Query the intelligence indicator list

Function

Query the intelligence indicator list.

Calling Method

For details, see Calling APIs.

URI

POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/search

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID.
workspace_id	Yes	String	Workspace ID

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	Token of the tenant.
content-type	Yes	String	application/json;charset=UTF-8

**Table 3** Request body parameters
Parameter	Mandatory	Type	Description
ids	No	Array of strings	List of indicator IDs.
dataclass_id	No	String	Data class ID.
condition	Yes	condition object	Search condition expression.
offset	Yes	Integer	request offset, from 0
limit	Yes	Integer	request limit size
sort_by	No	String	sort by property, create_time.
from_date	No	String	Query start time, for example, 2024-01-20T00:00:00.000Z+0800
to_date	No	String	Query end time, for example, 2024-01-26T23:59:59.999Z+0800

**Table 4** condition
Parameter	Mandatory	Type	Description
conditions	No	Array of conditions objects	Expression list.
logics	No	Array of strings	Expression logic.

**Table 5** conditions
Parameter	Mandatory	Type	Description
name	No	String	Expression name.
data	No	Array of strings	Expression content list.

Response Parameters

Status code: 200

**Table 6** Response header parameters
Parameter	Type	Description
X-request-id	String	Request ID, in the format request_uuid-timestamp-hostname.

**Table 7** Response body parameters
Parameter	Type	Description
code	String	Error code
message	String	Error Message
total	Integer	Total
data	Array of IndicatorDetail objects	List of indicators.

**Table 8** IndicatorDetail
Parameter	Type	Description
id	String	Indicator ID.
name	String	Indicator name.
data_object	IndicatorDataObjectDetail object	Indicator details
workspace_id	String	Workspace ID
project_id	String	Project ID.
dataclass_ref	DataClassRefPojo object	Data class object information.
create_time	String	Creation time.
update_time	String	Update time.

**Table 9** IndicatorDataObjectDetail
Parameter	Type	Description
indicator_type	indicator_type object	Indicator type object.
value	String	Value, for example, ip url domain.
update_time	String	Update time.
create_time	String	Creation time.
environment	environment object	Environment Info
data_source	data_source object	Data source.
first_report_time	String	First Occurred At
is_deleted	Boolean	Delete
last_report_time	String	Last occurred.
granular_marking	Integer	Confidentiality level. 1 -- First discovery; 2 -- Self-produced data; 3 -- Purchase required; and 4 -- Direct query from the external network.
name	String	Name.
id	String	Indicator ID.
project_id	String	Project ID.
revoked	Boolean	Whether to discard.
status	String	Status. The options are Open, Closed, and Revoked.
verdict	String	Threat degree. The options are Black, White, and Gray.
workspace_id	String	Workspace ID
confidence	Integer	Confidence. The value range is 80 to 100.

**Table 10** indicator_type
Parameter	Type	Description
indicator_type	String	Indicator type.
id	String	Indicator type ID.

**Table 11** environment
Parameter	Type	Description
vendor_type	String	Environment suppliers
domain_id	String	Tenant ID.
region_id	String	Region ID
project_id	String	Project ID.

**Table 12** data_source
Parameter	Type	Description
source_type	Integer	Data source type. The options are as follows-- 1- cloud product 2- Third-party product 3- Tenant product
domain_id	String	Tenant ID.
project_id	String	Project ID.
region_id	String	Region ID

**Table 13** DataClassRefPojo
Parameter	Type	Description
id	String	Data class ID.
name	String	Data class name.

Status code: 400

**Table 14** Response header parameters
Parameter	Type	Description
X-request-id	String	Request ID, in the format request_uuid-timestamp-hostname.

**Table 15** Response body parameters
Parameter	Type	Description
code	String	Error Code
message	String	Error Description

Example Requests

Query the intelligence indicator list. IDs are id1 and id2; Name is indicator name; Type is DATA_SOURCE; Data class ID is 28f61af50fc9452aa0ed5ea25c3cc3d3; Offset is 0. A maximum of 10 indicators can be included, and sorted by create_time.

{
  "ids" : [ "id1", "id2" ],
  "dataclass_id" : "28f61af50fc9452aa0ed5ea25c3cc3d3",
  "condition" : {
    "conditions" : [ {
      "name" : "name",
      "data" : [ "name", "=", "Indicator name" ]
    } ],
    "logics" : [ "name" ]
  },
  "offset" : 0,
  "limit" : 10,
  "sort_by" : "create_time",
  "from_date" : "2024-01-20T00:00:00.000Z+0800",
  "to_date" : "2024-01-26T23:59:59.999Z+0800"
}

Example Responses

Status code: 200

Response when the request is successful.

{
  "code" : "00000000",
  "data" : [ {
    "create_time" : "2023-07-24T20:54:19Z+0800",
    "data_object" : {
      "indicator_type" : {
        "indicator_type" : "ipv6",
        "id" : "ac794b2dfab9fe8c0676587301a636d3"
      },
      "revoked" : false,
      "workspace_id" : "d5baeef8-3e75-4e91-9826-fb208ac58987",
      "update_time" : "2023-07-24T20:54:19.038Z+0800",
      "project_id" : "15645222e8744afa985c93dab6341da6",
      "first_report_time" : "2023-07-31T20:54:12.000Z+0800",
      "id" : "ff61d1f8-0de4-4077-9e9b-e312f6829c6d",
      "granular_marking" : 1,
      "value" : "{}",
      "create_time" : "2023-07-24T20:54:19.038Z+0800",
      "confidence" : 80,
      "last_report_time" : "2023-07-25T20:54:15.000Z+0800",
      "data_source" : {
        "domain_id" : "ac7438b990ef4a37b741004eb45e8bf4",
        "project_id" : "15645222e8744afa985c93dab6341da6",
        "region_id" : "cn-XXX-7",
        "source_type" : 1
      },
      "environment" : {
        "domain_id" : "ac7438b990ef4a37b741004eb45e8bf4",
        "project_id" : "15645222e8744afa985c93dab6341da6",
        "region_id" : "cn-xxx-7",
        "vendor_type" : "xxx"
      },
      "verdict" : "Black",
      "name" : "test",
      "status" : "Open"
    },
    "dataclass_ref" : {
      "id" : "97ccf890-7480-31f6-a961-cf8da1f2f040",
      "name" : "name"
    },
    "id" : "ff61d1f8-0de4-4077-9e9b-e312f6829c6d",
    "update_time" : "2023-07-24T20:54:19Z+0800"
  } ],
  "message" : "",
  "total" : 2
}

Status Codes

Status Code	Description
200	Response when the request is successful.
400	Response when the request failed.

Error Codes

See Error Codes.

Parent Topic: Indicator Management

Previous topic: Indicator Management

Next topic: Creating an Indicator

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.

The system is busy. Please try again later.