  • malicious: malicious

  • suspicious: suspicious

  • clean: safe

  • unknown: unknown

• malware_type: threat classification. For the complete list, see Threat classification.

• malware_family: virus family, such as Xorddos.

• is_whitelist: whether the file is on the whitelist.

  • true = whitelisted.

  • false = not whitelisted.

• submit_time: file submission time, for example 2019-01-22 17:36:21.

• file_name: file name.

• file_type: file type.

• sample_sha256: file SHA256 hash.

• md5: file MD5 hash.

• sha1: file SHA1 hash.

• scenes: scenario detection.

  • Cybercrime: cybercrime sample.

  • CS_Detect: CobaltStrike trojan sample.

  • RT_Tools: red team tool.

  • Exploit: vulnerability exploit.

  • HW202X: major security event sample, year varies.

• tag: tags. A JSON object containing:

  • s: static tags. JSON array. For common tags, .

  • x: antivirus engine detection tags.

• threat_score: numerical threat score.

• sandbox_type: the sandbox environment used for this analysis.

• sandbox_type_list: list of all sandbox environments where the sample was successfully analyzed.

• multi_engines: antivirus scan engine detection rate.

signature

Behavioral signatures. A JSON array. Each item contains:

• severity: severity level (integer, higher = more severe).

• references: references (JSON array).

• sig_class: signature classification.

• name: signature name.

• description: behavior description.

• markcount: mark count.

• marks: raw signature data (JSON array).

• families: sample families (JSON array).

• attck_id: ATT&CK ID.

• attck_info: ATT&CK details (JSON array).

static

Static information. A JSON object.

pstree

Process behavior.

network

Network behavior.

• fingerprint: fingerprint information (JSON array).

• tls: TLS protocol (JSON array).

• udp: UDP protocol (JSON array).

• dns_servers: DNS service (JSON array).

• http: HTTP protocol (JSON array).

• irc: IRC protocol (JSON array).

• smtp: SMTP protocol (JSON array).

• tcp: TCP protocol (JSON array).

• smtp_ex: extended SMTP protocol data (JSON array).

• mitm: man-in-the-middle (JSON array).

• hosts: network hosts (JSON array).

• dns: Domain Name System (JSON array).

• http_ex: extended HTTP protocol data (JSON array).

• domains: domain names (JSON array).

• dead_hosts: dead hosts (JSON array).

• icmp: ICMP protocol (JSON array).

• https_ex: extended HTTPS protocol data (JSON array).

dropped

Dropped file behavior. A JSON array. Each item contains:

• sha1: file SHA1 hash (string).

• sha256: file SHA256 hash (string).

• md5: file MD5 hash (string).

• urls: extracted URLs (JSON array).

• size: file size (integer).

• filepath: file path (string).

• name: file name (string).

• crc32: file CRC32 hash (string).

• ssdeep: file SSDeep hash (string).

• type: file type (string).

• yara: YARA results (JSON array).

strings

String-related information. A JSON object. Each item contains:

• sha256: strings extracted from the file, corresponding to static strings based on the SHA256 hash (array).

• pcap: strings extracted from network traffic (array).

permalink

URL of the web sandbox report page.

Parameter

Description

Example

userId

The associated Alibaba Cloud account ID.

XXX

cloudUserId

The ThreatBook account ID. For details, see Prerequisites.

7f7c*************7fcca4

resource

An IP address or domain name. Query up to 100 resources per batch, separated by commas.

test.com or 0.0.0.0:80

Type

Parameter

Description

ip

is_malicious

Whether the IP is malicious.

• true = malicious.

• false = not malicious.

confidence_level

Confidence level.

• high

• medium

• low

severity

Comprehensive threat severity.

• critical

• high

• medium

• low

• info (no threat)

judgments

Threat type based on the IOC's malicious attributes:

• Malicious types:

  • C2 (remote control)

  • Sinkhole C2 (C2 server sinkholed by a security organization)

  • MiningPool (miner pool)

  • CoinMiner (private miner pool)

  • Malware

• Non-malicious types:

  • Whitelist

  • Info (basic information)

tags_classes

Related threat actor or security event information. A JSON array. Each item contains:

• tags_type: tag category, such as industry, gangs (threat actor group), or virus_family.

• tags: specific threat actor or security event tags, such as APT or OceanLotus.

permalink

Intelligence details link. URL of the complete threat intelligence analysis page for the IP address or domain name.

domain

categories

• Domain name categorization. A JSON object. Each item contains:

  • first_cats: level 1 category (array)

  • second_cats: level 2 category (string)

• Other fields are the same as described for ip above.

Parameter

Description

Example

userId

The associated Alibaba Cloud account ID.

XXX

cloudUserId

The ThreatBook account ID. For details, see Prerequisites.

7f7c*************7fcca4

resource

An IP address. Query up to 100 IP addresses per batch, separated by commas.

0.0.0.0

Parameter

Description

basic

A JSON object with the following fields:

• carrier: carrier or service provider.

• location: IP location information (JSON object):

  • country: country

  • country_code: country code

  • province: province

  • city: city

  • lng: longitude

  • lat: latitude

is_malicious

Whether the IP is malicious.

• true = malicious.

• false = not malicious.

confidence_level

Confidence level determined by intelligence source and confidence model.

• low

• medium

• high

severity

Threat severity indicating the danger level of the intelligence.

• critical

• high

• medium

• low

• info (no threat)

judgments

Comprehensive threat type extracted from threat intelligence analysis (JSON array).

• Malicious types:

  • Spam

  • Zombie (compromised computer)

  • Scanner

  • Exploit (vulnerability exploit)

  • Botnet

  • Brute Force (brute-force attack)

• Non-malicious types:

  • Whitelist

  • Info (basic information)

tags_classes

Related threat actor or security event information. A JSON array. Each item contains:

• tags_type: tag category, such as industry, gangs (threat actor group), or virus_family.

• tags: specific threat actor or security event tags, such as Mirai.

asn

ASN information. A JSON object containing:

• number: ASN number.

• info: AS name.

• rank: risk value (0 to 4, higher = higher risk).

update_time

Last update time of the intelligence.

scene

Application scenario, such as leased line or data center.

feature

Asset features. A JSON array. Each item contains:

• category: classification.

• tag_name: specific asset feature tag.

• tag_desc: tag description.

entity

Attributed entity. A JSON array. Each item contains:

• category: level 1 classification.

• type: level 2 classification.

• tag_name: specific entity tag.

• tag_desc: tag description.

hist_behavior

Attack behavior history. A JSON array. Each item contains:

• category: classification.

• tag_name: specific attack behavior tag.

• tag_desc: tag description.

• vuln_id: specific vulnerability ID when category is "Vulnerability Exploit".

evaluation

Impact assessment. A JSON object containing:

• active: activity level.

  • high

  • medium

  • low

• honeypot_hit: whether captured by a honeypot.

  • true = captured by a honeypot.

  • false = not captured.

fraud

Fraudulent behavior. A JSON array. Each item contains:

• tag_name: specific fraud behavior tag.

• tag_desc: tag description.

permalink

URL of the intelligence query result page for the IP address.