Introduction - Intel APIv3
Need keys? Email your Intel Enablement Manager or FireEye Technical Support
Need a subscription? Contact FireEye Intel product sales
For Threat Intel Partner integrations start here: Partners
Welcome to the documentation for FireEye Threat Intelligence API (Intel API).
If you have a valid subscription for the Intel API and need API keys, please email technical support or contact your Intelligence Enablement Manager and ask for APIv3 keys.
The Intel API can provide machine-to-machine integration with FireEye's contextually rich threat intelligence. The Intel API provides automated access to indicators of compromise (IOCs) — IP addresses, domain names, URLs threat actors are using, via the indicators endpoint, allows access to full length finished intelligence in the reports endpoint, allows for notificaiton of threats to brand and keyword monitoring via the alerts endpoint, and finally allows searching for intelligence on the adversary with the search endpoint that will further enrich customer knowledge.
The Intel API is based upon the OASIS Structured Threat Information Expression (STIX™) version 2.1 industry standard. STIX defines a language for expressing cyber threat and observable information for exchange in a simple and scalable manner via a RESTful API and set of resource definitions. For additional information on STIX start here: STIX Introduction
For a STIX deep dive into the STIX v2.1 standard please see the STIX 2.1 specification.
For technical support or issues: FireEye Support Information, you can additionally email FireEye Support at support@fireeye.com.
Intel API base url ->
https://api.intelligence.fireeye.comIntel API token url ->
https://api.intelligence.fireeye.com/token
If you need to inquire about product access or would like a demonstration of FireEye's Threat Intelligence, get in touch with our outstanding sales team.
For FireEye terms of service information see here: Terms of Service
Intel APIv3 Endpoints
There are currently six endpoints on APIv3, some of these are collections and some are endpoints to interact with the API such as search and permissions.
| Endpoint | Endpoint URL | Description | Is_collection? |
|---|---|---|---|
| Collections | https://api.intelligence.fireeye.com/collections |
Description and technical data for collections | No |
| Permissions | https://api.intelligence.fireeye.com/permissions |
An endpoint to show customer permissions / organization keys | No |
| Reports | https://api.intelligence.fireeye.com/collections/reports |
STIX 2.1, HTML and PDF finished intelligence reports | Yes |
| Indicators | https://api.intelligence.fireeye.com/collections/indicators |
STIX 2.1 indicators & observables | Yes |
| Alerts | https://api.intelligence.fireeye.com/collections/alerts |
Digital Threat Monitoring alerts | Yes |
| Search | https://api.intelligence.fireeye.com/collections/search |
Threat Intelligence search endpoint | No |
Authentication
To authorize, use this code:
curl https://api.intelligence.fireeye.com/token \
-u publickey:privatekey -d "grant_type=client_credentials"
import requests
import json
from requests.auth import HTTPBasicAuth
APIv3_key='publickey'
APIv3_secret='privatekey'
API_URL = 'https://api.intelligence.fireeye.com/token'
headers = {
'grant_type': 'client_credentials'
}
r = requests.post(API_URL, auth=HTTPBasicAuth(APIv3_key, APIv3_secret), data=headers)
data = r.json()
auth_token = data.get('access_token')
print('Token request API response: %s' % r.status_code)
print('Authorization Token: %s' % auth_token)
require "uri"
require "net/http"
url = URI("https://api.intelligence.fireeye.com/token")
https = Net::HTTP.new(url.host, url.port);
https.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/x-www-form-urlencoded"
request.body = "grant_type=client_credentials"
response = https.request(request)
puts response.read_body
FireEye's Intel API uses the OAuth 2.0 Authorization Framework, with the client credentials grant to access API endpoints. Use the public key and private key client credentials to authenticate and receive a time-limited access token. This is accomplished by making a POST request to the Intel API /token endpoint, using HTTP Basic Authentication, as described in Section 4.4 of RFC 6749.
If successful, the API responds with a JSON body containing the access_token, the token_type, and the expiration time expressed in seconds. Unless the token has been revoked, it may be used until it expires (generally 12 hours), at which point the client must authenticate to receive a new token.
Successful token API response:
{
"access_token": "15d1814233c9e742342338576d39543c38c434b76f70f60041a81d0769fe2c42",
"token_type": "bearer",
"expires_in": 43200
}
Development Quick Starts
Intel API base url ->
https://api.intelligence.fireeye.com
- Obtain your Intel API Keys: Contact your Intel Enablement Manager or FireEye Technical Support to obtain Intel APIv3 keys.
Intel API token url ->
https://api.intelligence.fireeye.com/token
- Get a token from the Intel API: To make your first API call to the Intel API, you must first authenticate with your APIv3 credentials at the Intel API token URL. For authentication details: Intel API Authentication
curl --location --request GET 'https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899' \
--header 'Accept: application/vnd.oasis.stix+json; version=2.1' \
--header 'X-App-Name: '' \
--header 'Authorization: Bearer {Your OAuth2.0 token here}'
import requests
url = "https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899"
payload = {}
headers = {
'Accept': 'application/vnd.oasis.stix+json; version=2.1',
'X-App-Name': '',
'Authorization': 'Bearer {Your OAuth2 token here}'
}
response = requests.request("GET", url, headers=headers, data = payload)
print(response.text.encode('utf8'))
require "uri"
require "net/http"
url = URI("https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899")
https = Net::HTTP.new(url.host, url.port);
https.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = "application/vnd.oasis.stix+json; version=2.1"
request["X-App-Name"] = " "
request["Authorization"] = "Bearer {Your OAuth2 token here}"
response = https.request(request)
puts response.read_body
For more information on the X-App-Name requirement, see the section under Core Concepts
Make an API call to the permissions endpoint: This endpoint returns licensing, rate limit, and daily quota information of the calling organization.
Read the pagination section for the Intel API to understand how to set the length of objects returned and identify how to page the response.
Read the collections section to understand which Intel API endpoint provides what.
Read the query parameters for each collection for filtering of the Intel API endpoints so users can make more effective and precise API calls.
Core Concepts
Typical API Interaction
End-users typically interact with the Intel API by obtaining a token from the token endpoint, and then using a filter to grab intel from a specific endpoint. One example of this would be retrieving indicators in the last 24 hours by using the added_after filter with the indicators endpoint. Doing so retrieves a bundle of STIX 2.1 indicators in a paged API response that can then be parsed using open source tools. For more information, please see STIX2 Python Docs or cti-stix2-python.
