THthreatconnect
Indicators

Retrieve Indicators

Changed on

Returns a list of all Indicators

get/v3/indicators

Request

  • Base URL
    https://app.threatconnect.com/api
  • URL
    https://app.threatconnect.com/api/v3/indicators
  • Auth
    API key in header Authorization

Query parameters

tqlstring

TQL query string for filtering response list

fieldsstring[]

Indicator subentity fields to include in response (See OPTIONS endpoint for valid values)

countstring

Boolean that detnotes whether counts should be returned in the resultset

sortingstring

Sorting order for resultset

Response

The Indicators

idinteger
dateAddedstring date-time
ownerIdinteger
ownerNamestring
webLinkstring
typestring required
lastModifiedstring date-time
externalDateAddedstring date-time
externalLastModifiedstring date-time
externalDateExpiresstring date-time
firstSeenstring date-time
lastSeenstring date-time
ratingnumber
confidenceinteger
threatAssessRatingnumber double
threatAssessConfidencenumber double
threatAssessScoreinteger
threatAssessScoreObservedinteger
threatAssessScoreFalsePositiveinteger
calScoreinteger
calLastCheckedstring date-time
sourcestring
descriptionstring
summarystring
observationsinteger
lastObservedstring date-time
falsePositivesinteger
lastFalsePositivestring date-time
falsePositiveReportedByUserboolean
falsePositiveFlagboolean
trackedUsersobject
privateFlagboolean
activeboolean
activeLockedboolean
value1string
value2string
value3string
flag1boolean
flag2boolean
flag3boolean
intValue1integer
intValue2integer
intValue3integer
addressstring
md5string
sha1string
sha256string
sizeinteger
modestring
ipstring
hostNamestring
dnsActiveboolean
whoisActiveboolean
textstring
legacyLinkstring

Changes