Threat intelligence

Latest Dynatrace
Reference

Threat intelligence report events represent structured threat intelligence publications ingested from external providers such as AlienVault OTX, CrowdStrike Falcon Intelligence, and STIX/TAXII feeds. Available for third-party ingested data only.

Threat report

A threat intelligence report event represents a structured threat intelligence publication—such as an AlienVault OTX pulse, a CrowdStrike Falcon Intelligence malware analysis report, or a STIX 2.1 report object from a TAXII feed—ingested from an external threat intelligence platform. One event per publication. Fields cover the report's identity and provenance (threat.report.), adversary context (actor, targeting, malware, ATT&CK), and extracted indicators of compromise (threat.observables.).

Query

Lists the latest version of each recent threat intelligence report event.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| sort timestamp desc

Counts unique latest threat intelligence reports by provider and product.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| summarize {reports = count()}, by: {event.provider, product.name}
| sort reports desc

Lists the latest version of recent threat intelligence reports that include CVE observables.

fetch security.events
| filter event.type == "THREAT_REPORT"
| dedup {threat.report.id}, sort: {timestamp desc}
| filter arraySize(threat.observables.cves) > 0
| fields timestamp, threat.report.id, threat.report.name, threat.observables.cves, event.provider, product.name
| sort timestamp desc

Required fields

Fields that must be present on every threat intelligence report event.

Attribute	Type	Description	Examples
`event.kind`	string	stableDisplay name: `Event kind`Describes the general nature of the event. Must be set to SECURITY_EVENT for threat intelligence report events.Tags: `permission`	`SECURITY_EVENT`
`event.name`	string	stableDisplay name: `Event name`The human readable display name of an event type.	`Threat report event`
`event.provider`	string	stableDisplay name: `Event provider`Name of the threat intelligence platform or feed that is the original source of this report.Tags: `permission`	`AlienVault`; `CrowdStrike`; `FireEye`
`event.type`	string	stableDisplay name: `Event type`Discriminator for the event schema within SECURITY_EVENT. Must be set to THREAT_REPORT for threat intelligence report events.Tags: `permission`	`THREAT_REPORT`
`product.name`	string	resource experimentalProduct name.	`AlienVault OTX`; `Falcon Intelligence`; `FireEye TAXII Feed`
`product.vendor`	string	resource experimentalProduct vendor.	`LevelBlue`; `CrowdStrike`; `FireEye`
`threat.report.description`	string	experimentalSummary or abstract of the threat intelligence report. Producers should truncate to 2 KB to stay within Grail field size limits; full content belongs in a linked document referenced via threat.report.references.urls.	`Threat actors have compromised several @antv-scoped packages on npm...`
`threat.report.id`	string	experimentalVendor-assigned unique identifier for this threat intelligence report. Stable across report updates; use to correlate modified versions of the same report. Format varies by provider (for example, opaque ID string, base64, STIX report– UUID).	`6a0c1b289f4fe8b7bdf00a84`; `YWdhdXNsMjYwNjE0`; `report--f2b63e80-b523-4747-a069-35c002c690db`
`threat.report.name`	string	experimentalHuman-readable title of the threat intelligence report as provided by the source platform. May be a vendor reference code (for example, "CSA-260614") or a descriptive title.	`Active Supply Chain Attack Compromises Packages on npm`; `CSA-260614`
`threat.report.time.created`	timestamp	experimentalTimestamp when the report was first created by the source platform.	`2026-05-19T08:11:20.341Z`; `2026-04-12T06:45:00Z`; `1747642280341000000`
`threat.report.time.updated`	timestamp	experimentalTimestamp of the most recent modification to the report. Useful for detecting updated intelligence on the same report ID.	`2026-05-19T17:46:10.861Z`; `2026-04-14T11:20:00Z`; `1747684370861000000`

Recommended fields

Fields that should be populated when the source platform provides the data. These fields enable threat actor attribution, targeting analysis, and MITRE ATT&CK correlation.