For an end-user populating a threat intelligence platform, the user should look to consume both the indicators collection endpoint and the reports collection endpoint, providing both the indicator relationships, and the report context relationships.
X-App-Name
The FireEye Intel API uses the header variable X-App-Name for customers and partners to set a user-agent on all of their API calls. This mandatory field is typically a combination of the customer or partners organization name, its application name, and its version. A typical customer X-App-Name would be 'indicators.script.xyzcompany.v1.0' or similar. The X-App-Name for customers should, at a minimum, have the calling organization name and, for partners, it is required to have the company product name and version of the integration for troubleshooting purposes.
The X-App-Name variable is not required when calling the token endpoint, but it is required when calling all other API endpoints.
curl --location --request GET 'https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899' \
--header 'Accept: application/vnd.oasis.stix+json; version=2.1' \
--header 'X-App-Name: '' \
--header 'Authorization: Bearer {Your OAuth2.0 token here}'
import requests
url = "https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899"
payload = {}
headers = {
'Accept': 'application/vnd.oasis.stix+json; version=2.1',
'X-App-Name': '',
'Authorization': 'Bearer {Your OAuth2 token here}'
}
response = requests.request("GET", url, headers=headers, data = payload)
print(response.text.encode('utf8'))
require "uri"
require "net/http"
url = URI("https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899")
https = Net::HTTP.new(url.host, url.port);
https.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = "application/vnd.oasis.stix+json; version=2.1"
request["X-App-Name"] = " "
request["Authorization"] = "Bearer {Your OAuth2 token here}"
response = https.request(request)
puts response.read_body
Request Headers
curl https://api.intelligence.fireeye.com/token \
-u publickey:privatekey -d "grant_type=client_credentials"
import requests
import json
from requests.auth import HTTPBasicAuth
APIv3_key='publickey'
APIv3_secret='privatekey'
API_URL = 'https://api.intelligence.fireeye.com/token'
headers = {
'grant_type': 'client_credentials'
}
r = requests.post(API_URL, auth=HTTPBasicAuth(APIv3_key, APIv3_secret), data=headers)
data = r.json()
auth_token = data.get('access_token')
print('Token request API response: %s' % r.status_code)
print('Authorization Token: %s' % auth_token)
require "uri"
require "net/http"
url = URI("https://api.intelligence.fireeye.com/token")
https = Net::HTTP.new(url.host, url.port);
https.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/x-www-form-urlencoded"
request.body = "grant_type=client_credentials"
response = https.request(request)
puts response.read_body
Token Endpoint Headers
GET https://api.intelligence.fireeye.com/token
| Header Key | Header Value | Required |
|---|---|---|
| grant_type | client_credentials | Yes |
General endpoint headers
| Header Key | Header Value | Required |
|---|---|---|
| Accept | application/vnd.oasis.stix+json; version=2.1 | Yes |
| X-App-Name | {your app name here} | Yes |
| Authorization | Bearer {your received token here} | Yes |
Rate Limiting
By default, the Intel APIv3 is rate limited to 50,000 queries per day, and 1000 queries per second. The Intel API's design is such that it is far more preferable for end-users to download the required reports, indicators, and alerts daily than to implement a system where the customer's tools do a one item remote API lookup. The better use case would be to use a query to download a page of indicators, use a couple of queries to grab all the pages in the last 24 hours, and then do a local lookup.
Length
curl -X GET https://api.intellience.fireeye.com/collections/indicators/objects??added_after=1580764458&length=1000 \
-H 'Accept: application/stix+json; version=2.1'
-H 'Authorization: Bearer {Your OAuth2 token here}'
import requests
url = "https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1580764458&length=1000"
payload = {}
headers = {
'Accept': 'application/stix+json; version=2.1',
'X-App-Name': '',
'Authorization': 'Bearer {Your OAuth2 token here}'
}
response = requests.request("GET", url, headers=headers, data = payload)
print(response.text.encode('utf8'))
require "uri"
require "net/http"
url = URI("https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1573491899&length=1000")
https = Net::HTTP.new(url.host, url.port);
https.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Accept"] = "application/vnd.oasis.stix+json; version=2.1"
request["X-App-Name"] = " "
request["Authorization"] = "Bearer {Your OAuth2 token here}"
response = https.request(request)
puts response.read_body
To avoid rate limiting issues, users can widen the limit / length parameter in API queries to ensure that, per query, the end-user can receive the maximum amount of data.
Length is a single integer value that indicates the maximum number of objects that the client would like to receive in a single response. If not specified, the default value is 50 and a maximum bvalue of 1000. If the value of length is set to more than 1000, then only 1000 records will be returned.
| API Query | Description |
|---|---|
https://api.intelligence.fireeye.com/collections/alerts/objects?added_after=1580600436&length=1000 |
Query the alerts collection for new objects from Feb 1, 2020 and return 1000 objects in the response. |
Pagination - Collections
while(True):
r = requests.get(queryURL, headers=headers)
if r.status_code == 204:
logging.info('API Status Code: {0} No Content Available for this timeframe.'.format(r.status_code))
break
if r.status_code !=200:
logging.error('API Status Code: {0} Error Reason: {1}'.format(r.status_code, r.text))
break
if r.status_code == 200:
(parse successfull API response...)
try:
queryURL = r.links['next']['url']
except KeyError:
break
The FireEye Intelligence API supports pagination of large result sets on endpoints. These endpoints return results sorted in ascending order by the date they were added to the collection. The server may limit the number of responses in response to a query, either as the result of a server-specified limit or in response to a length query query parameter passed by the client as part of a query. The length parameter can be used to specify the number of objects to be returned in a single page, with the maximum allowed set to length=1000 for the indicator collection, and a maximum of length=100 on the alerts and reports collection.
If more objects are available, either because the client requested that they be limited via the length parameter or the API limited the response, the response header will contain an HTTP Link entity.
The HTTP Link entity-header provides a URL to the next page for results. The link to get the next set of data is set in the response header in the "Link" field. The URL before "rel=next" represented the next set of data, and the URL before "rel=first" will return the first page of data.
In the URL, lastidmodified_timestamp is NOT the exact epoch timestamp and is a base64-encoded string the internal server uses for pagination.
