Synapse Data Model - Forms
Forms
Forms are derived from types, or base types. Forms represent node types in the graph.
auth:access
An instance of using creds to access a resource.
The base type for the form can be found at auth:access.
- Properties:
name
type
doc
:creds
The credentials used to attempt access.
:time
The time of the access attempt.
:success
Set to true if the access was successful.
:person
The person who attempted access.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
auth:creds
A unique set of credentials used to access a resource.
The base type for the form can be found at auth:creds.
- Properties:
name
type
doc
opts
The email address used to identify the user.
:user
The user name used to identify the user.
:phone
The phone number used to identify the user.
:passwd
The password used to authenticate.
:passwdhash
The password hash used to authenticate.
:account
The account that the creds allow access to.
:website
The base URL of the website that the credentials allow access to.
:host
The host that the credentials allow access to.
:wifi:ssid
The WiFi SSID that the credentials allow access to.
:web:acct
Deprecated. Use :service:account.
Deprecated:
True
:service:account
The service account that the credentials allow access to.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
belief:subscriber
A contact which subscribes to a belief system.
The base type for the form can be found at belief:subscriber.
- Properties:
name
type
doc
:contact
The contact which subscribes to the belief system.
:system
The belief system to which the contact subscribes.
:began
The time that the contact began to be a subscriber to the belief system.
:ended
The time when the contact ceased to be a subscriber to the belief system.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.
belief:subscriber
-(follows)>
belief:tenet
The subscriber is assessed to generally adhere to the specific tenet.
- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
belief:system
A belief system such as an ideology, philosophy, or religion.
The base type for the form can be found at belief:system.
- Properties:
name
type
doc
opts
:name
The name of the belief system.
:desc
A description of the belief system.
Display:
{'hint': 'text'}
:type
A taxonometric type for the belief system.
:began
The time that the belief system was first observed.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.
belief:system
-(has)>
belief:tenet
The belief system includes the tenet.
- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
belief:system:type:taxonomy
A hierarchical taxonomy of belief system types.
The base type for the form can be found at belief:system:type:taxonomy.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
belief:tenet
A concrete tenet potentially shared by multiple belief systems.
The base type for the form can be found at belief:tenet.
- Properties:
name
type
doc
opts
:name
The name of the tenet.
:desc
A description of the tenet.
Display:
{'hint': 'text'}
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
belief:subscriber
-(follows)>
belief:tenet
The subscriber is assessed to generally adhere to the specific tenet.
belief:system
-(has)>
belief:tenet
The belief system includes the tenet.
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:bundle
A bundle allows construction of products which bundle instances of other products.
The base type for the form can be found at biz:bundle.
- Properties:
name
type
doc
opts
:count
The number of instances of the product or service included in the bundle.
:price
The price of the bundle.
:product
The product included in the bundle.
:service
The service included in the bundle.
:deal
Deprecated. Please use econ:receipt:item for instances of bundles being sold.
Deprecated:
True
:purchase
Deprecated. Please use econ:receipt:item for instances of bundles being sold.
Deprecated:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:deal
A sales or procurement effort in pursuit of a purchase.
The base type for the form can be found at biz:deal.
- Properties:
name
type
doc
opts
:id
strip:True
An identifier for the deal.
:title
A title for the deal.
:type
The type of deal.
Display:
{'hint': 'taxonomy'}
:status
The status of the deal.
Display:
{'hint': 'taxonomy'}
:updated
The last time the deal had a significant update.
:contacted
The last time the contacts communicated about the deal.
:rfp
The RFP that the deal is in response to.
:buyer
The primary contact information for the buyer.
:buyer:org
The buyer org.
:buyer:orgname
The reported ou:name of the buyer org.
:buyer:orgfqdn
The reported inet:fqdn of the buyer org.
:seller
The primary contact information for the seller.
:seller:org
The seller org.
:seller:orgname
The reported ou:name of the seller org.
:seller:orgfqdn
The reported inet:fqdn of the seller org.
:currency
The currency of econ:price values associated with the deal.