Attribute	Type	Description	Examples
`threat.actor.names`	string[]	experimentalNames of the threat actors attributed to the activity described in this report. Each entry may represent either a distinct co-attributed actor (e.g. two groups acting together) or an alternative name (alias) used for the same actor across different vendors or intelligence sources. Use the names as provided by the source platform. Omit when attribution is not provided or is explicitly uncertain.	`['SCATTERED SPIDER']`; `['BITWISE SPIDER']`; `['Leek Likho']`; `['Cozy Bear', 'APT29', 'Midnight Blizzard']`
`threat.attack.subtechnique.ids`	string[]	experimentalMITRE ATT&CK sub-technique identifiers for this detection, in T{parent}.{sub} dotted format. Independent of threat.attack.technique.ids—no positional alignment is assumed or required. The parent technique is encoded in the sub-technique ID itself, for example, T1059.003 belongs to technique T1059). Omit when no sub-technique information is available; don't use empty string placeholders. Sub-technique names are derivable from IDs via the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.subtechnique.ids, "T1059.003")	`['T1059.003']`; `['T1059.003', 'T1078.002']`
`threat.attack.subtechnique.names`	string[]	experimentalHuman-readable names of the MITRE ATT&CK sub-techniques for this detection. Optional companion to threat.attack.subtechnique.ids. When populated, elements must correspond positionally to threat.attack.subtechnique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide sub-technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Windows Command Shell']`; `['Windows Command Shell', 'Domain Accounts']`
`threat.attack.tactic.ids`	string[]	experimentalMITRE ATT&CK tactic identifiers for this detection, in TA-prefixed format. A detection may map to zero or more tactics. Omit or set to an empty array when tactic information is unavailable from the producing source. Tactic names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.tactic.ids, "TA0002")	`['TA0002']`; `['TA0002', 'TA0004']`
`threat.attack.tactic.names`	string[]	experimentalHuman-readable names of the MITRE ATT&CK tactics for this detection. Optional companion to threat.attack.tactic.ids. When populated, elements must correspond positionally to threat.attack.tactic.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide tactic names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Execution']`; `['Execution', 'Privilege Escalation']`
`threat.attack.technique.ids`	string[]	experimentalMITRE ATT&CK technique identifiers for this detection, in T-prefixed format. A detection may map to zero or more techniques. The primary pivot field for ATT&CK heat maps and technique coverage dashboards. Technique names can be derived from IDs using the ATT&CK knowledge base. DQL filter example: array.contains(threat.attack.technique.ids, "T1059")	`['T1059']`; `['T1059', 'T1078']`
`threat.attack.technique.names`	string[]	experimentalHuman-readable names of the MITRE ATT&CK techniques for this detection. Optional companion to threat.attack.technique.ids. When populated, elements must correspond positionally to threat.attack.technique.ids: names[i] is the display name for ids[i]. No specific ordering of the array is required. Omit when the producing source does not provide technique names; don't use placeholder values. Names can be derived from IDs using the ATT&CK knowledge base.	`['Command and Scripting Interpreter']`; `['Command and Scripting Interpreter', 'Valid Accounts']`
`threat.attack.version`	string	experimentalVersion of the MITRE ATT&CK framework used to classify this detection. Useful for audit and reproducibility, since tactic and technique IDs can be added or renumbered across major ATT&CK versions. Some producers don't embed the framework version in their event payloads; omit when version provenance can't be reliably determined. Use bare version numbers without a "v" prefix.	`14.1`; `15.1`; `16.0`
`threat.malware.families`	string[]	experimentalNames of the malware families observed or attributed in this report. Use the canonical family name as provided by the source platform. Omit when no malware family information is available.	`['LockBit 3.0']`; `['ALPHV', 'BlackCat']`; `['Poison Ivy', 'PIVY Variant']`
`threat.target.countries.iso_codes`	string[]	experimentalISO 3166-1 alpha-2 codes of the countries targeted by the adversary activity. Uses the same two-letter country code representation as geo.country.iso_code, the platform-wide standard for country geography, so threat targeting can be correlated with geo-enriched data and rendered on maps without name normalization. Complements threat.target.countries.names (full English country names); the two arrays are independent and need not align positionally—either may be populated without the other. Omit when targeting information is not available.	`['US']`; `['DE', 'JP']`; `['US', 'GB']`
`threat.target.countries.names`	string[]	experimentalNames of the countries targeted by the adversary activity. Use the full English country name as provided by the source platform. Omit when targeting information is not available. It is recommended to normalize country values to ISO 3166 standard names; non-standard values may not be processed correctly by consumers of this field.	`['United States of America']`; `['Germany', 'Japan']`; `['United States of America', 'United Kingdom of Great Britain and Northern Ireland']`
`threat.target.industries`	string[]	experimentalNames of the industry verticals targeted by the adversary activity. Use the sector name as provided by the source platform. Omit when targeting information is not available.	`['Technology']`; `['Manufacturing']`; `['Financial Services', 'Healthcare']`