The table below represents a sample output from the response header for the original call to the indicators collection using the added_after query parameter. Since this call represents more than one page of information, the Link response header is returned along with the ['next']['url'] showing the end-user what to call next.
| KEY | VALUE |
|---|---|
Content-Type |
application/stix+json; version=2.1 |
Content-Length |
881399 |
Connection |
keep-alive |
Date |
Mon, 10 Feb 2020 21:44:30 GMT |
x-amzn-RequestId |
b3769082-a4f9-4796-8922-dbb50afb61c9 |
x-amz-apigw-id |
Hs06CGLPoAMFliQ= |
Link |
<https://api.intelligence.fireeye.com/collections/indicators/objects?length=1000&last_id_modified_timestamp=MTU4MDgwOTIxOTcyODY0NixpbmRpY2F0b3ItLTA5MWI3OWQxLTllOWQtNWExYS04ODMzLTZlNTkyZmNjMmM1NQ%3D%3D&added_after=1580764458>; rel=next, <https://api.intelligence.fireeye.com/collections/indicators/objects?length=1000&added_after=1580764458>; rel=first |
X-Amzn-Trace-Id |
Root=1-5e41cea6-ef2d4440f5b33f60f43c5ac0;Sampled=0 |
X-Cache |
Miss from cloudfront |
Via |
1.1 56d3604ac04bb426a5e942749eccab1a.cloudfront.net (CloudFront) |
X-Amz-Cf-Pop |
LAX3-C4 |
X-Amz-Cf-Id |
Fd_tjsEX4MgOrrwIZFMUA67h9NHPxj-GfZRnLsN9N5JWkxtFhJg3FA== |
Pagination - Search
{
"queries": [
{
"type":"report",
"query": "x_fireeye_com_metadata.report_type = 'malware'" }
],
"limit": 50,
"offset": 50,
"sort_by":"name",
"sort_order":"asc"
}
See Limit and Offset in the search query to the right. The limit maximum integer value can be 50, the offset goes by 50 (starting with zero initially), until the user receives a 204 response from the API, and they have successfully paged through the API response.
The main idea here and in reviewing the code is that limit is always 50, offset begins at 0, and with each successful API call receiving a 200 response, you add the limit + offset to provide the new offset, and go back through the loop. This code has only basic error checking and the user will very likely require much more heavy error checking in their production code.
limit = 50
offset = 0
try:
while True:
payload = '''{
"queries": [
{ "type": "%s" }
],
"sort_by": "name",
"sort_order": "asc",
"limit" : %d,
"offset" : %d
} ''' %(requestType,limit,offset)
r = requests.post(url, data=payload, headers=headers)
if r.status_code != 200:
raise Exception(r.text)
if r.status_code == 200:
(parse the request...)
offset = limit + offset
Collections
The Intel API is designed around the concept of "collections." A collection provides an interface to a logical repository of Cyber Threat Intelligence data that is organized as sets of specific data that are targeted to address specific areas, such as indicators of compromise, reports, threat actors, malware, and others. The objects that comprise a specific collection may also appear in another collection, allowing the consumer to pivot from a collection with minimal details about an object, such as a threat actor, to another collection that contains more details without forcing consumers of a specific collection to deal with more detailed information.
The Intel API currently provides a number of collections and is designed to allow new collections to be added without disrupting existing consumers. Each collection is assigned a unique identifier (UUID) and an alias name, either of which can be used when performing queries in the API.
A consumer can programmatically obtain a list of the current collections that contain a title, short description, the assigned unique identifier, alias, and an indication of whether they are able to access or update the contents of a collection. Below is a list of the current collections available in the API along with brief descriptions of each.
Indicators Collection
{
"media_types": [
"application/vnd.oasis.stix+json; version=2.1",
"application/stix+json",
"application/stix+json; version=2.1",
"application/vnd.oasis.stix+json"
],
"description": "This collection holds indicators, the corresponding observables used in detection, and attribution",
"alias": "f5c927fa-4a5c-490a-ac83-31f64ddb4443",
"title": "Indicators",
"can_read": true,
"can_write": false,
"id": "indicators"
}
The Indicators Collection allows consumers to retrieve indicators that can be used in detection that have been attributed without the requirement to traverse through a report in order to obtain the indicators. The Indicators are expressed as a pattern that allows the characteristics that enable the detection of the presence of something within a cyber environment. Indicators are detective in nature and are for specifying particular conditions that may exist to indicate the presents of a particular TTP along with relevant contextual information. Indicators are not used to characterize the particulars of any given adversary behavior, only how to detect it. The detection aspects of an indicator allow for the specification of a pattern by which to indicate the presence of something.
| Collection Identifier | Alias Name |
|---|---|
| f5c927fa-4a5c-490a-ac83-31f64ddb4443 | indicators |
Get Indicators
This endpoint retrieves indicators from the Intel API.
NOTE: Response format is STIX2.1, see media_types object to the right.
HTTP Request
https://api.intelligence.fireeye.com/collections/indicators/objects
Headers
See the general request-headers for the required headers.
