Try it free

Threat intelligence

  • Latest Dynatrace
  • Reference

Threat intelligence report events represent structured threat intelligence publications ingested from external providers such as AlienVault OTX, CrowdStrike Falcon Intelligence, and STIX/TAXII feeds. Available for third-party ingested data only.

Query

Lists the latest version of each recent threat intelligence report.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| sort timestamp desc

Counts unique threat intelligence reports by provider and product.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| summarize {reports = count()}, by: {event.provider, product.name}
| sort reports desc

Lists the latest threat intelligence reports that include CVE observables.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| filter arraySize(threat.observables.cves) > 0
| fields timestamp, threat.report.id, threat.report.name, threat.observables.cves, event.provider
| sort timestamp desc

Threat report

A threat intelligence report event represents a structured threat intelligence publication—such as an AlienVault OTX pulse, a CrowdStrike Falcon Intelligence malware analysis report, or a STIX 2.1 report object from a TAXII feed—ingested from an external threat intelligence platform. One event per publication. Fields cover the report's identity and provenance (threat.report.), adversary context (actor, targeting, malware, ATT&CK), and extracted indicators of compromise (threat.observables.).

Query

Lists the latest version of each recent threat intelligence report event.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| sort timestamp desc

Counts unique latest threat intelligence reports by provider and product.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| summarize {reports = count()}, by: {event.provider, product.name}
| sort reports desc

Lists the latest version of recent threat intelligence reports that include CVE observables.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| filter arraySize(threat.observables.cves) > 0
| fields timestamp, threat.report.id, threat.report.name, threat.observables.cves, event.provider, product.name
| sort timestamp desc

Required fields

Fields that must be present on every threat intelligence report event.

AttributeTypeDescriptionExamples

event.kind

string

stable
Display name: Event kind
Describes the general nature of the event. Must be set to SECURITY_EVENT for threat intelligence report events.
Tags: permission

SECURITY_EVENT

event.name

string

stable
Display name: Event name
The human readable display name of an event type.

Threat report event

event.provider

string

stable
Display name: Event provider
Name of the threat intelligence platform or feed that is the original source of this report.
Tags: permission

AlienVault; CrowdStrike; FireEye

event.type

string

stable
Display name: Event type
Discriminator for the event schema within SECURITY_EVENT. Must be set to THREAT_REPORT for threat intelligence report events.
Tags: permission

THREAT_REPORT

product.name

string

resource experimental
Product name.

AlienVault OTX; Falcon Intelligence; FireEye TAXII Feed

product.vendor

string

resource experimental
Product vendor.

LevelBlue; CrowdStrike; FireEye

threat.report.description

string

experimental
Summary or abstract of the threat intelligence report. Producers should truncate to 2 KB to stay within Grail field size limits; full content belongs in a linked document referenced via threat.report.references.urls.

Threat actors have compromised several @antv-scoped packages on npm...

threat.report.id

string

experimental
Vendor-assigned unique identifier for this threat intelligence report. Stable across report updates; use to correlate modified versions of the same report. Format varies by provider (for example, opaque ID string, base64, STIX report– UUID).

6a0c1b289f4fe8b7bdf00a84; YWdhdXNsMjYwNjE0; report--f2b63e80-b523-4747-a069-35c002c690db

threat.report.name

string

experimental
Human-readable title of the threat intelligence report as provided by the source platform. May be a vendor reference code (for example, "CSA-260614") or a descriptive title.

Active Supply Chain Attack Compromises Packages on npm; CSA-260614

threat.report.time.created

timestamp

experimental
Timestamp when the report was first created by the source platform.

2026-05-19T08:11:20.341Z; 2026-04-12T06:45:00Z; 1747642280341000000

threat.report.time.updated

timestamp

experimental
Timestamp of the most recent modification to the report. Useful for detecting updated intelligence on the same report ID.

2026-05-19T17:46:10.861Z; 2026-04-14T11:20:00Z; 1747684370861000000

Recommended fields

Fields that should be populated when the source platform provides the data. These fields enable threat actor attribution, targeting analysis, and MITRE ATT&CK correlation.