Optional fields

Optional fields for threat intelligence report events. Observable fields should be populated when the source platform provides indicator data.

Attribute	Type	Description	Examples
`threat.observables.cves`	string[]	experimentalCVE identifiers for vulnerabilities exploited or referenced in this report. Must use the canonical CVE-YYYY-NNNNN format. Deduplicate before ingestion.	`['CVE-2024-1234']`; `['CVE-2012-0158', 'CVE-2013-0422', 'CVE-2013-1347']`
`threat.observables.domains`	string[]	experimentalDomain names observed as indicators of compromise. Includes fully-qualified domain names (FQDNs) and bare domain names. Deduplicate before ingestion.	`['t.m-kosche.com']`; `['evil.example.com', 'rdp-relay.backup-vault.eu']`
`threat.observables.emails`	string[]	experimentalEmail addresses observed as indicators of compromise (for example, attacker C2 contact addresses or phishing sender addresses). Deduplicate before ingestion.	`['c2@evil.com']`
`threat.observables.hashes.md5`	string[]	experimentalMD5 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['d41d8cd98f00b204e9800998ecf8427e']`; `['1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d']`
`threat.observables.hashes.sha1`	string[]	experimentalSHA-1 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['1916faa365f2788b6e193514872d51a242876569']`; `['da39a3ee5e6b4b0d3255bfef95601890afd80709']`
`threat.observables.hashes.sha256`	string[]	experimentalSHA-256 file hashes observed as indicators of compromise. Values must be lowercase hexadecimal strings. Deduplicate before ingestion.	`['e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']`; `['c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2']`
`threat.observables.ips`	ipAddress[]	experimentalIPv4 and IPv6 addresses observed as indicators of compromise in this report. Include both IPv4 dotted-decimal and IPv6 colon-hex representations as provided by the source. Deduplicate before ingestion.	`['1.2.3.4', '91.208.52.149']`; `['219.76.208.163', '113.10.246.30']`
`threat.observables.urls`	string[]	experimentalFull URLs observed as indicators of compromise. Includes scheme, host, port, and path as provided by the source platform. Deduplicate before ingestion.	`['https://t.m-kosche.com:443/api/public/otel/v1/traces']`
`threat.report.author`	string	experimentalName of the author or team that published the report. Omit when not provided by the source platform.	`AlienVault`; `CrowdStrike Intelligence Team`; `FireEye, Inc.`
`threat.report.references.urls`	string[]	experimentalExternal URLs referenced by or linking to the full report. May include the report's own URL on the source platform, blog posts, advisories, or research papers that underpin the report.	`['https://socket.dev/blog/antv-packages-compromised']`; `['https://falcon.crowdstrike.com/intelligence/reports/CSA-260614']`
`threat.report.tags`	string[]	experimentalFree-form classification tags assigned to the report by the source platform. Useful for filtering and grouping reports by topic. Omit when not provided by the source platform.	`['supply chain attack', 'npm', 'credential theft']`; `['ransomware', 'lockbit', 'rdp']`

Technical fields

Required fields that should be automatically added during ingest via OpenPipeline.