:buyer:budget
The buyers budget for the eventual purchase.
:buyer:deadline
When the buyer intends to make a decision.
:offer:price
The total price of the offered products.
:offer:expires
When the offer expires.
:purchase
Records a purchase resulting from the deal.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:dealstatus
A deal/rfp status taxonomy.
The base type for the form can be found at biz:dealstatus.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:dealtype
A deal type taxonomy.
The base type for the form can be found at biz:dealtype.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:listing
A product or service being listed for sale at a given price by a specific seller.
The base type for the form can be found at biz:listing.
- Properties:
name
type
doc
:seller
The contact information for the seller.
:product
The product being offered.
:service
The service being offered.
:current
Set to true if the offer is still current.
:time
The first known offering of this product/service by the organization for the asking price.
:expires
Set if the offer has a known expiration date.
:price
The asking price of the product or service.
:currency
The currency of the asking price.
:count:total
min:0
The number of instances for sale.
:count:remaining
min:0
The current remaining number of instances for sale.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:prodtype
A product type taxonomy.
The base type for the form can be found at biz:prodtype.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:product
A product which is available for purchase.
The base type for the form can be found at biz:product.
- Properties:
name
type
doc
opts
:name
The name of the product.
:type
The type of product.
Display:
{'hint': 'taxonomy'}
:summary
A brief summary of the product.
Display:
{'hint': 'text'}
:maker
A contact for the maker of the product.
:madeby:org
Deprecated. Please use biz:product:maker.
Deprecated:
True
:madeby:orgname
Deprecated. Please use biz:product:maker.
Deprecated:
True
:madeby:orgfqdn
Deprecated. Please use biz:product:maker.
Deprecated:
True
:price:retail
The MSRP price of the product.
:price:bottom
The minimum offered or observed price of the product.
:price:currency
The currency of the retail and bottom price properties.
:bundles
An array of bundles included with the product.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:rfp
An RFP (Request for Proposal) soliciting proposals.
The base type for the form can be found at biz:rfp.
- Properties:
name
type
doc
opts
:ext:id
An externally specified identifier for the RFP.
:title
The title of the RFP.
:summary
A brief summary of the RFP.
Display:
{'hint': 'text'}
:status
The status of the RFP.
Display:
{'hint': 'enum'}
:url
The official URL for the RFP.
:file
The RFP document.
:posted
The date/time that the RFP was posted.
:quesdue
The date/time that questions are due.
:propdue
The date/time that proposals are due.
:contact
The contact information given for the org requesting offers.
:purchases
Any known purchases that resulted from the RFP.
:requirements
A typed array which indexes each field.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:service
A service which is performed by a specific organization.
The base type for the form can be found at biz:service.
- Properties:
name
type
doc
opts
:provider
The contact info of the entity which performs the service.
:name
The name of the service being performed.
:summary
A brief summary of the service.
Display:
{'hint': 'text'}
:type
A taxonomy of service types.
:launched
The time when the operator first made the service available.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
biz:stake
A stake or partial ownership in a company.
The base type for the form can be found at biz:stake.
- Properties:
name
type
doc
:vitals
The ou:vitals snapshot this stake is part of.
:org
The resolved org.
:orgname
The org name as reported by the source of the vitals.
:orgfqdn
The org FQDN as reported by the source of the vitals.
:name
An arbitrary name for this stake. Can be non-contact like “pool”.
:asof
The time the stake is being measured. Likely as part of an ou:vitals.
:shares
The number of shares represented by the stake.
:invested
The amount of money invested in the cap table iteration.
:value
The monetary value of the stake.
:percent
The percentage ownership represented by this stake.
:owner
Contact information of the owner of the stake.
:purchase
The purchase event for the stake.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:algorithm
A cryptographic algorithm name.
The base type for the form can be found at crypto:algorithm.
An example of crypto:algorithm
:
aes256
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:currency:address
An individual crypto currency address.
The base type for the form can be found at crypto:currency:address.