AttributeTypeDescriptionExamples

threat.actor.names

string[]

experimental
Names of the threat actors attributed to the activity described in this report. Each entry may represent either a distinct co-attributed actor (e.g. two groups acting together) or an alternative name (alias) used for the same actor across different vendors or intelligence sources. Use the names as provided by the source platform. Omit when attribution is not provided or is explicitly uncertain.

['SCATTERED SPIDER']; ['BITWISE SPIDER']; ['Leek Likho']; ['Cozy Bear', 'APT29', 'Midnight Blizzard']

threat.attack.subtechnique.ids

string[]

experimental
MITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")

['T1059.003']; ['T1059.003', 'T1078.002']

threat.attack.subtechnique.names

string[]

experimental
Human-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Windows Command Shell']; ['Windows Command Shell', 'Domain Accounts']

threat.attack.tactic.ids

string[]

experimental
MITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")

['TA0002']; ['TA0002', 'TA0004']

threat.attack.tactic.names

string[]

experimental
Human-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Execution']; ['Execution', 'Privilege Escalation']

threat.attack.technique.ids

string[]

experimental
MITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")

['T1059']; ['T1059', 'T1078']

threat.attack.technique.names

string[]

experimental
Human-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.

['Command and Scripting Interpreter']; ['Command and Scripting Interpreter', 'Valid Accounts']

threat.attack.version

string

experimental
Version of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.

14.1; 15.1; 16.0

threat.malware.families

string[]

experimental
Names of the malware families observed or attributed in this report. Use the canonical family name as provided by the source platform. Omit when no malware family information is available.

['LockBit 3.0']; ['ALPHV', 'BlackCat']; ['Poison Ivy', 'PIVY Variant']

threat.target.countries.iso_codes

string[]

experimental
ISO 3166-1 alpha-2 codes of the countries targeted by the adversary activity. Uses the same two-letter country code representation as geo.country.iso_code, the platform-wide standard for country geography, so threat targeting can be correlated with geo-enriched data and rendered on maps without name normalization. Complements threat.target.countries.names (full English country names); the two arrays are independent and need not align positionally—either may be populated without the other. Omit when targeting information is not available.

['US']; ['DE', 'JP']; ['US', 'GB']

threat.target.countries.names

string[]

experimental
Names of the countries targeted by the adversary activity. Use the full English country name as provided by the source platform. Omit when targeting information is not available. It is recommended to normalize country values to ISO 3166 standard names; non-standard values may not be processed correctly by consumers of this field.

['United States of America']; ['Germany', 'Japan']; ['United States of America', 'United Kingdom of Great Britain and Northern Ireland']

threat.target.industries

string[]

experimental
Names of the industry verticals targeted by the adversary activity. Use the sector name as provided by the source platform. Omit when targeting information is not available.

['Technology']; ['Manufacturing']; ['Financial Services', 'Healthcare']

Optional fields

Optional fields for threat intelligence report events. Observable fields should be populated when the source platform provides indicator data.

AttributeTypeDescriptionExamples

threat.observables.cves

string[]

experimental
CVE identifiers for vulnerabilities exploited or referenced in this report. Must use the canonical CVE-YYYY-NNNNN format. Deduplicate before ingestion.

['CVE-2024-1234']; ['CVE-2012-0158', 'CVE-2013-0422', 'CVE-2013-1347']

threat.observables.domains

string[]

experimental
Domain names observed as indicators of compromise. Includes fully-qualified domain names (FQDNs) and bare domain names. Deduplicate before ingestion.

['t.m-kosche.com']; ['evil.example.com', 'rdp-relay.backup-vault.eu']

threat.observables.emails

string[]

experimental
Email addresses observed as indicators of compromise (for example, attacker C2 contact addresses or phishing sender addresses). Deduplicate before ingestion.

['c2@evil.com']

threat.observables.hashes.md5

string[]

experimental
MD5 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.

['d41d8cd98f00b204e9800998ecf8427e']; ['1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d']

threat.observables.hashes.sha1

string[]

experimental
SHA-1 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.

