Attributes are key/value data sets that can be added to Groups, Indicators, Victims, and Workflow Cases. When adding an Attribute to an object, users must select the type of Attribute they want to create.
Endpoint: /api/v3/attributeTypes
Endpoint Options
Available Fields
Send the following request to retrieve a complete list of fields that may be included in responses returned from the /v3/attributeTypes endpoint, which is a read-only endpoint:
OPTIONS /v3/attributeTypes?show=readonly
Include Additional Fields in Responses
When creating, retrieving, or updating data, you can use the fields query parameter to include additional fields in the API response that are not included by default.
Send the following request to retrieve a list of fields you can include in responses returned from the /v3/attributeTypes endpoint:
OPTIONS /v3/attributeTypes/fields
Filter Results
When retrieving data, you can use the tql query parameter to filter results with ThreatConnect Query Language (TQL).
Send the following request to retrieve a list of valid TQL parameters you can use when including the tql query parameter in a request to the /v3/attributeTypes endpoint:
OPTIONS /v3/attributeTypes/tql
Retrieve Attribute Types
Retrieve All Attribute Types
Send the following request to retrieve data for all Attribute Types:
GET /v3/attributeTypes
{
"next": "https://app.threatconnect.com/api/v3/attributeTypes?resultStart=100&resultLimit=100",
"data": [
{
"id": 1,
"name": "Course of Action Taken",
"description": "Describe the Course of Action Taken.",
"maxSize": 500,
"allowMarkdown": true,
"errorMessage": "Please enter a valid Course of Action."
},
{
"id": 2,
"name": "Infrastructure Ownership",
"description": "Select ownership details of the Infrastructure (IP Address, Domain Name, URL, etc) used in an Adversary operation.",
"maxSize": 19,
"allowMarkdown": false,
"errorMessage": "Please enter valid infrastructure ownership details: Adversary Owned, Adversary Leased, Adversary Subverted",
"validationRule": {
"id": 12,
"name": "Adversary Ownership",
"text": "Adversary Owned;Adversary Leased;Adversary Subverted;Unknown;",
"type": "SelectOne",
"description": "Infrastructure Ownership Types",
"version": "1"
}
},
{...}
],
"count": 214,
"status": "Success"
}
Retrieve a Specific Attribute Type
Send a request in the following format to retrieve data for a specific Attribute Type:
GET /v3/attributeTypes/{attributeTypeId}
For example, the following request will retrieve data for the Attribute Type whose ID is 3:
GET /v3/attributeTypes/3
{
"data": {
"id": 3,
"name": "TTP Description: Malware/Tool Information",
"description": "Malware and hackertools usage characteristics: backdoor, self-propagating, rootkit, pass-the-hash, keylogger, Other.",
"maxSize": 500,
"allowMarkdown": true,
"errorMessage": "Please enter a valid TTP Description: Malware/Tool Information."
},
"status": "Success"
}