An example of crypto:currency:address
:
btc/1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
- Properties:
name
type
doc
opts
:coin
The crypto coin to which the address belongs.
Read Only:
True
:seed
The cryptographic key and or password used to generate the address.
:iden
The coin specific address identifier.
Read Only:
True
:desc
A free-form description of the address.
:contact
The primary contact for the crypto currency address.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:currency:block
An individual crypto currency block record on the blockchain.
The base type for the form can be found at crypto:currency:block.
- Properties:
name
type
doc
opts
:coin
The coin/blockchain this block resides on.
Read Only:
True
:offset
The index of this block.
Read Only:
True
:hash
The unique hash for the block.
:minedby
The address which mined the block.
:time
Time timestamp embedded in the block by the miner.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:currency:client
A fused node representing a crypto currency address used by an Internet client.
The base type for the form can be found at crypto:currency:client.
An example of crypto:currency:client
:
(1.2.3.4, (btc, 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2))
- Properties:
name
type
doc
opts
:inetaddr
The Internet client address observed using the crypto currency address.
Read Only:
True
:coinaddr
The crypto currency address observed in use by the Internet client.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:currency:coin
An individual crypto currency type.
The base type for the form can be found at crypto:currency:coin.
An example of crypto:currency:coin
:
btc
- Properties:
name
type
doc
:name
The full name of the crypto coin.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:currency:transaction
An individual crypto currency transaction recorded on the blockchain.
The base type for the form can be found at crypto:currency:transaction.
- Properties:
name
type
doc
opts
:hash
The unique transaction hash for the transaction.
:desc
An analyst specified description of the transaction.
:block
The block which records the transaction.
:block:coin
The coin/blockchain of the block which records this transaction.
:block:offset
The offset of the block which records this transaction.
:success
Set to true if the transaction was successfully executed and recorded.
:status:code
A coin specific status code which may represent an error reason.
:status:message
A coin specific status message which may contain an error reason.
:to
The destination address of the transaction.
:from
The source address of the transaction.
:inputs
Deprecated. Please use crypto:payment:input:transaction.
Deprecated:
True
:outputs
Deprecated. Please use crypto:payment:output:transaction.
Deprecated:
True
:fee
The total fee paid to execute the transaction.
:value
The total value of the transaction.
:time
The time this transaction was initiated.
:eth:gasused
The amount of gas used to execute this transaction.
:eth:gaslimit
The ETH gas limit specified for this transaction.
:eth:gasprice
The gas price (in ETH) specified for this transaction.
:contract:input
Input value to a smart contract call.
:contract:output
Output value of a smart contract call.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:key
A cryptographic key and algorithm.
The base type for the form can be found at crypto:key.
- Properties:
name
type
doc
opts
:algorithm
The cryptographic algorithm which uses the key material.
Example:
aes256
:mode
The algorithm specific mode in use.
:iv
The hex encoded initialization vector.
:iv:text
Set only if the :iv property decodes to ASCII.
:public
The hex encoded public key material if the algorithm has a public/private key pair.
:public:text
Set only if the :public property decodes to ASCII.
:public:md5
The MD5 hash of the public key in raw binary form.
:public:sha1
The SHA1 hash of the public key in raw binary form.
:public:sha256
The SHA256 hash of the public key in raw binary form.
:private
The hex encoded private key material. All symmetric keys are private.
:private:text
Set only if the :private property decodes to ASCII.
:private:md5
The MD5 hash of the private key in raw binary form.
:private:sha1
The SHA1 hash of the private key in raw binary form.
:private:sha256
The SHA256 hash of the private key in raw binary form.
:seed:passwd
The seed password used to generate the key material.
:seed:algorithm
The algorithm used to generate the key from the seed password.
Example:
pbkdf2
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:payment:input
A payment made into a transaction.
The base type for the form can be found at crypto:payment:input.
- Properties:
name
type
doc
:transaction
The transaction the payment was input to.
:address
The address which paid into the transaction.
:value
The value of the currency paid into the transaction.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:payment:output
A payment received from a transaction.
The base type for the form can be found at crypto:payment:output.