SAMPLE INDICATORS OUTPUT:
{
"spec_version": "2.1",
"objects": [
{
"id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"type": "marking-definition",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"definition": {
"tlp": "amber"
}
},
{
"external_references": [
{
"source_name": "fireeye-intel",
"external_id": "18-00010024",
"description": "FLUXXY Malware Overview"
},
{
"source_name": "fireeye-intel",
"external_id": "18-00011411",
"description": "Fluxxy Malware Profile"
}
],
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
"id": "malware--552dfe3c-9179-57fb-97a0-b672b77c9cb9",
"name": "fluxxy",
"type": "malware",
"created": "2018-10-02T23:32:17.000Z",
"modified": "2020-02-04T09:35:14.000Z",
"malware_types": [
"unknown"
],
"is_family": true,
"labels": [
"fastflux-bot",
"unknown"
],
"revoked": false,
"spec_version": "2.1"
},
{
"object_marking_refs": [],
"id": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"name": "The MITRE Corporation",
"type": "identity",
"created": "2017-06-01T00:00:00.000Z",
"modified": "2017-06-01T00:00:00.000Z",
"revoked": false,
"identity_class": "organization",
"lang": "en",
"spec_version": "2.1"
},
{
"id": "marking-definition--f88d31f6-486f-44da-b317-01333bde0b82",
"type": "marking-definition",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"definition": {
"tlp": "amber"
}
},
{
"id": "relationship--ddbd0913-aa55-524e-9cd7-bc3346f4122b",
"source_ref": "indicator--93537359-68bf-5920-b474-97efdfb4eb39",
"target_ref": "malware--552dfe3c-9179-57fb-97a0-b672b77c9cb9",
"type": "relationship",
"created": "2020-02-04T09:35:14.000Z",
"modified": "2020-02-04T09:35:14.000Z",
"revoked": false,
"relationship_type": "indicates",
"spec_version": "2.1"
},
{
"x_fireeye_com_metadata": {
"subscriptions": [
"fusion"
]
},
"indicator_types": [
"malicious-activity"
],
"pattern_type": "stix",
"object_marking_refs": [
"marking-tlp--f88d31f6-486f-44da-b317-01333bde0b82"
],
"id": "indicator--93537359-68bf-5920-b474-97efdfb4eb39",
"type": "indicator",
"created": "2020-02-04T09:35:14.000Z",
"modified": "2020-02-04T09:35:14.000Z",
"revoked": false,
"valid_from": "2020-02-04T09:35:14.000Z",
"confidence": 90,
"pattern": "[domain-name:value='b.bidomrfrog.org']",
"labels": [
"malicious-activity"
],
"valid_until": "2020-02-11T09:35:15.000Z",
"spec_version": "2.1"
},
{
"id": "marking-definition--63ffe2ce-a941-42cf-923b-7c2d1286b657",
"type": "marking-definition",
"created": "2019-05-08T20:30:00.000Z",
"created_by_ref": "identity--93607fcf-a0cc-472f-bcc6-92082f856b37",
"definition_type": "statement",
"spec_version": "2.1",
"definition": {
"statement": "Copyright 2019, FireEye, Inc. All rights reserved."
}
},
{
"object_marking_refs": [
"marking-definition--63ffe2ce-a941-42cf-923b-7c2d1286b657"
],
"id": "identity--93607fcf-a0cc-472f-bcc6-92082f856b37",
"name": "FireEye, Inc.",
"type": "identity",
"created": "2019-05-08T20:30:00.000Z",
"modified": "2019-05-08T20:30:00.000Z",
"identity_class": "organization",
"spec_version": "2.1"
}
],
"id": "bundle--c0b6a21f-27e8-45dd-8f9d-85648bc95f42",
"type": "bundle"
}
Indicator Query Parameters
| Parameter | Valid | Description |
|---|---|---|
| added_after | integer | An epoch timestamp that filters objects to only include those added to the collection after the specified timestamp. If no added_after URL query parameter is provided, the API returns the oldest objects matching the request first. |
| length | integer | Length: specifies the maximum number of objects to include in a page. If not specified, the default value is 50. Maximum value is 1000. |
| match.id | STIX UUID | ID: this is the STIX ID of the alert object the user would like to receive. |
| match.status | active, revoked | filters on whether the indicator is in an active state or has been revoked. |
Sample API Call with parameters
| API Query | Description |
|---|---|
https://api.intelligence.fireeye.com/collections/indicators/objects?added_after=1580600436&length=1000 |
Query the indicators collection for new objects from Feb 1, 2020 and return 1000 objects in the response. |
STIX 2.1 Indicators Object
Image Credit - OASIS CTI TC 2020
Reports Collection
{
"media_types": [
"application/vnd.oasis.stix+json; version=2.1",
"application/stix+json",
"application/stix+json; version=2.1",
"application/vnd.oasis.stix+json",
"application/pdf",
"text/html"
],
"description": "This collection holds reports, the corresponding observables used in detection, and attribution",
"alias": "a7ee60d2-f8d5-4f75-b8fc-886e5a478b95",
"title": "Reports",
"can_read": true,
"can_write": false,
"id": "reports"
}
The Reports Collection allows consumers to retrieve finished intelligence reports (FINTEL) in a machine-readable format that can be directly inserted into another system. In addition to supporting a machine-readable format, the Reports Collection allows users to retrieve a Report in HTML format so it can be viewed in a web browser, as well as a PDF file useful for offline human-consumption.
| Collection Identifier | Alias Name |
|---|---|
| a7ee60d2-f8d5-4f75-b8fc-886e5a478b95 | reports |
Get Reports
This endpoint retrieves finished intelligence reports from the Intel API.
NOTE: Response formats are STIX2.1, PDF, and HTML, see media_types object to the right.
HTTP Request
https://api.intelligence.fireeye.com/collections/reports/objects
Headers
See the general request-headers for the required headers.
