Threat intelligence report events represent structured threat intelligence publications ingested from external providers such as AlienVault OTX, CrowdStrike Falcon Intelligence, and STIX/TAXII feeds. Available for third-party ingested data only.
Lists the latest version of each recent threat intelligence report.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| sort timestamp desc
Counts unique threat intelligence reports by provider and product.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| summarize {reports = count()}, by: {event.provider, product.name}| sort reports desc
Lists the latest threat intelligence reports that include CVE observables.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| filter arraySize(threat.observables.cves) > 0| fields timestamp, threat.report.id, threat.report.name, threat.observables.cves, event.provider| sort timestamp desc
A threat intelligence report event represents a structured threat intelligence publication—such as an AlienVault OTX pulse, a CrowdStrike Falcon Intelligence malware analysis report, or a STIX 2.1 report object from a TAXII feed—ingested from an external threat intelligence platform. One event per publication. Fields cover the report's identity and provenance (threat.report.), adversary context (actor, targeting, malware, ATT&CK), and extracted indicators of compromise (threat.observables.).
Lists the latest version of each recent threat intelligence report event.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| sort timestamp desc
Counts unique latest threat intelligence reports by provider and product.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| summarize {reports = count()}, by: {event.provider, product.name}| sort reports desc
Lists the latest version of recent threat intelligence reports that include CVE observables.
fetch security.events| filter event.type == "THREAT_REPORT"| dedup {threat.report.id}, sort: {timestamp desc}| filter arraySize(threat.observables.cves) > 0| fields timestamp, threat.report.id, threat.report.name, threat.observables.cves, event.provider, product.name| sort timestamp desc
Fields that must be present on every threat intelligence report event.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.kind | string | stable Display name: Event kindDescribes the general nature of the event. Must be set to SECURITY_EVENT for threat intelligence report events. Tags: permission | SECURITY_EVENT |
event.name | string | stable Display name: Event nameThe human readable display name of an event type. | Threat report event |
event.provider | string | stable Display name: Event providerName of the threat intelligence platform or feed that is the original source of this report. Tags: permission | AlienVault; CrowdStrike; FireEye |
event.type | string | stable Display name: Event typeDiscriminator for the event schema within SECURITY_EVENT. Must be set to THREAT_REPORT for threat intelligence report events. Tags: permission | THREAT_REPORT |
product.name | string | experimental Name of the product that emitted the data 1 | AlienVault OTX; Falcon Intelligence; FireEye TAXII Feed |
product.vendor | string | experimental Organization that owns or distributes the source system that produced the data 2 | LevelBlue; CrowdStrike; FireEye |
threat.report.description | string | experimental Summary or abstract of the threat intelligence report. Producers should truncate to 2 KB to stay within Grail field size limits; full content belongs in a linked document referenced via threat.report.references.urls. | Threat actors have compromised several @antv-scoped packages on npm... |
threat.report.id | string | experimental Vendor-assigned unique identifier for this threat intelligence report. Stable across report updates; use to correlate modified versions of the same report. Format varies by provider (for example, opaque ID string, base64, STIX report– UUID). | 6a0c1b289f4fe8b7bdf00a84; YWdhdXNsMjYwNjE0; report--f2b63e80-b523-4747-a069-35c002c690db |
threat.report.name | string | experimental Human-readable title of the threat intelligence report as provided by the source platform. May be a vendor reference code (for example, "CSA-260614") or a descriptive title. | Active Supply Chain Attack Compromises Packages on npm; CSA-260614 |
threat.report.time.created | timestamp | experimental Timestamp when the report was first created by the source platform. | 2026-05-19T08:11:20.341Z; 2026-04-12T06:45:00Z; 1747642280341000000 |
threat.report.time.updated | timestamp | experimental Timestamp of the most recent modification to the report. Useful for detecting updated intelligence on the same report ID. | 2026-05-19T17:46:10.861Z; 2026-04-14T11:20:00Z; 1747684370861000000 |
Required when using product.* fields. Use the official product name as marketed by the vendor. Should be specific enough to identify the product uniquely within a vendor.