- Properties:
name
type
doc
:transaction
The transaction the payment was output from.
:address
The address which received payment from the transaction.
:value
The value of the currency received from the transaction.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:contract
A smart contract.
The base type for the form can be found at crypto:smart:contract.
- Properties:
name
type
doc
:transaction
The transaction which created the contract.
:address
The address of the contract.
:bytecode
The bytecode which implements the contract.
:token:name
The ERC-20 token name.
:token:symbol
The ERC-20 token symbol.
:token:totalsupply
The ERC-20 totalSupply value.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:burntoken
A smart contract effect which destroys a non-fungible token.
The base type for the form can be found at crypto:smart:effect:burntoken.
- Properties:
name
type
doc
:token
The non-fungible token that was destroyed.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:edittokensupply
A smart contract effect which increases or decreases the supply of a fungible token.
The base type for the form can be found at crypto:smart:effect:edittokensupply.
- Properties:
name
type
doc
:contract
The contract which defines the tokens.
:amount
The number of tokens added or removed if negative.
:totalsupply
The total supply of tokens after this modification.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:minttoken
A smart contract effect which creates a new non-fungible token.
The base type for the form can be found at crypto:smart:effect:minttoken.
- Properties:
name
type
doc
:token
The non-fungible token that was created.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:proxytoken
A smart contract effect which grants a non-owner address the ability to manipulate a specific non-fungible token.
The base type for the form can be found at crypto:smart:effect:proxytoken.
- Properties:
name
type
doc
:owner
The address granting proxy authority to manipulate non-fungible tokens.
:proxy
The address granted proxy authority to manipulate non-fungible tokens.
:token
The specific token being granted access to.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:proxytokenall
A smart contract effect which grants a non-owner address the ability to manipulate all non-fungible tokens of the owner.
The base type for the form can be found at crypto:smart:effect:proxytokenall.
- Properties:
name
type
doc
:contract
The contract which defines the tokens.
:owner
The address granting/denying proxy authority to manipulate all non-fungible tokens of the owner.
:proxy
The address granted/denied proxy authority to manipulate all non-fungible tokens of the owner.
:approval
The approval status.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:proxytokens
A smart contract effect which grants a non-owner address the ability to manipulate fungible tokens.
The base type for the form can be found at crypto:smart:effect:proxytokens.
- Properties:
name
type
doc
:contract
The contract which defines the tokens.
:owner
The address granting proxy authority to manipulate fungible tokens.
:proxy
The address granted proxy authority to manipulate fungible tokens.
:amount
The hex encoded amount of tokens the proxy is allowed to manipulate.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:transfertoken
A smart contract effect which transfers ownership of a non-fungible token.
The base type for the form can be found at crypto:smart:effect:transfertoken.
- Properties:
name
type
doc
:token
The non-fungible token that was transferred.
:from
The address the NFT was transferred from.
:to
The address the NFT was transferred to.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:effect:transfertokens
A smart contract effect which transfers fungible tokens.
The base type for the form can be found at crypto:smart:effect:transfertokens.
- Properties:
name
type
doc
:contract
The contract which defines the tokens.
:from
The address the tokens were transferred from.
:to
The address the tokens were transferred to.
:amount
The number of tokens transferred.
:index
The order of the effect within the effects of one transaction.
:transaction
The transaction where the smart contract was called.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:smart:token
A token managed by a smart contract.
The base type for the form can be found at crypto:smart:token.
- Properties:
name
type
doc
opts
:contract
The smart contract which defines and manages the token.
Read Only:
True
:tokenid
The token ID.
Read Only:
True
:owner
The address which currently owns the token.
:nft:url
The URL which hosts the NFT metadata.
:nft:meta
The raw NFT metadata.
:nft:meta:name
The name field from the NFT metadata.
:nft:meta:description
The description field from the NFT metadata.
Display:
{'hint': 'text'}
:nft:meta:image
The image URL from the NFT metadata.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:x509:cert
A unique X.509 certificate.
The base type for the form can be found at crypto:x509:cert.
