Synapse Data Model - Types

Base Types

Base types are defined via Python classes.

array

A typed array which indexes each field. It is implemented by the following class: synapse.lib.types.Array.

The base type array has the following default options set:

  • type: int

bool

The base boolean type. It is implemented by the following class: synapse.lib.types.Bool.

comp

The base type for compound node fields. It is implemented by the following class: synapse.lib.types.Comp.

data

Arbitrary json compatible data. It is implemented by the following class: synapse.lib.types.Data.

duration

A duration value. It is implemented by the following class: synapse.lib.types.Duration.

The base type duration has the following default options set:

  • signed: False

edge

An digraph edge base type. It is implemented by the following class: synapse.lib.types.Edge.

file:base

A file name with no path. It is implemented by the following class: synapse.models.files.FileBase.

An example of file:base:

  • woot.exe

file:bytes

The file bytes type with SHA256 based primary property. It is implemented by the following class: synapse.models.files.FileBytes.

file:path

A normalized file path. It is implemented by the following class: synapse.models.files.FilePath.

An example of file:path:

  • c:/windows/system32/calc.exe

float

The base floating point type. It is implemented by the following class: synapse.lib.types.Float.

The base type float has the following default options set:

  • fmt: %f
  • min: None
  • minisvalid: True
  • max: None
  • maxisvalid: True

geo:dist

A geographic distance (base unit is mm). It is implemented by the following class: synapse.models.geospace.Dist.

An example of geo:dist:

  • 10 km

geo:latlong

A Lat/Long string specifying a point on Earth. It is implemented by the following class: synapse.models.geospace.LatLong.

An example of geo:latlong:

  • -12.45,56.78

guid

The base GUID type. It is implemented by the following class: synapse.lib.types.Guid.

hex

The base hex type. It is implemented by the following class: synapse.lib.types.Hex.

The base type hex has the following default options set:

  • size: 0

hugenum

A potentially huge/tiny number. [x] <= 170141183460469231731687 with a fractional precision of 15 decimal digits. It is implemented by the following class: synapse.lib.types.HugeNum.

The base type hugenum has the following default options set:

  • norm: True

inet:addr

A network layer URL-like format to represent tcp/udp/icmp clients and servers. It is implemented by the following class: synapse.models.inet.Addr.

An example of inet:addr:

  • tcp://1.2.3.4:80

inet:cidr4

An IPv4 address block in Classless Inter-Domain Routing (CIDR) notation. It is implemented by the following class: synapse.models.inet.Cidr4.

An example of inet:cidr4:

  • 1.2.3.0/24

inet:cidr6

An IPv6 address block in Classless Inter-Domain Routing (CIDR) notation. It is implemented by the following class: synapse.models.inet.Cidr6.

An example of inet:cidr6:

  • 2001:db8::/101

inet:dns:name

A DNS query name string. Likely an FQDN but not always. It is implemented by the following class: synapse.models.dns.DnsName.

An example of inet:dns:name:

  • vertex.link

inet:email

An e-mail address. It is implemented by the following class: synapse.models.inet.Email.

inet:fqdn

A Fully Qualified Domain Name (FQDN). It is implemented by the following class: synapse.models.inet.Fqdn.

An example of inet:fqdn:

  • vertex.link

inet:ipv4

An IPv4 address. It is implemented by the following class: synapse.models.inet.IPv4.

An example of inet:ipv4:

  • 1.2.3.4

inet:ipv4range

An IPv4 address range. It is implemented by the following class: synapse.models.inet.IPv4Range.

An example of inet:ipv4range:

  • 1.2.3.4-1.2.3.8

inet:ipv6

An IPv6 address. It is implemented by the following class: synapse.models.inet.IPv6.

An example of inet:ipv6:

  • 2607:f8b0:4004:809::200e

inet:ipv6range

An IPv6 address range. It is implemented by the following class: synapse.models.inet.IPv6Range.

An example of inet:ipv6range:

  • (2607:f8b0:4004:809::200e, 2607:f8b0:4004:809::2011)

inet:rfc2822:addr

An RFC 2822 Address field. It is implemented by the following class: synapse.models.inet.Rfc2822Addr.

An example of inet:rfc2822:addr:

  • "Visi Kenshoto" <visi@vertex.link>

inet:url

A Universal Resource Locator (URL). It is implemented by the following class: synapse.models.inet.Url.

An example of inet:url:

  • http://www.woot.com/files/index.html

int

The base 64 bit signed integer type. It is implemented by the following class: synapse.lib.types.Int.