Required when using product.* fields. Identifies the top-level vendor regardless of how the data was ingested. For open-source projects, use the primary commercial distributor or sponsoring organization (for example, "Red Hat" for OpenShift, "Google" for GKE). For Dynatrace-produced data, use "Dynatrace".
Fields that should be populated when the source platform provides the data. These fields enable threat actor attribution, targeting analysis, and MITRE ATT&CK correlation.
| Attribute | Type | Description | Examples |
|---|---|---|---|
threat.actor.names | string[] | experimental Names of the threat actors attributed to the activity described in this report. Each entry may represent either a distinct co-attributed actor (e.g. two groups acting together) or an alternative name (alias) used for the same actor across different vendors or intelligence sources. Use the names as provided by the source platform. Omit when attribution is not provided or is explicitly uncertain. | ['SCATTERED SPIDER']; ['BITWISE SPIDER']; ['Leek Likho']; ['Cozy Bear', 'APT29', 'Midnight Blizzard'] |
threat.attack.subtechnique.ids | string[] | experimental MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003") | ['T1059.003']; ['T1059.003', 'T1078.002'] |
threat.attack.subtechnique.names | string[] | experimental Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Windows Command Shell']; ['Windows Command Shell', 'Domain Accounts'] |
threat.attack.tactic.ids | string[] | experimental MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002") | ['TA0002']; ['TA0002', 'TA0004'] |
threat.attack.tactic.names | string[] | experimental Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Execution']; ['Execution', 'Privilege Escalation'] |
threat.attack.technique.ids | string[] | experimental MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059") | ['T1059']; ['T1059', 'T1078'] |
threat.attack.technique.names | string[] | experimental Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base. | ['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts'] |
threat.attack.version | string | experimental Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix. | 14.1; 15.1; 16.0 |
threat.malware.families | string[] | experimental Names of the malware families observed or attributed in this report. Use the canonical family name as provided by the source platform. Omit when no malware family information is available. | ['LockBit 3.0']; ['ALPHV', 'BlackCat']; ['Poison Ivy', 'PIVY Variant'] |
threat.target.countries.iso_codes | string[] | experimental ISO 3166-1 alpha-2 codes of the countries targeted by the adversary activity. Uses the same two-letter country code representation as geo.country.iso_code, the platform-wide standard for country geography, so threat targeting can be correlated with geo-enriched data and rendered on maps without name normalization. Complements threat.target.countries.names (full English country names); the two arrays are independent and need not align positionally—either may be populated without the other. Omit when targeting information is not available. | ['US']; ['DE', 'JP']; ['US', 'GB'] |
threat.target.countries.names | string[] | experimental Names of the countries targeted by the adversary activity. Use the full English country name as provided by the source platform. Omit when targeting information is not available. It is recommended to normalize country values to ISO 3166 standard names; non-standard values may not be processed correctly by consumers of this field. | ['United States of America']; ['Germany', 'Japan']; ['United States of America', 'United Kingdom of Great Britain and Northern Ireland'] |
threat.target.industries | string[] | experimental Names of the industry verticals targeted by the adversary activity. Use the sector name as provided by the source platform. Omit when targeting information is not available. | ['Technology']; ['Manufacturing']; ['Financial Services', 'Healthcare'] |
Optional fields for threat intelligence report events. Observable fields should be populated when the source platform provides indicator data.