- Properties:
name
type
doc
:file
The file that the certificate metadata was parsed from.
:subject
The subject identifier, commonly in X.500/LDAP format, to which the certificate was issued.
:issuer
The Distinguished Name (DN) of the Certificate Authority (CA) which issued the certificate.
:issuer:cert
The certificate used by the issuer to sign this certificate.
:serial
zeropad:40
The certificate serial number as a big endian hex value.
:version
enums:((0, 'v1'), (2, 'v3'))
The version integer in the certificate. (ex. 2 == v3 ).
:validity:notbefore
The timestamp for the beginning of the certificate validity period.
:validity:notafter
The timestamp for the end of the certificate validity period.
:md5
The MD5 fingerprint for the certificate.
:sha1
The SHA1 fingerprint for the certificate.
:sha256
The SHA256 fingerprint for the certificate.
:rsa:key
The optional RSA public key associated with the certificate.
:algo
The X.509 signature algorithm OID.
:signature
The hexadecimal representation of the digital signature.
:ext:sans
The Subject Alternate Names (SANs) listed in the certificate.
:ext:crls
A list of Subject Alternate Names (SANs) for Distribution Points.
:identities:fqdns
The fused list of FQDNs identified by the cert CN and SANs.
:identities:emails
The fused list of e-mail addresses identified by the cert CN and SANs.
:identities:ipv4s
The fused list of IPv4 addresses identified by the cert CN and SANs.
:identities:ipv6s
The fused list of IPv6 addresses identified by the cert CN and SANs.
:identities:urls
The fused list of URLs identified by the cert CN and SANs.
:crl:urls
The extracted URL values from the CRLs extension.
:selfsigned
Whether this is a self-signed certificate.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:x509:crl
A unique X.509 Certificate Revocation List.
The base type for the form can be found at crypto:x509:crl.
- Properties:
name
type
doc
:file
The file containing the CRL.
:url
The URL where the CRL was published.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:x509:revoked
A revocation relationship between a CRL and an X.509 certificate.
The base type for the form can be found at crypto:x509:revoked.
- Properties:
name
type
doc
opts
:crl
The CRL which revoked the certificate.
Read Only:
True
:cert
The certificate revoked by the CRL.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
crypto:x509:signedfile
A digital signature relationship between an X.509 certificate and a file.
The base type for the form can be found at crypto:x509:signedfile.
- Properties:
name
type
doc
opts
:cert
The certificate for the key which signed the file.
Read Only:
True
:file
The file which was signed by the certificates key.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
doc:policy
Guiding principles used to reach a set of goals.
The base type for the form can be found at doc:policy.
- Properties:
name
type
doc
:id
strip:True
The policy ID.
:name
The policy name.
:type
The type of policy.
:text
The text of the policy.
:file
The file which contains the policy.
:created
The time that the policy was created.
:updated
The time that the policy was last updated.
:author
The contact information of the primary author.
:contributors
An array of contacts which contributed to the policy.
:version
The version of the policy.
:supersedes
An array of policies which are superseded by this policy.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
doc:policy:type:taxonomy
A taxonomy of policy types.
The base type for the form can be found at doc:policy:type:taxonomy.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
doc:standard
A group of requirements which define how to implement a policy or goal.
The base type for the form can be found at doc:standard.
- Properties:
name
type
doc
:policy
The policy which was used to derive the standard.
:id
strip:True
The standard ID.
:name
The standard name.
:type
The type of standard.
:text
The text of the standard.
:file
The file which contains the standard.
:created
The time that the standard was created.
:updated
The time that the standard was last updated.
:author
The contact information of the primary author.
:contributors
An array of contacts which contributed to the standard.
:version
The version of the standard.
:supersedes
An array of standards which are superseded by this standard.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
doc:standard:type:taxonomy
A taxonomy of standard types.
The base type for the form can be found at doc:standard:type:taxonomy.
- Properties:
name
type
doc
opts
:title
A brief title of the definition.
:summary
Deprecated. Please use title/desc.