['1916faa365f2788b6e193514872d51a242876569']; ['da39a3ee5e6b4b0d3255bfef95601890afd80709']

threat.observables.hashes.sha256

string[]

experimental
SHA-256 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.

['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']; ['c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2']

threat.observables.ips

ipAddress[]

experimental
IPv4 and IPv6 addresses observed as indicators of compromise in this report. Include both IPv4 dotted-decimal and IPv6 colon-hex representations as provided by the source. Deduplicate before ingestion.

['1.2.3.4', '91.208.52.149']; ['219.76.208.163', '113.10.246.30']

threat.observables.urls

string[]

experimental
Full URLs observed as indicators of compromise. Includes scheme, host, port, and path as provided by the source platform. Deduplicate before ingestion.

['https://t.m-kosche.com:443/api/public/otel/v1/traces']

threat.report.author

string

experimental
Name of the author or team that published the report. Omit when not provided by the source platform.

AlienVault; CrowdStrike Intelligence Team; FireEye, Inc.

threat.report.references.urls

string[]

experimental
External URLs referenced by or linking to the full report. May include the report's own URL on the source platform, blog posts, advisories, or research papers that underpin the report.

['https://socket.dev/blog/antv-packages-compromised']; ['https://falcon.crowdstrike.com/intelligence/reports/CSA-260614']

threat.report.tags

string[]

experimental
Free-form classification tags assigned to the report by the source platform. Useful for filtering and grouping reports by topic. Omit when not provided by the source platform.

['supply chain attack', 'npm', 'credential theft']; ['ransomware', 'lockbit', 'rdp']

Technical fields

Required fields that should be automatically added during ingest via OpenPipeline.

AttributeTypeDescriptionExamples

event.id

string

stable
Display name: Event ID
In combination with timestamp, this field uniquely identifies a specific event.

1669863368163_07755297913417681159

timestamp

timestamp

stable
Display name: Timestamp
Time (UNIX Epoch time in nanoseconds) when the event was ingested.

1649822520123123123

Examples

AlienVault OTX—Supply chain npm attack

A threat report covering a supply chain attack on npm packages, demonstrating report metadata, ATT&CK sub-technique classification, and URL/hostname/hash observables from a pulse-based threat intelligence feed.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "AlienVault",
  "product.vendor": "LevelBlue",
  "product.name": "AlienVault OTX",


  "threat.report.id": "6a0c1b289f4fe8b7bdf00a84",
  "threat.report.name": "Active Supply Chain Attack Compromises Packages on npm",
  "threat.report.description": "Threat actors have compromised several @antv-scoped packages on npm, injecting credential-stealing code that exfiltrates data to a remote endpoint via OpenTelemetry traces.",
  "threat.report.author": "AlienVault",
  "threat.report.time.created": "2026-05-19T08:11:20.341Z",
  "threat.report.time.updated": "2026-05-19T17:46:10.861Z",
  "threat.report.references.urls": ["https://socket.dev/blog/antv-packages-compromised"],
  "threat.report.tags": ["supply chain attack", "npm", "credential theft"],


  "threat.target.countries": ["United States"],
  "threat.target.industries": ["Technology"],


  "threat.attack.technique.ids": ["T1059", "T1552"],
  "threat.attack.technique.names": ["Command and Scripting Interpreter", "Unsecured Credentials"],
  "threat.attack.subtechnique.ids": ["T1059.007", "T1552.005"],


  "threat.observables.domains": ["t.m-kosche.com"],
  "threat.observables.urls": ["https://t.m-kosche.com:443/api/public/otel/v1/traces"],
  "threat.observables.hashes.sha1": ["1916faa365f2788b6e193514872d51a242876569"]
}

CrowdStrike Falcon Intelligence—LockBit 3.0 ransomware

A malware analysis report covering LockBit 3.0 distributed via RDP brute-force, demonstrating actor attribution, malware families, ATT&CK tactic classification, and multi-type hash observables.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "CrowdStrike",
  "product.vendor": "CrowdStrike",
  "product.name": "Falcon Intelligence",