| Attribute | Type | Description | Examples |
|---|---|---|---|
threat.observables.cves | string[] | experimental CVE identifiers for vulnerabilities exploited or referenced in this report. Must use the canonical CVE-YYYY-NNNNN format. Deduplicate before ingestion. | ['CVE-2024-1234']; ['CVE-2012-0158', 'CVE-2013-0422', 'CVE-2013-1347'] |
threat.observables.domains | string[] | experimental Domain names observed as indicators of compromise. Includes fully-qualified domain names (FQDNs) and bare domain names. Deduplicate before ingestion. | ['t.m-kosche.com']; ['evil.example.com', 'rdp-relay.backup-vault.eu'] |
threat.observables.emails | string[] | experimental Email addresses observed as indicators of compromise (for example, attacker C2 contact addresses or phishing sender addresses). Deduplicate before ingestion. | ['c2@evil.com'] |
threat.observables.hashes.md5 | string[] | experimental MD5 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion. | ['d41d8cd98f00b204e9800998ecf8427e']; ['1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d'] |
threat.observables.hashes.sha1 | string[] | experimental SHA-1 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion. | ['1916faa365f2788b6e193514872d51a242876569']; ['da39a3ee5e6b4b0d3255bfef95601890afd80709'] |
threat.observables.hashes.sha256 | string[] | experimental SHA-256 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion. | ['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']; ['c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2'] |
threat.observables.ips | ipAddress[] | experimental IPv4 and IPv6 addresses observed as indicators of compromise in this report. Include both IPv4 dotted-decimal and IPv6 colon-hex representations as provided by the source. Deduplicate before ingestion. | ['1.2.3.4', '91.208.52.149']; ['219.76.208.163', '113.10.246.30'] |
threat.observables.urls | string[] | experimental Full URLs observed as indicators of compromise. Includes scheme, host, port, and path as provided by the source platform. Deduplicate before ingestion. | ['https://t.m-kosche.com:443/api/public/otel/v1/traces'] |
threat.report.author | string | experimental Name of the author or team that published the report. Omit when not provided by the source platform. | AlienVault; CrowdStrike Intelligence Team; FireEye, Inc. |
threat.report.references.urls | string[] | experimental External URLs referenced by or linking to the full report. May include the report's own URL on the source platform, blog posts, advisories, or research papers that underpin the report. | ['https://socket.dev/blog/antv-packages-compromised']; ['https://falcon.crowdstrike.com/intelligence/reports/CSA-260614'] |
threat.report.tags | string[] | experimental Free-form classification tags assigned to the report by the source platform. Useful for filtering and grouping reports by topic. Omit when not provided by the source platform. | ['supply chain attack', 'npm', 'credential theft']; ['ransomware', 'lockbit', 'rdp'] |
Required fields that should be automatically added during ingest via OpenPipeline.
| Attribute | Type | Description | Examples |
|---|---|---|---|
event.id | string | stable Display name: Event IDIn combination with timestamp, this field uniquely identifies a specific event. | 1669863368163_07755297913417681159 |
timestamp | timestamp | stable Display name: TimestampTime (UNIX Epoch time in nanoseconds) when the event was ingested. | 1649822520123123123 |
A threat report covering a supply chain attack on npm packages, demonstrating report metadata, ATT&CK sub-technique classification, and URL/hostname/hash observables from a pulse-based threat intelligence feed.
{"event.kind": "SECURITY_EVENT","event.type": "THREAT_REPORT","event.name": "Threat report event","event.provider": "AlienVault","product.vendor": "LevelBlue","product.name": "AlienVault OTX","threat.report.id": "6a0c1b289f4fe8b7bdf00a84","threat.report.name": "Active Supply Chain Attack Compromises Packages on npm","threat.report.description": "Threat actors have compromised several @antv-scoped packages on npm, injecting credential-stealing code that exfiltrates data to a remote endpoint via OpenTelemetry traces.","threat.report.author": "AlienVault","threat.report.time.created": "2026-05-19T08:11:20.341Z","threat.report.time.updated": "2026-05-19T17:46:10.861Z","threat.report.references.urls": ["https://socket.dev/blog/antv-packages-compromised"],"threat.report.tags": ["supply chain attack", "npm", "credential theft"],"threat.target.countries": ["United States"],"threat.target.industries": ["Technology"],"threat.attack.technique.ids": ["T1059", "T1552"],"threat.attack.technique.names": ["Command and Scripting Interpreter", "Unsecured Credentials"],"threat.attack.subtechnique.ids": ["T1059.007", "T1552.005"],"threat.observables.domains": ["t.m-kosche.com"],"threat.observables.urls": ["https://t.m-kosche.com:443/api/public/otel/v1/traces"],"threat.observables.hashes.sha1": ["1916faa365f2788b6e193514872d51a242876569"]}
A malware analysis report covering LockBit 3.0 distributed via RDP brute-force, demonstrating actor attribution, malware families, ATT&CK tactic classification, and multi-type hash observables.