Deprecated:True
Display:{'hint': 'text'}
:desc
A definition of the taxonomy entry.
Display:
{'hint': 'text'}
:sort
A display sort order for siblings.
:base
The base taxon.
Read Only:
True
:depth
The depth indexed from 0.
Read Only:
True
:parent
The taxonomy parent.
Read Only:
True
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:acct:balance
A snapshot of the balance of an account at a point in time.
The base type for the form can be found at econ:acct:balance.
- Properties:
name
type
doc
:time
The time the balance was recorded.
:pay:card
The payment card holding the balance.
:crypto:address
The crypto currency address holding the balance.
:amount
The account balance at the time.
:currency
The currency of the balance amount.
:delta
The change since last regular sample.
:total:received
The total amount of currency received by the account.
:total:sent
The total amount of currency sent from the account.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:acct:invoice
An invoice issued requesting payment.
The base type for the form can be found at econ:acct:invoice.
- Properties:
name
type
doc
:issued
The time that the invoice was issued to the recipient.
:issuer
The contact information for the entity who issued the invoice.
:purchase
The purchase that the invoice is requesting payment for.
:recipient
The contact information for the intended recipient of the invoice.
:due
The time by which the payment is due.
:paid
Set to true if the invoice has been paid in full.
:amount
The balance due.
:currency
The currency that the invoice specifies for payment.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:acct:payment
A payment or crypto currency transaction.
The base type for the form can be found at econ:acct:payment.
- Properties:
name
type
doc
opts
:txnid
strip:True
A payment processor specific transaction id.
:fee
The transaction fee paid by the recipient to the payment processor.
:from:cash
Set to true if the payment input was in cash.
:to:instrument
The payment instrument which received funds from the payment.
:from:instrument
The payment instrument used to make the payment.
:from:account
Deprecated. Please use :from:instrument.
Deprecated:
True
:from:pay:card
Deprecated. Please use :from:instrument.
Deprecated:
True
:from:contract
A contract used as an aggregate payment source.
:from:coinaddr
Deprecated. Please use :from:instrument.
Deprecated:
True
:from:contact
Contact information for the entity making the payment.
:to:cash
Set to true if the payment output was in cash.
:to:account
Deprecated. Please use :to:instrument.
Deprecated:
True
:to:coinaddr
Deprecated. Please use :to:instrument.
Deprecated:
True
:to:contact
Contact information for the person/org being paid.
:to:contract
A contract used as an aggregate payment destination.
:time
The time the payment was processed.
:purchase
The purchase which the payment was paying for.
:amount
The amount of money transferred in the payment.
:currency
The currency of the payment.
:memo
A small note specified by the payer common in financial transactions.
:crypto:transaction
A crypto currency transaction that initiated the payment.
:invoice
The invoice that the payment applies to.
:receipt
The receipt that was issued for the payment.
:place
The place where the payment occurred.
:place:name
The name of the place where the payment occurred.
:place:address
The address of the place where the payment occurred.
:place:loc
The loc of the place where the payment occurred.
:place:latlong
The latlong where the payment occurred.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:bank:statement
-(has)>
econ:acct:payment
The bank statement includes the payment.
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:acct:receipt
A receipt issued as proof of payment.
The base type for the form can be found at econ:acct:receipt.
- Properties:
name
type
doc
:issued
The time the receipt was issued.
:purchase
The purchase that the receipt confirms payment for.
:issuer
The contact information for the entity who issued the receipt.
:recipient
The contact information for the entity who received the receipt.
:currency
The currency that the receipt uses to specify the price.
:amount
The price that the receipt confirms was paid.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:acquired
Deprecated. Please use econ:purchase -(acquired)> *.
The base type for the form can be found at econ:acquired.
- Properties:
name
type
doc
opts
:purchase
The purchase event which acquired an item.
Read Only:
True
:item
A reference to the item that was acquired.
Read Only:
True
:item:form
The form of item purchased.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:bank:aba:rtn
An American Bank Association (ABA) routing transit number (RTN).
