THthreatconnect
Indicators

Retrieve Indicator by ID

Changed on

Returns a single Indicator corresponding to provided uniqueId

get/v3/indicators/{uniqueId}

Request

  • Base URL
    https://app.threatconnect.com/api
  • URL
    https://app.threatconnect.com/api/v3/indicators/{uniqueId}
  • Auth
    API key in header Authorization

Path parameters

uniqueId'1' | '2' | '3' required

param ID of the Indicator that needs to be fetched

ID of the Indicator to be fetched

Query parameters

fieldsstring[]

Indicator subentity fields to include in response (See OPTIONS endpoint for valid values)

countstring

Boolean that detnotes whether counts should be returned in the resultset

Response

The Indicator

idinteger
dateAddedstring date-time
ownerIdinteger
ownerNamestring
webLinkstring
typestring required
lastModifiedstring date-time
externalDateAddedstring date-time
externalLastModifiedstring date-time
externalDateExpiresstring date-time
firstSeenstring date-time
lastSeenstring date-time
ratingnumber
confidenceinteger
threatAssessRatingnumber double
threatAssessConfidencenumber double
threatAssessScoreinteger
threatAssessScoreObservedinteger
threatAssessScoreFalsePositiveinteger
calScoreinteger
calLastCheckedstring date-time
sourcestring
descriptionstring
summarystring
observationsinteger
lastObservedstring date-time
falsePositivesinteger
lastFalsePositivestring date-time
falsePositiveReportedByUserboolean
falsePositiveFlagboolean
trackedUsersobject
privateFlagboolean
activeboolean
activeLockedboolean
value1string
value2string
value3string
flag1boolean
flag2boolean
flag3boolean
intValue1integer
intValue2integer
intValue3integer
addressstring
md5string
sha1string
sha256string
sizeinteger
modestring
ipstring
hostNamestring
dnsActiveboolean
whoisActiveboolean
textstring
legacyLinkstring

Changes