{"event.kind": "SECURITY_EVENT","event.type": "THREAT_REPORT","event.name": "Threat report event","event.provider": "CrowdStrike","product.vendor": "CrowdStrike","product.name": "Falcon Intelligence","threat.report.id": "bWFsd2FyZTI1MDQxMg==","threat.report.name": "MMA-250412","threat.report.description": "Analysis of LOCKBIT 3.0 variant distributed via RDP brute-force intrusions against manufacturing sector targets in Germany and Japan. The sample employs intermittent encryption and tampers with VSS snapshots to impede recovery.","threat.report.time.created": "2026-04-12T06:45:00Z","threat.report.time.updated": "2026-04-14T11:20:00Z","threat.report.references.urls": ["https://falcon.crowdstrike.com/intelligence/reports/MMA-250412"],"threat.report.tags": ["ransomware", "lockbit", "rdp", "manufacturing"],"threat.actor.names": ["BITWISE SPIDER"],"threat.target.countries": ["Germany", "Japan"],"threat.target.industries": ["Manufacturing"],"threat.malware.families": ["LockBit 3.0"],"threat.attack.technique.ids": ["T1110", "T1486", "T1490", "T1070"],"threat.attack.technique.names": ["Brute Force", "Data Encrypted for Impact", "Inhibit System Recovery", "Indicator Removal"],"threat.attack.tactic.ids": ["TA0006", "TA0040", "TA0005"],"threat.attack.tactic.names": ["Credential Access", "Impact", "Defense Evasion"],"threat.observables.ips": ["91.208.52.149", "185.220.101.33"],"threat.observables.domains": ["rdp-relay.backup-vault.eu"],"threat.observables.hashes.sha256": ["c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2","f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1"],"threat.observables.hashes.md5": ["1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d"]}
A STIX 2.1 threat report covering the long-lived Poison Ivy remote access trojan, demonstrating high-volume observable arrays (18 IPs, 25 domains, 6 CVEs) ingested from a TAXII feed. The full indicator lists are truncated here for readability.
{"event.kind": "SECURITY_EVENT","event.type": "THREAT_REPORT","event.name": "Threat report event","event.provider": "FireEye","product.vendor": "FireEye","product.name": "FireEye TAXII Feed","threat.report.id": "report--f2b63e80-b523-4747-a069-35c002c690db","threat.report.name": "Poison Ivy: Assessing Damage and Extracting Intelligence","threat.report.description": "This report spotlights Poison Ivy (PIVY), a RAT that remains popular and effective a full eight years after its release, despite its age and familiarity in IT security circles.","threat.report.author": "FireEye, Inc.","threat.report.time.created": "2015-05-15T09:12:16.432Z","threat.report.time.updated": "2015-05-15T09:12:16.432Z","threat.malware.families": ["Poison Ivy", "PIVY Variant"],"threat.observables.ips": ["219.76.208.163", "113.10.246.30", "219.90.112.203", "75.126.95.138","219.90.112.197", "202.65.222.45", "202.65.220.64", "98.126.148.114","180.210.206.96", "101.78.151.179", "60.10.1.114", "60.1.1.114","60.10.1.115", "60.10.1.118", "60.10.1.120", "60.10.1.121","60.2.148.167", "123.183.210.28"],"threat.observables.domains": ["www.webserver.dynssl.com", "www.webserver.freetcp.com", "www.webserver.fartit.com","microsofta.byinter.net", "microsoftb.byinter.net", "microsoftc.byinter.net","microsofte.byinter.net", "nkr.iphone.qpoe.com", "e.ct.toh.info","js001.3322.org", "apple.cmdnetview.com", "autuo.xicp.net","tw.2012yearleft.com", "dedydns.ns01.us", "maofajapa.3322.org","send.have8000.com", "fbi.zyns.com", "weile3322b.3322.org","ngcc.8800.org", "sh.chromeenter.com", "mf.ddns.info","av.ddns.us", "jj.mysecondarydns.com", "mongoles.3322.org", "3q.wubangtu.info"],"threat.observables.cves": ["CVE-2012-0158", "CVE-2009-4324", "CVE-2013-0422","CVE-2013-1347", "CVE-2011-3544", "CVE-2010-3333"]}