SAMPLE REPORT OUTPUT:
{
"id": "bundle--1ced526a-6c63-40b5-8a63-f11ebffef349",
"type": "bundle",
"objects": [
{
"type": "report",
"spec_version": "2.1",
"id": "report--b8d51df0-c292-53fa-86c7-fd50b27089ef",
"created_by_ref": "identity--93607fcf-a0cc-572f-bcc6-92082f856b37",
"created": "2019-03-07T22:06:46.993Z",
"modified": "2019-03-07T22:07:20.973Z",
"name": "Title - d63e74bf 79718c50313d05a2-1551996406",
"description": "Overview 32cf81c8 62058946c0b4b9bb",
"report_types": [ "threat-report" ],
"published": "2019-03-07T22:07:20.972Z",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
"x_fireeye_com_additional_description_sections": {
"analysis": [
"Analysis 6588be26 ff899819d7d71267"
],
"key_points": [
"Key Points 26d5ce20 5f33fb7bdc206b4a"
]
},
"object_refs": [
"relationship--cd1fa28b-ff23-53bd-8375-887efabecba3",
"relationship--60128523-d01c-5b31-9047-b39fcdaf7642",
"relationship--b4d545c9-557f-5842-9b08-0670b5e30b86",
"relationship--a1e8f651-ee6c-5b63-841e-fae621b033d7",
"x-fireeye-com-url--267f7633-f503-58f0-8189-9669c4388ac9",
"relationship--83479639-2b33-54d4-ae92-43191bdc4b42",
"relationship--fb7948f2-56d0-5c31-b817-488278ea786b",
"x-fireeye-com-domain-name--718e7095-2568-5234-83b6-d6e4ff8a38bd",
"relationship--f333c380-3758-5280-a270-485255786a31",
"relationship--bc587c58-50ad-54f6-8a5d-13d0e4c8c0c2",
"x-fireeye-com-socket-addr--e65095dc-81a2-5bbf-9418-192dc806c3cc",
"relationship--be07f23f-33a1-5f40-a4f8-bdb5c0088679",
"relationship--b9783779-059a-582f-8c6e-2b07ce8dc077",
"x-fireeye-com-email-message--a867827d-9c13-5970-9496-1927ce9d9361",
"x-fireeye-com-file--dd42f582-65db-50c1-9828-fb2c8344da22",
"indicator--7c8b0f77-912a-5157-a38f-5a2affb03328",
"x-fireeye-com-network-traffic--51d3d3bb-f2a8-47b3-830b-956fa578420b",
"malware--4bfa8fe6-2b58-5f53-85bf-3b4c3b15508a",
"threat-actor--1f59bb93-105c-51d8-8a3c-42dc3385638a",
"indicator--778ff5fe-535c-51ef-81ed-387e957d58ad",
"indicator--da678751-8012-517a-9107-ebd41db31e85",
"relationship--f0cd5cbe-f89d-55a1-8571-ae214c278028",
"relationship--c259307a-9855-5710-96f1-342500c5ab44",
"indicator--3521c406-47d8-567f-aae1-fb1c75fef0f8",
"relationship--71f88376-644c-5aed-8e58-8456f8771607",
"relationship--6e2572c6-fe7e-56f3-9ac0-2ce20dc94258",
"x-fireeye-com-ipv4-addr--5b84ac6a-0b2e-5a17-ab2d-c56f392d88dd",
"relationship--13b8994c-689e-5a9e-846d-211ef2d9014c",
"relationship--806b8e4a-6d41-58ed-bd5d-21d4f33478cb",
"x-fireeye-com-windows-registry-key--bf8aa637-e474-5ede-ac6e-2ccfedb4eecb",
"x-fireeye-com-whois--683946bf-6c4b-579e-b455-601b4f0e72d7",
"relationship--cb5e390a-7e54-5a25-bc7b-aed8218a71d7",
"relationship--6a87e2fc-a803-5ae8-8b0a-6fda68889518",
"relationship--2a8f70c9-2364-531f-b4a6-6c40cbf6f933",
"relationship--0d9fbca5-ee76-5467-a846-a25cfd7b2d0a",
"relationship--fddf9f27-05c3-59ab-9f03-bf9bb53a0e86",
"relationship--38886d24-2e0e-5398-9990-7f0154427127",
"relationship--53db6133-b823-5ad4-861b-a99169a00938",
"relationship--ec0c58af-32c2-5b3d-be3f-e8fe60cb0562",
"relationship--f0f5cc78-3ef1-531b-94d1-6000d1a088f8",
"x-fireeye-com-autonomous-system--e116fedf-9ade-5899-9a71-a51d38a60ca9",
"relationship--1bc5e0e6-c2e0-563e-8eaa-0fb3af1a4ad8",
"relationship--ab7be335-b210-5fb6-bf16-1b14f6f3b95a",
"x-fireeye-com-ipv4-netmask--cae8efc7-08a5-5e67-b648-8d2f3db51ecc",
"relationship--d62ba347-bf25-5b48-9e9c-0ede1069de23"
],
"x_fireeye_com_tracking_info": {
"document_version": "1.0",
"current_release_date": "2019-03-07T22:07:20.972Z",
"document_id": "19-00014859",
},
"x_fireeye_com_metadata": {
"product_type": [
"Intelligence Report"
],
"subscriptions": [
"operational"
"cyber-espionage"
]
}
}
]
}
Report Query Parameters
| Parameter | Valid | Description |
|---|---|---|
| added_after | integer | An epoch timestamp that filters objects to only include those added to the collection after the specified timestamp. If no added_after URL query parameter is provided, the API returns the oldest objects matching the request first. |
| length | integer | Length: specifies the maximum number of objects to include in a page. If not specified, the default value is 50. Maximum value for reports is 100. |
| match.report_id | STIX UUID | ID: this is the STIX ID of the alert object the user would like to receive, example: report--5e55ad2e-803e-54b0-94d7-2b5bc2aac4a0. |
| match.document_id | report# | filters this endpoint to a single report using the reportID, example: 20-00000710 |
| match.status | active, revoked | filters on whether the reports is active or has been revoked. |
| match.subscription | cyber-crime, cyber-espionage, hacktivism, cyber-physical, strategic, fusion, operational, vulnerability, standard | filters on a specific subscription of reports either ThreatScape or role based intel. |
| match.report_type | reportType | filter on a reportType, for multiple report types use |
| match.actor_name | actorName | filters the report results down to a specific actor, to return all matching reports for that actor. NEW |
| match.malware_name | malwareFamily | filters the report results down to a specific malware family, to return all matching reports for that malware family. NEW |
Sample API Call with parameters
| API Query | Description |
|---|---|
https://api.intelligence.fireeye.com/collections/reports/objects?added_after=1580600436&length=100 |
Query the reports collection for new objects from Feb 1, 2020 and return 1000 objects in the response. |
https://api.intelligence.fireeye.com/collections/reports/objects?match.actor_name=apt28&length=100 |
Query the reports collection for reports related to APT28 and return 1000 objects in the response. |
STIX2.1 Report object
Image Credit - OASIS CTI TC 2020
Alerts Collection
{
"media_types": [
"application/stix+json",
"application/stix+json; version=2.1",
"application/vnd.oasis.stix+json",
"application/vnd.oasis.stix+json; version=2.1"
],
"description": "This collection contains alerts, the corresponding objects referenced in the alerts",
"alias": "dd861d9b-6163-4880-94c8-8db35484eb0e",
"title": "Alerts",
"can_read": true,
"can_write": false,
"id": "alerts"
}
FireEye's Digital Threat Monitoring (DTM) Alerts Collection allows consumers to retrieve various types of DTM alerts in a machine-readable format that can be directly inserted into another system (e.g., a SIEM) and used to provide rules to detect malicious activity as well as entities using a technology-agnostic pattern language.
| Collection Identifier | Alias Name |
|---|---|
| dd861d9b-6163-4880-94c8-8db35484eb0e | alerts |
Get Alerts
This endpoint retrieves DTM alerts from the Intel API.
NOTE: Response format is STIX2.1, see media_types object to the right.
HTTP Request
https://api.intelligence.fireeye.com/collections/alerts/objects
Headers
See the general request-headers for the required headers.