The base type for the form can be found at econ:bank:aba:rtn.
- Properties:
name
type
doc
:bank
The bank which was issued the ABA RTN.
:bank:name
The name which is registered for this ABA RTN.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:bank:account
A bank account.
The base type for the form can be found at econ:bank:account.
- Properties:
name
type
doc
:type
The type of bank account.
:aba:rtn
The ABA routing transit number for the bank which issued the account.
:number
regex:[0-9]+
The account number.
:iban
The IBAN for the account.
:issuer
The bank which issued the account.
:issuer:name
The name of the bank which issued the account.
:currency
The currency of the account balance.
:balance
The most recently known bank balance information.
:contact
The primary contact for the bank account.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:bank:account:type:taxonomy
A bank account type taxonomy.
The base type for the form can be found at econ:bank:account:type:taxonomy.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:bank:balance
A balance contained by a bank account at a point in time.
The base type for the form can be found at econ:bank:balance.
- Properties:
name
type
doc
:time
The time that the account balance was observed.
:amount
The amount of currency available at the time.
:account
The bank account which contained the balance amount.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*
The attack targeted the target node.
risk:attack
-(uses)>
*
The attack used the target node to facilitate the attack.
risk:compromise
-(stole)>
*
The target node was stolen or copied as a result of the compromise.
risk:extortion
-(leveraged)>
*
The extortion event was based on attacker access to the target node.
risk:leak
-(leaked)>
*
The leak included the disclosure of the target node.
risk:outage
-(impacted)>
*
The outage event impacted the availability of the target node.
risk:threat
-(targets)>
*
The threat cluster targeted the target node.
risk:threat
-(uses)>
*
The threat cluster uses the target node.
risk:tool:software
-(uses)>
*
The tool uses the target node.
sci:evidence
-(has)>
*
The evidence includes observations from the target nodes.
sci:experiment
-(uses)>
*
The experiment used the target nodes when it was run.
sci:observation
-(has)>
*
The observations are summarized from the target nodes.
econ:bank:iban
An International Bank Account Number.
The base type for the form can be found at econ:bank:iban.
- Source Edges:
source
verb
target
doc
*
-(meets)>
ou:requirement
The requirement is met by the source node.
*
-(refs)>
*
The source node contains a reference to the target node.
*
-(seenat)>
geo:telem
Deprecated. Please use
geo:telem:node
.- Target Edges:
source
verb
target
doc
*
-(refs)>
*
None
econ:purchase
-(acquired)>
*
The purchase was used to acquire the target node.
it:app:snort:rule
-(detects)>
*
The snort rule is intended for use in detecting the target node.
it:app:yara:rule
-(detects)>
*
The YARA rule is intended for use in detecting the target node.
it:exec:query
-(found)>
*
The target node was returned as a result of running the query.
math:algorithm
-(generates)>
*
The target node was generated by the algorithm.
meta:note
-(about)>
*
The meta:note is about the target node.
meta:rule
-(detects)>
*
The meta:rule is designed to detect instances of the target node.
meta:rule
-(matches)>
*
The meta:rule has matched on target node.
meta:source
-(seen)>
*
The meta:source observed the target node.
ou:campaign
-(targets)>
*
The campaign targeted the target nodes.
ou:campaign
-(uses)>
*
The campaign made use of the target node.
ou:contribution
-(includes)>
*
The contribution includes the specific node.
ou:org
-(has)>
*
The organization is or was in possession of the target node.
ou:org
-(owns)>
*
The organization owns or owned the target node.
ou:org
-(targets)>
*
The organization targets the target node.
ou:org
-(uses)>
*
The ou:org makes use of the target node.
plan:procedure:step
-(uses)>
*
The step in the procedure makes use of the target node.
ps:contact
-(has)>
*
The contact is or was in possession of the target node.
ps:contact
-(owns)>
*
The contact owns or owned the target node.
ps:person
-(has)>
*
The person is or was in possession of the target node.
ps:person
-(owns)>
*
The person owns or owned the target node.
risk:attack
-(targets)>
*