  "threat.report.id": "bWFsd2FyZTI1MDQxMg==",
  "threat.report.name": "MMA-250412",
  "threat.report.description": "Analysis of LOCKBIT 3.0 variant distributed via RDP brute-force intrusions against manufacturing sector targets in Germany and Japan. The sample employs intermittent encryption and tampers with VSS snapshots to impede recovery.",
  "threat.report.time.created": "2026-04-12T06:45:00Z",
  "threat.report.time.updated": "2026-04-14T11:20:00Z",
  "threat.report.references.urls": ["https://falcon.crowdstrike.com/intelligence/reports/MMA-250412"],
  "threat.report.tags": ["ransomware", "lockbit", "rdp", "manufacturing"],


  "threat.actor.names": ["BITWISE SPIDER"],
  "threat.target.countries": ["Germany", "Japan"],
  "threat.target.industries": ["Manufacturing"],
  "threat.malware.families": ["LockBit 3.0"],


  "threat.attack.technique.ids": ["T1110", "T1486", "T1490", "T1070"],
  "threat.attack.technique.names": ["Brute Force", "Data Encrypted for Impact", "Inhibit System Recovery", "Indicator Removal"],
  "threat.attack.tactic.ids": ["TA0006", "TA0040", "TA0005"],
  "threat.attack.tactic.names": ["Credential Access", "Impact", "Defense Evasion"],


  "threat.observables.ips": ["91.208.52.149", "185.220.101.33"],
  "threat.observables.domains": ["rdp-relay.backup-vault.eu"],
  "threat.observables.hashes.sha256": [
    "c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
    "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1"
  ],
  "threat.observables.hashes.md5": ["1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d"]
}

FireEye STIX Feed—Poison Ivy RAT

A STIX 2.1 threat report covering the long-lived Poison Ivy remote access trojan, demonstrating high-volume observable arrays (18 IPs, 25 domains, 6 CVEs) ingested from a TAXII feed. The full indicator lists are truncated here for readability.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "FireEye",
  "product.vendor": "FireEye",
  "product.name": "FireEye TAXII Feed",


  "threat.report.id": "report--f2b63e80-b523-4747-a069-35c002c690db",
  "threat.report.name": "Poison Ivy: Assessing Damage and Extracting Intelligence",
  "threat.report.description": "This report spotlights Poison Ivy (PIVY), a RAT that remains popular and effective a full eight years after its release, despite its age and familiarity in IT security circles.",
  "threat.report.author": "FireEye, Inc.",
  "threat.report.time.created": "2015-05-15T09:12:16.432Z",
  "threat.report.time.updated": "2015-05-15T09:12:16.432Z",


  "threat.malware.families": ["Poison Ivy", "PIVY Variant"],


  "threat.observables.ips": [
    "219.76.208.163", "113.10.246.30", "219.90.112.203", "75.126.95.138",
    "219.90.112.197", "202.65.222.45", "202.65.220.64", "98.126.148.114",
    "180.210.206.96", "101.78.151.179", "60.10.1.114", "60.1.1.114",
    "60.10.1.115", "60.10.1.118", "60.10.1.120", "60.10.1.121",
    "60.2.148.167", "123.183.210.28"
  ],
  "threat.observables.domains": [
    "www.webserver.dynssl.com", "www.webserver.freetcp.com", "www.webserver.fartit.com",
    "microsofta.byinter.net", "microsoftb.byinter.net", "microsoftc.byinter.net",
    "microsofte.byinter.net", "nkr.iphone.qpoe.com", "e.ct.toh.info",
    "js001.3322.org", "apple.cmdnetview.com", "autuo.xicp.net",
    "tw.2012yearleft.com", "dedydns.ns01.us", "maofajapa.3322.org",
    "send.have8000.com", "fbi.zyns.com", "weile3322b.3322.org",
    "ngcc.8800.org", "sh.chromeenter.com", "mf.ddns.info",
    "av.ddns.us", "jj.mysecondarydns.com", "mongoles.3322.org", "3q.wubangtu.info"
  ],
  "threat.observables.cves": [
    "CVE-2012-0158", "CVE-2009-4324", "CVE-2013-0422",
    "CVE-2013-1347", "CVE-2011-3544", "CVE-2010-3333"
  ]
}