SAMPLE ALERTS OUTPUT:
{
"spec_version": "2.1",
"objects": [
{
"id": "x-fireeye-com-alert--a51ad835-3847-414f-8a2a-************",
"type": "x-fireeye-com-alert",
"alert_type": "document_analysis",
"name": "alert",
"status": "new",
"alert_context": [
"x-fireeye-com-finding--85e055be-8627-4c54-9afe-************",
"x-fireeye-com-analysis--2a245dee-0d20-5294-b55c-************",
"file--4245b407-f15d-4b41-9b51-************",
"artifact--ca65f6bc-42f5-453a-b2cc-************"
],
"prerequisite_conditions": [
"x-fireeye-com-selector--93808525-c6b7-441c-a5c8-************"
],
"object_refs": [
"identity--dede2837-d7be-59f0-9fd7-************"
],
"action_nature": "tasking-conditional",
"description": "Text '{customer set keyword}' mentioned in OOXML Workbook document",
"created": "2019-08-17T17:40:45.000Z",
"modified": "2019-08-17T17:40:45.000Z",
"alert_severity": {
"severity_score": 80
},
"spec_version": "2.1"
},
{
"id": "marking-definition--63ffe2ce-a941-42cf-923b-7c2d1286b657",
"type": "marking-definition",
"created": "2019-05-08T20:30:00.000Z",
"created_by_ref": "identity--93607fcf-a0cc-472f-bcc6-92082f856b37",
"definition_type": "statement",
"definition": {
"statement": "Copyright 2019, FireEye, Inc. All rights reserved."
},
"spec_version": "2.1"
},
{
"id": "identity--93607fcf-a0cc-472f-bcc6-92082f856b37",
"name": "FireEye, Inc.",
"type": "identity",
"identity_class": "organization",
"created": "2019-05-08T20:30:00.000Z",
"modified": "2019-05-08T20:30:00.000Z",
"object_marking_refs": [
"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82"
],
"spec_version": "2.1"
}
],
"id": "bundle--ba4f0e23-2b27-4167-bbd1-ff1dda82febb",
"type": "bundle"
}
Alert Query Parameters
| Parameter | Valid | Description |
|---|---|---|
| added_after | integer | An epoch timestamp that filters objects to only include those added to the collection after the specified timestamp. If no added_after URL query parameter is provided, the API returns the oldest objects matching the request first. |
| length | integer | Length: specifies the maximum number of objects to include in a page. If not specified, the default value is 50. Maximum value is 100. |
| match.alert_type | forum_post, tweet, web_content_publish, paste, email_analysis, domain_discovery, document_analysis | Alert type: this filters down to the alert's source. |
| match.alert_categories | social-media, forums, documents, malware-repository, network-indicators, web-content, paste-sites | Alert category: this allow end-users to filter down to a specific category of alerts. |
| match.alert_status | new, new_requested, investigated, under_investigation, closed, closed_investigated | Alert status: filter for the alert's status. |
| match.id | STIX UUID | ID: this is the STIX ID of the alert object the user wants to receive. |
| match.alert_severity | low, medium, high, critical | Alert severity: filters down to the alert severity the user wants to receive. |
Sample API Call with parameters
| API Query | Description |
|---|---|
https://api.intelligence.fireeye.com/collections/alerts/objects?added_after=1580600436&length=100 |
Query the alerts collection for new objects from Feb 1, 2020, and return 1000 objects in the response. |
The APIv3 sample output to the right is a single STIX2.1 object delivered in a json bundle with a marking definition and a declared identity for FireEye using the "spec_version": "2.1", meaning this is STIX2.1 formatted output.
Search
This API endpoint allows customers to search all collections for objects of interest. Customers can also query all objects in all collections, which provides them with a large response. Customers can also choose to filter searches on the support object type listed below for objects such as a threat-actor, report, ipv4-addr, URL, vulnerability, and others.
{
"media_types": [
"application/stix+json",
"application/stix+json; version=2.1",
"application/vnd.oasis.stix+json",
"application/vnd.oasis.stix+json; version=2.1"
],
"description": "This endpoint supports searches across all collections.",
"alias": "g7ee60d2-f8d5-4f75-b8fc-886e5a478b96",
"title": "Search",
"can_read": true,
"can_write": false,
"id": "search"
}
| Endpoint Identifier | Alias Name |
|---|---|
| g7ee60d2-f8d5-4f75-b8fc-886e5a478b96 | search |
POST Search
This endpoint supports searches across all collections.
HTTP Request
https://api.intelligence.fireeye.com/collections/search
Description: This endpoint is used to search data in Intelligence API. The fields of the request body are described below.
Headers
See the general request-headers for the required headers.
Search Template
This is the full json search template for use in searching against the Intel API. Not all of these components are required, see the template break down for a description of the required fields.
{
"queries": [
{
"type":"<support object type>",
"query":"<query expression on properties>"
}
],
"include_connected_objects":"<true|false>",
"connected_objects": [
{
"connection_type":"reference",
"connected_type":"<source or target>",
"object_type":"<supported object type>",
"property":"objects"
},
{
"connection_type":"relationship",
"connected_type":"<source or target>",
"object_type":"<supported object type>",
"relationship_type":"<relationship_type>"
}
],
"sort_by":"<supported property>",
"sort_order":"<asc|desc>"
}```
Search Template Break Down
{
"queries": [
{
"type":"<support object type>",
"query":"<query expression on properties>"
}
- queries
Description: Queries is the list of Query Objects. Each query object includes the type and query properties:
- type: The type specifies the object to search.
Below are all allowed support object type values for use with search, which are actually object_refs:
"object_refs":
{
"artifact"
"domain-name"
"email-addr"
"email-message"
"file"
"identity"
"indicator"
"ipv4-addr"
"location"
"malware"
"report"
"threat-actor"
"url"
"vulnerability"
"windows-registry-key"
"x-fireeye-com-cpe"
"x-fireeye-com-exploit"
"x-fireeye-com-exploitation"
}
- query: A query contains a Query Search Expression. Multiple query search expressions are joined by boolean AND or OR operators. Query search expressions consist of three parts: Property Path, a Comparison Operator, and an Operand.
