Querying Details About a Threat Indicator

Function

This API is used to query the details about a threat indicator.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/{indicator_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
project_id	Yes	String	Project ID.
workspace_id	Yes	String	Workspace ID.
indicator_id	Yes	String	Threat indicator ID.

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token.
content-type	Yes	String	application/json;charset=UTF-8

Response Parameters

Status code: 200

**Table 3** Response header parameters
Parameter	Type	Description
X-request-id	String	Request ID. Format: request_uuid-timestamp-hostname.

**Table 4** Response body parameters
Parameter	Type	Description
code	String	Error code.
message	String	Error message.
data	IndicatorDetail object	Indicator details.

**Table 5** IndicatorDetail
Parameter	Type	Description
id	String	Threat indicator ID.
name	String	Threat indicator name.
data_object	IndicatorDataObjectDetail object	Indicator details.
workspace_id	String	Workspace ID.
project_id	String	Project ID.
dataclass_ref	DataClassRefPojo object	Data class object information.
create_time	String	Creation time.
update_time	String	Update time.

**Table 6** IndicatorDataObjectDetail
Parameter	Type	Description
indicator_type	indicator_type object	Indicator type object.
value	String	Value, for example, ip, url, and domain.
update_time	String	Update time.
create_time	String	Creation time.
environment	environment object	Environment information.
data_source	data_source object	Data source information.
first_report_time	String	First occurrence time.
is_deleted	Boolean	Whether to delete.
last_report_time	String	Last occurrence time.
granular_marking	Integer	Granularity (confidentiality level). 1: First discovery; 2: Self-produced data; 3: Purchase required; and 4: Direct query from the external network.
name	String	Name.
id	String	Threat indicator ID.
project_id	String	Project ID.
revoked	Boolean	Whether to discard.
status	String	Status. The options are Open, Closed, and Revoked.
verdict	String	Threat degree. The options are Black, White, and Gray.
workspace_id	String	Workspace ID.
confidence	Integer	Confidence. Value range: 80 to 100.

**Table 7** indicator_type
Parameter	Type	Description
indicator_type	String	Indicator type.
id	String	Indicator type ID.

**Table 8** environment
Parameter	Type	Description
vendor_type	String	Environment provider.
domain_id	String	Account ID.
region_id	String	Region ID.
project_id	String	Project ID.

**Table 9** data_source
Parameter	Type	Description
source_type	Integer	Data source type. The value can be 1, 2, or 3. 1: Huawei Cloud product; 2: Third-party products, and 3: Your in-house products.
domain_id	String	Account ID.
project_id	String	Project ID.
region_id	String	Region ID.

**Table 10** DataClassRefPojo
Parameter	Type	Description
id	String	Data class ID.
name	String	Data class name.

Status code: 400

**Table 11** Response header parameters
Parameter	Type	Description
X-request-id	String	Request ID. Format: request_uuid-timestamp-hostname.

**Table 12** Response body parameters
Parameter	Type	Description
code	String	Error code.
message	String	Error description.

Example Requests

None

Example Responses

Status code: 200

Response to a successful request.

{
  "code" : 0,
  "message" : "Error message",
  "data" : {
    "id" : "28f61af50fc9452aa0ed5ea25c3cc3d3",
    "name" : "Indicator name.",
    "data_object" : {
      "indicator_type" : {
        "indicator_type" : "ipv6",
        "id" : "ac794b2dfab9fe8c0676587301a636d3"
      },
      "value" : "ip",
      "data_source" : {
        "domain_id" : "ac7438b990ef4a37b741004eb45e8bf4",
        "project_id" : "5b8bb3c888db498f9eeaf1023f7ba597",
        "region_id" : "xxx",
        "source_type" : 1
      },
      "workspace_id" : "909494e3-558e-46b6-a9eb-07a8e18ca620",
      "project_id" : "909494e3-558e-46b6-a9eb-07a8e18ca62f",
      "granular_marking" : 1,
      "first_report_time" : "2023-07-04T16:47:01Z+0800",
      "status" : "Open"
    },
    "dataclass_ref" : {
      "id" : "28f61af50fc9452aa0ed5ea25c3cc3d3",
      "name" : "Name."
    },
    "create_time" : "2021-01-30T23:00:00Z+0800",
    "update_time" : "2021-01-30T23:00:00Z+0800"
  }
}