Method: legacy.legacySearchEnterpriseWideIoCs

string

Required. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}

object (Interval)

Required. Time range [start, end) in which matched to be queried. UI/FE is expected to pass in NOW as end.

integer

Required. How many matches to return, maximum. All matches will be sorted by default by most recently seen IoC ingestion time OR first seen in enterprise time and the most recent items returned as shown in the mocks. If we need to support other sorting schemes, we can add another field later.

boolean

Required. Indicates if mandiant attributes should be added to the ioc response.

string

ID of the entity.

object (FieldAndValue)

Field path or type with value to identify entity.

{
  "artifact_indicator": {
    object (ArtifactIndicator)
  },
  "id": string,
  "sources": [
    string
  ],
  "categories": [
    string
  ],
  "confidence_score": integer,
  "confidence_bucket": string,
  "asset_indicators": [
    {
      object (AssetIndicator)
    }
  ],
  "empty_asset_list_reason_code": enum (EmptyAssetListReasonCode),
  "ioc_ingest_timestamp": string,
  "first_seen_timestamp": string,
  "last_seen_timestamp": string,
  "filter_properties": {
    object (FilterProperties)
  },
  "raw_severity": string,
  "ioc_state": enum (IocState),
  "priority": enum (Priority),
  "association_identifier": [
    {
      object (AssociationIdentity)
    }
  ],
  "campaigns": [
    string
  ],
  "global_source_id": string,
  "log_type": enum (LogType),
  "global_customer_id": string,
  "confidence_score_bucket": {
    object (IntRange)
  },
  "ip_and_ports": {
    object (IpAndPorts)
  },
  "categorization": string,
  "domain_and_ports": {
    object (DomainAndPorts)
  },
  "active_timerange": {
    object (Interval)
  },
  "link": {
    object (Link)
  },
  "feed_name": string,
  "description": string
}

object (ArtifactIndicator)

Artifact that was found in the customer environment.

string

Entity ID as a string for pivoting

string

IoC feed sources.

string

IoC threat categories.

integer

IoC confidence score. It is not a repeated field because it is used for V2 feeds, where sources and categories are restricted to a cardnality of 1 as well.

string

IoC confidence score, bucketed into e.g. low/medium/high.

object (AssetIndicator)

We will limit the number of assets to the first N (e.g., N=20) found.

enum (EmptyAssetListReasonCode)

When asset_indicators is empty, this field should be set.

string (Timestamp format)

Timestamp when the IoC was first received from ANY feed. This is the earliest timestamp of receipt by Malachite, given that the artifact might have been sent in multiple feeds at different times.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

string (Timestamp format)

Timestamp when the IoC was first seen in the enterprise.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

string (Timestamp format)

Timestamp when the IoC was last seen in the enterprise.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

object (FilterProperties)

Properties of this match, used for filtering in the client.

string

The indicator's raw severity.

enum (IocState)

The current state of IoC. default state is MATCHED.

enum (Priority)

The priority of the ioc match.

object (AssociationIdentity)

Associated actors and malware.

string

List of campaigns this IoC was observed.

string

Global source ID this IoC is part of. This would only be populated if the indicator is coming from a global source.

enum (LogType)

The log type of the IoC source.

string (bytes format)

Global source ID this IoC is part of. This would only be populated if the indicator is coming from a global source.

A base64-encoded string.

object (IntRange)

Confidence score bucket

object (IpAndPorts)

IP address indicator.

string

The category/type of this indicator. Ex: "Spyware", "Bitcoin_Related", etc.

object (DomainAndPorts)

Domain indicator.

object (Interval)

The time range in which this indicator has been "active". The start or end time (or both) may be empty, indicating an open-ended time interval.

object (Link)

optional. This will usually be a link to the Feed's definition.

string

Original feed this indicator originated from.

string

Raw description of the IoC.

{
  "name": string,
  "region_code": {
    object (Location)
  },
  "association_type": enum (AssociationType),
  "association_id": string
}

string

object (Location)

enum (AssociationType)

string