Comparision Operators are : =, !=, >, <, >=, <=, IN, LIKE, CONTAINS_ANY, CONTAINS_ALL, TEXT_MATCHES
Date: Allowed date format is- '%Y-%m-%dT%H:%M:%S.%fZ'. The date value should be specified in single quotes (e.g., created='2016-10-20T17:39:05.101Z').
],
"include_connected_objects":"<true|false>",
- include_connected_objects:
Required: False
Type: Boolean
Default Value: false
Description: Indicates whether objects connected to matching objects, through a reference or relationship, will be included in the search result.
"connected_objects": [
{
"connection_type":"reference",
"connected_type":"<source or target>",
"object_type":"<supported object type>",
"property":"objects"
},
{
"connection_type":"relationship",
"connected_type":"<source or target>",
"object_type":"<supported object type>",
"relationship_type":"<relationship_type>"
}
],
- connected_objects
Required: False
Type: List of connection
Default Value: -
Description: Lists all connections, which all contain following fields:
a. connection_type: Value of connection_type can be one of the following:
reference: The connected object should either be referenced from the matching object or reference the matching object.
relationship: The connected object should be related to the matching object via a Relationship where the matching object is the source or the target. If it is not specified, both types are returned.
b. connected_type: connected_type value can be one of the following:
source: Returns the connected object that is the connection source. If connection_type is reference, the matching object is the target of the reference and will therefore return the source object that is referenced by matching object. If connection_type is relationship, the matching object is the target of the relationship and will return the object that is the source of the relationship, and the relationship object itself.
target: Returns the connected object that is the connection target. if connection_type is reference, the matching object is the source of the reference and will therefore return the target object that is referenced by the matching object. If connection_type is relationship, the matching object is the source of the relationship and will therefore return the object that is the target of the relationship, and the relationship object itself.
c. object_type: Object type returns the connected_objects of type specified in the object_type field.
If result_type contains "connected_objects,"the resulting connections are restricted only to those connections that match one of the connection objects in this list. If result_type contains "connected_objects" and this list is empty or the field is not present, all connections will be returned.
d. property: property is used when connection_type is "reference." When connected_type is "source," this field returns the connected objects that reference the matching objects via the given property. When connected_type is "target," this field returns the connected objects that are referenced by matching object via the given property.
If this field is not specified, it matches any property by which the reference exists. This field is ignored when connection_type is relationship.
e. relationship_type: This field is used when connection_type is relationship. This field returns only the related objects that are involved in relationships of the specified relationship_type.
If not specified, all relationship_types are considered for matching. This field is ignored when connection_type is reference.
"sort_by":"<supported property>",
"sort_order":"<asc|desc>"
}
sort_by
Required: False
Type: string
Default Value: -
Description: sort-by specifies the property of the object on which results are to be sorted. sort_by is applicable only when the include_connected_object flag is set to false.sort_order
Required: False
Type: string
Default Value: -
Description: This field specifies the direction of sort. Sort order can be set to "asc" (ascending) or "desc" (descending). If the sort order is not specified, it will default to ascending. Note that the sort_order is only applicable when the include_connected_object flag is set to false.
Search Examples
Report types containing malware
{
"queries": [
{
"type":"report",
"query": "x_fireeye_com_metadata.report_type = 'malware'" }
],
"limit": 50,
"offset": 50,
"sort_by":"name",
"sort_order":"asc"
}
This query will return both report_types for Malware Profile and Malware Overview reports in search. This value of malware is NOT applicable for the report collection filter.
Actor with a name LIKE APT27
{
"queries": [
{
"type": "threat-actor",
"query" : "name LIKE '%APT27%'"}
],
"include_connected_objects": true,
"connected_objects" : [
{"connection_type" : "relationship"},
{"connection_type" : "reference"}]
}
This query will search for a threat-actor using name LIKE APT27. Note the single ticks and the % signs around the term apt27, and return all relationships for that actor.
Actor with name equals APT27
{
"queries": [
{
"type": "threat-actor",
"query" : "name = 'APT27'"}
],
"include_connected_objects": true,
"connected_objects" : [
{"connection_type" : "relationship"},
{"connection_type" : "reference"}]
}
This query will search for a threat-actor whose name is exactly APT27, and return all relationships for that actor.
IPv4 equals
{
"queries": [
{
"type": "ipv4-addr",
"query": "value = '164.132.67.216'"
}
],
"include_connected_objects": true
}
This query will search for an IPv4 address of exactly 164.132.67.216.
Object ref search
{ "queries": [
{
"type": "report",
"query" : "object_refs = 'x-fireeye-com-exploit--e358f41a-2e2b-56f2-88ae-68d9c77c59ba'"
}
],
"include_connected_objects": true
}
This query will search for the details for x-fireeye-com-exploit--e358f41a-2e2b-56f2-88ae-68d9c77c59ba and return the connected objects.
Location actor search
{
"queries":[
{ "type": "location" , "query" : "country = 'ir'" }
],
"include_connected_objects": true,
"connected_objects" : [
{
"connection_type" : "relationship",
"object_type" : "threat-actor"
}
]
}
Stage one of a location search, give me all actors from this region (Iran), returns actorID's plus other meta-data that can be used in another detailed search.
Actor IOC Search
{
"queries": [
{ "type": "threat-actor" ,"query" :"id IN ('threat-actor--e9e0b284-572e-57bd-925b-71fabf9e8a65','threat-actor--90ecd6c1-abb7-5137-9160-e68f29239a3f','threat-actor--ce850ca5-61cf-53cb-9b17-2e4396b4c3a2','threat-actor--a09f768d-7733-5e01-a42e-d2f356dbca10','threat-actor--1c3be4c1-fd7f-530e-9275-e4350f557591','threat-actor--30d897ea-3c4f-5a63-be30-cd6ab8313f5f','threat-actor--02e6e376-e6ec-5a74-9a03-233f4fbaad2d','threat-actor--b617ea48-6569-54b7-8015-0291b4b66ede','threat-actor--5f57586d-8a5c-5c48-adbb-9c01ed079c8a') AND modified > '2019-04-01T00:00:00.000Z' " }
],
"include_connected_objects": true,
"connected_objects" : [
{
"connection_type" : "relationship",
"object_type" : "domain-name"
}
]
}
Stage two of the location search, the actorID's below were returned from the location actor search, and then using the query "id IN" with the threat-actor-ID's, the end-user is able to retrieve all domains associated with the specified actors location (example includes a time period search as well).