Attribute	Type	Description	Examples
`event.id`	string	stableDisplay name: `Event ID`In combination with `timestamp`, this field uniquely identifies a specific event.	`1669863368163_07755297913417681159`
`timestamp`	timestamp	stableDisplay name: `Timestamp`Time (UNIX Epoch time in nanoseconds) when the event was ingested.	`1649822520123123123`

Concept: What is a threat intelligence report?

A threat intelligence report is a curated, structured publication produced by an analyst or a threat intelligence platform (TIP). It groups related threat intelligence objects—indicators of compromise, malware descriptions, actor attribution, TTPs, and vulnerabilities—under a single editorial context, with a title, publisher, and timestamps.

This is not:

A PDF document or narrative report
A file submission ("reporting a suspicious file")—that is a file observable or a malware-analysis record
The result of a query or detection—those are findings or alerts

Concrete examples of a threat intelligence report in this sense:

An AlienVault OTX pulse
A CrowdStrike Falcon Intelligence malware analysis report
A STIX 2.1 report object delivered via a TAXII feed

The threat.report.* fields capture the report's identity and provenance (who published it, when, what it covers). The threat.observables.* fields capture the indicators extracted from the report. Together they let consumers correlate updates to the same report, filter by publisher, and link back to the source for full context.

Standard references:

Examples

AlienVault OTX—Supply chain npm attack

A threat report covering a supply chain attack on npm packages, demonstrating report metadata, ATT&CK sub-technique classification, and URL/hostname/hash observables from a pulse-based threat intelligence feed.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "AlienVault",
  "product.vendor": "LevelBlue",
  "product.name": "AlienVault OTX",

  "threat.report.id": "6a0c1b289f4fe8b7bdf00a84",
  "threat.report.name": "Active Supply Chain Attack Compromises Packages on npm",
  "threat.report.description": "Threat actors have compromised several @antv-scoped packages on npm, injecting credential-stealing code that exfiltrates data to a remote endpoint via OpenTelemetry traces.",
  "threat.report.author": "AlienVault",
  "threat.report.time.created": "2026-05-19T08:11:20.341Z",
  "threat.report.time.updated": "2026-05-19T17:46:10.861Z",
  "threat.report.references.urls": ["https://socket.dev/blog/antv-packages-compromised"],
  "threat.report.tags": ["supply chain attack", "npm", "credential theft"],

  "threat.target.countries": ["United States"],
  "threat.target.industries": ["Technology"],

  "threat.attack.technique.ids": ["T1059", "T1552"],
  "threat.attack.technique.names": ["Command and Scripting Interpreter", "Unsecured Credentials"],
  "threat.attack.subtechnique.ids": ["T1059.007", "T1552.005"],

  "threat.observables.domains": ["t.m-kosche.com"],
  "threat.observables.urls": ["https://t.m-kosche.com:443/api/public/otel/v1/traces"],
  "threat.observables.hashes.sha1": ["1916faa365f2788b6e193514872d51a242876569"]
}

CrowdStrike Falcon Intelligence—LockBit 3.0 ransomware

A malware analysis report covering LockBit 3.0 distributed via RDP brute-force, demonstrating actor attribution, malware families, ATT&CK tactic classification, and multi-type hash observables.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "CrowdStrike",
  "product.vendor": "CrowdStrike",
  "product.name": "Falcon Intelligence",

  "threat.report.id": "bWFsd2FyZTI1MDQxMg==",
  "threat.report.name": "MMA-250412",
  "threat.report.description": "Analysis of LOCKBIT 3.0 variant distributed via RDP brute-force intrusions against manufacturing sector targets in Germany and Japan. The sample employs intermittent encryption and tampers with VSS snapshots to impede recovery.",
  "threat.report.time.created": "2026-04-12T06:45:00Z",
  "threat.report.time.updated": "2026-04-14T11:20:00Z",
  "threat.report.references.urls": ["https://falcon.crowdstrike.com/intelligence/reports/MMA-250412"],
  "threat.report.tags": ["ransomware", "lockbit", "rdp", "manufacturing"],

