IOC / Enrichment Fields

Additionally, the response may include automatically extracted indicators of compromise (IOCs). Only indicators that are actually found in the underlying content are returned; IOC fields with no data are omitted from the response.

Supported IOC / enrichment fields:

• m_phone_number — Phone Numbers

• m_email — Emails

• m_domain — Domains

• m_country — Country

• m_url — URLs

• m_cve — CVE & CWE

• m_ip — IP Addresses

• m_yara_rule — YARA Rules

• m_encoded_urls — Encoded URLs

• m_file_paths — File Paths

• m_credit_card — Credit Cards

• m_org — Organizations

• m_company_name — Company Names

• m_person — Persons

• m_location — Locations

• m_language — Languages

• m_user_agents — User Agents

• m_asns — ASNs

• m_team — Teams

• m_hashtag — Hashtags

• m_mention — Mentions

• m_social_media_profiles — Social Media Profiles

• m_currencies — Currencies

• m_crypto_address — Crypto Addresses

• m_xmpp_addresses — XMPP Addresses

• m_enterprise_attack_tactics — Enterprise ATT&CK Tactics

• m_enterprise_attack_techniques — Enterprise ATT&CK Techniques

• m_document_id — Document IDs

• m_au_abn — Australian IDs

• m_us_passport — US IDs

• m_us_bank_number — US Bank Numbers

• m_platform — Platform

• m_author — Author

• m_industry — Industry

• m_scrap_file — Scrap Script