Field Definitions
The field definitions page is designed to provide a maximum amount of detail available for these items. Under searchable properties object, is a list of the object_ref's and their individual elements that may provide help when searching for intel via the API.
Please provide feedback to intel-integrations [AT] fireeye.com.
{
"reportTypes": [
"Actor Overview",
"Actor Profile",
"Country Profile",
"Credit Card Shop Report",
"Event Coverage/Implication",
"Executive Perspective",
"FireEye Labs Research",
"Horizons",
"ICS Security Roundup",
"Industry Intelligence Quarterly",
"Industry Reporting",
"Malicious Activity Report",
"Malware Overview",
"Malware Profile",
"Malware Quarterly Industry Report",
"Net Assessment",
"Network Activity Reports",
"Operational Net-Assessment",
"TTP Deep Dive",
"Tactical Threat Report",
"Targeted Malware Lures",
"Threat Activity Alert",
"Threat Activity Report",
"Trends and Forecasting",
"Vulnerability",
"Vulnerability Report",
"Weekly Vulnerability Exploitation Report"
],
"threatScape": [
"fusion",
"operational",
"strategic",
"vulnerability",
"cyber-espionage",
"cyber-crime",
"cyber-physical",
"hacktivisim",
"standard"
],
"relationship_type": [
"affects",
"associated-with",
"attributed-to",
"characterized-by",
"contained_within",
"has-characteristic",
"indicates",
"located-at",
"member-of",
"modifies",
"related-to",
"resolves-to",
"source-geography",
"targeted-geography",
"targets",
"undefined",
"used-by",
"used_against",
"uses"
],
"object_refs": {
"artifact": "yes",
"attack-pattern": "no",
"autonomous-system": "no",
"campaign": "no",
"course-of-action": "no",
"domain-name": "yes",
"email-addr": "yes",
"email-message": "yes",
"file": "yes",
"identity": "yes",
"indicator": "yes",
"infrastructure": "no",
"intel-note": "no",
"intrusion-set": "no",
"ipv4-addr": "yes",
"kill-chain-phase": "no",
"location": "yes",
"malware": "yes",
"network-traffic": "no",
"remedy-action": "no",
"report": "yes",
"socket-addr": "no",
"software": "no",
"tactic": "no",
"threat-actor": "yes",
"tool": "no",
"url": "yes",
"vulnerability": "yes",
"weakness": "no",
"whois": "no",
"windows-registry-key": "yes",
"x-fireeye-com-cpe": "yes",
"x-fireeye-com-exploit": "no",
"x-fireeye-com-exploitation": "yes"
},
"searchable_properties": {
"artifact": [
"id",
"created",
"modified",
"hashes.MD5",
"hashes.SHA-1",
"hashes.SHA-256"
],
"domain-name": [
"id",
"value",
"created",
"modified"
],
"email-addr": [
"id",
"value",
"created",
"modified",
"display_name"
],
"email-message": [
"id",
"value",
"created",
"modified",
"display_name"
],
"file": [
"id",
"name",
"ctime",
"mtime",
"hashes.MD5",
"hashes.SHA-1",
"hashes.SHA-256"
],
"identity": [
"id",
"name",
"labels",
"created",
"modified",
"description",
"identity_class",
"industry_sectors"
],
"indicator": [
"id",
"name",
"created",
"modified",
"valid_from",
"valid_until",
"confidence",
"description",
"pattern",
"labels"
],
"ipv4-addr": [
"id",
"value",
"created",
"modified"
],
"location": [
"id",
"created",
"modified",
"country"
],
"malware": [
"id",
"name",
"labels",
"created",
"modified",
"aliases",
"is_family",
"description",
"os_execution_envs"
],
"report": [
"id",
"name",
"labels",
"created",
"modified",
"published",
"object_refs",
"description",
"x_fireeye_com_tracking_info.document_id",
"x_fireeye_com_metadata.report_type",
"x_fireeye_com_metadata.affected_it_systems",
"x_fireeye_com_metadata.risk_rating",
"x_fireeye_com_exploitation_rating",
"x_fireeye_com_metadata.intended_effect",
"x_fireeye_com_additional_description_sections.analysis",
"x_fireeye_com_metadata.target_geographies",
"x_fireeye_com_metadata.affected_industries",
"x_fireeye_com_additional_description_sections.key_points",
"x_fireeye_com_metadata.targeted_information",
"x_fireeye_com_metadata.motivation",
"x_fireeye_com_metadata.subscriptions",
"x_fireeye_com_metadata.source_geographies",
"x_fireeye_com_risk_rating_justification",
"x_fireeye_com_metadata.affected_ot_systems"
],
"threat-actor": [
"id",
"name",
"aliases",
"created",
"labels",
"modified",
"description",
"primary_motivation",
"secondary_motivations",
"sophistication",
"x_fireeye_com_intended_effect",
"x_fireeye_com_planning_and_operational_support"
],
"url": [
"id",
"created",
"modified",
"value"
],
"vulnerability": [
"id",
"name",
"created",
"modified",
"x_fireeye_com_identifier.value",
"x_fireeye_com_identifier.naming_authority"
],
"windows-registry-key": [
"id",
"hive",
"created",
"modified"
],
"x-fireeye-com-cpe": [
"id",
"created",
"modified",
"product",
"name_fs",
"name_uri",
"vendor_name"
],
"x-fireeye-com-exploit": [
"id",
"name",
"created",
"modified",
"disclosure_date",
"exploit_artifacts",
"exploit_type"
],
"x-fireeye-com-exploitation": [
"id",
"name",
"created",
"modified",
"object_refs"
],
"x-fireeye-com-weakness": [
"id",
"name",
"created",
"modified",
"description",
"formatted_identifier"
]
}
}```
Response Status Codes
| Error Code | Meaning | Reason |
|---|---|---|
| 200 | Everything worked correctly | We gave you data! |
| 204 | Everything worked correctly | No data provided! |
| 400 | Bad Request -- Your request is invalid. | |
| 401 | Unauthorized -- Your account is expired or the dates are wrong. | |
| 403 | Forbidden -- User is not authorized to access this resource with an explicit deny. | Your token was rejected. |
| 500 | Internal Server Error -- We had a problem with our application server, please let us know. | |
| 502 | Gateway Error -- We had a problem with our gateway server, please let us know. | |
| 504 | Gateway Error -- We had a problem with our gateway server, please let us know. |