  "threat.actor.names": ["BITWISE SPIDER"],
  "threat.target.countries": ["Germany", "Japan"],
  "threat.target.industries": ["Manufacturing"],
  "threat.malware.families": ["LockBit 3.0"],

  "threat.attack.technique.ids": ["T1110", "T1486", "T1490", "T1070"],
  "threat.attack.technique.names": ["Brute Force", "Data Encrypted for Impact", "Inhibit System Recovery", "Indicator Removal"],
  "threat.attack.tactic.ids": ["TA0006", "TA0040", "TA0005"],
  "threat.attack.tactic.names": ["Credential Access", "Impact", "Defense Evasion"],

  "threat.observables.ips": ["91.208.52.149", "185.220.101.33"],
  "threat.observables.domains": ["rdp-relay.backup-vault.eu"],
  "threat.observables.hashes.sha256": [
    "c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
    "f0e1d2c3b4a5f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1"
  ],
  "threat.observables.hashes.md5": ["1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d"]
}

FireEye STIX Feed—Poison Ivy RAT

A STIX 2.1 threat report covering the long-lived Poison Ivy remote access trojan, demonstrating high-volume observable arrays (18 IPs, 25 domains, 6 CVEs) ingested from a TAXII feed. The full indicator lists are truncated here for readability.

{
  "event.kind": "SECURITY_EVENT",
  "event.type": "THREAT_REPORT",
  "event.name": "Threat report event",
  "event.provider": "FireEye",
  "product.vendor": "FireEye",
  "product.name": "FireEye TAXII Feed",

  "threat.report.id": "report--f2b63e80-b523-4747-a069-35c002c690db",
  "threat.report.name": "Poison Ivy: Assessing Damage and Extracting Intelligence",
  "threat.report.description": "This report spotlights Poison Ivy (PIVY), a RAT that remains popular and effective a full eight years after its release, despite its age and familiarity in IT security circles.",
  "threat.report.author": "FireEye, Inc.",
  "threat.report.time.created": "2015-05-15T09:12:16.432Z",
  "threat.report.time.updated": "2015-05-15T09:12:16.432Z",

  "threat.malware.families": ["Poison Ivy", "PIVY Variant"],

  "threat.observables.ips": [
    "219.76.208.163", "113.10.246.30", "219.90.112.203", "75.126.95.138",
    "219.90.112.197", "202.65.222.45", "202.65.220.64", "98.126.148.114",
    "180.210.206.96", "101.78.151.179", "60.10.1.114", "60.1.1.114",
    "60.10.1.115", "60.10.1.118", "60.10.1.120", "60.10.1.121",
    "60.2.148.167", "123.183.210.28"
  ],
  "threat.observables.domains": [
    "www.webserver.dynssl.com", "www.webserver.freetcp.com", "www.webserver.fartit.com",
    "microsofta.byinter.net", "microsoftb.byinter.net", "microsoftc.byinter.net",
    "microsofte.byinter.net", "nkr.iphone.qpoe.com", "e.ct.toh.info",
    "js001.3322.org", "apple.cmdnetview.com", "autuo.xicp.net",
    "tw.2012yearleft.com", "dedydns.ns01.us", "maofajapa.3322.org",
    "send.have8000.com", "fbi.zyns.com", "weile3322b.3322.org",
    "ngcc.8800.org", "sh.chromeenter.com", "mf.ddns.info",
    "av.ddns.us", "jj.mysecondarydns.com", "mongoles.3322.org", "3q.wubangtu.info"
  ],
  "threat.observables.cves": [
    "CVE-2012-0158", "CVE-2009-4324", "CVE-2013-0422",
    "CVE-2013-1347", "CVE-2011-3544", "CVE-2010-3333"
  ]
}