The base type int has the following default options set:

  • size: 8
  • signed: True
  • fmt: %d
  • min: None
  • max: None
  • ismin: False
  • ismax: False

it:sec:cpe

A NIST CPE 2.3 Formatted String. It is implemented by the following class: synapse.models.infotech.Cpe23Str.

The base type it:sec:cpe has the following default options set:

  • lower: True

it:semver

Semantic Version type. It is implemented by the following class: synapse.models.infotech.SemVer.

ival

A time window/interval. It is implemented by the following class: synapse.lib.types.Ival.

loc

The base geo political location type. It is implemented by the following class: synapse.lib.types.Loc.

ndef

The node definition type for a (form,valu) compound field. It is implemented by the following class: synapse.lib.types.Ndef.

nodeprop

The nodeprop type for a (prop,valu) compound field. It is implemented by the following class: synapse.lib.types.NodeProp.

range

A base range type. It is implemented by the following class: synapse.lib.types.Range.

The base type range has the following default options set:

  • type: ('int', {})

str

The base string type. It is implemented by the following class: synapse.lib.types.Str.

The base type str has the following default options set:

  • enums: None
  • regex: None
  • lower: False
  • strip: False
  • replace: ()
  • onespace: False
  • globsuffix: False

syn:tag

The base type for a synapse tag. It is implemented by the following class: synapse.lib.types.Tag.

The base type syn:tag has the following default options set:

  • enums: None
  • regex: None
  • lower: False
  • strip: False
  • replace: ()
  • onespace: False
  • globsuffix: False

syn:tag:part

A tag component string. It is implemented by the following class: synapse.lib.types.TagPart.

The base type syn:tag:part has the following default options set:

  • enums: None
  • regex: None
  • lower: False
  • strip: False
  • replace: ()
  • onespace: False
  • globsuffix: False

tel:mob:imei

An International Mobile Equipment Id. It is implemented by the following class: synapse.models.telco.Imei.

An example of tel:mob:imei:

  • 490154203237518

tel:mob:imsi

An International Mobile Subscriber Id. It is implemented by the following class: synapse.models.telco.Imsi.

An example of tel:mob:imsi:

  • 310150123456789

tel:phone

A phone number. It is implemented by the following class: synapse.models.telco.Phone.

An example of tel:phone:

  • +15558675309

time

A date/time value. It is implemented by the following class: synapse.lib.types.Time.

The base type time has the following default options set:

  • ismin: False
  • ismax: False

timeedge

An digraph edge base type with a unique time. It is implemented by the following class: synapse.lib.types.TimeEdge.

Types

Regular types are derived from BaseTypes.

auth:access

An instance of using creds to access a resource. The auth:access type is derived from the base type: guid.

auth:creds

A unique set of credentials used to access a resource. The auth:creds type is derived from the base type: guid.

crypto:currency:address

An individual crypto currency address. The crypto:currency:address type is derived from the base type: comp.

An example of crypto:currency:address:

  • (btc, 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2)

The type crypto:currency:address has the following options set:

  • fields: (('coin', 'crypto:currency:coin'), ('iden', 'str'))

crypto:currency:client

A fused node representing a crypto currency address used by an Internet client. The crypto:currency:client type is derived from the base type: comp.

An example of crypto:currency:client:

  • (1.2.3.4, (btc, 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2))

The type crypto:currency:client has the following options set:

  • fields: (('inetaddr', 'inet:client'), ('coinaddr', 'crypto:currency:address'))

crypto:currency:coin

An individual crypto currency type. The crypto:currency:coin type is derived from the base type: str.

An example of crypto:currency:coin:

  • btc

The type crypto:currency:coin has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

crypto:x509:cert

A unique X.509 certificate. The crypto:x509:cert type is derived from the base type: guid.

crypto:x509:crl

A unique X.509 Certificate Revocation List. The crypto:x509:crl type is derived from the base type: guid.

crypto:x509:revoked

A revocation relationship between a CRL and an X.509 certificate. The crypto:x509:revoked type is derived from the base type: comp.

The type crypto:x509:revoked has the following options set:

  • fields: (('crl', 'crypto:x509:crl'), ('cert', 'crypto:x509:cert'))

crypto:x509:san

An X.509 Subject Alternative Name (SAN). The crypto:x509:san type is derived from the base type: comp.

The type crypto:x509:san has the following options set:

  • fields: (('type', 'str'), ('value', 'str'))

crypto:x509:signedfile

A digital signature relationship between an X.509 certificate and a file. The crypto:x509:signedfile type is derived from the base type: comp.

The type crypto:x509:signedfile has the following options set:

  • fields: (('cert', 'crypto:x509:cert'), ('file', 'file:bytes'))

econ:acct:payment

A payment moving currency from one monetary instrument to another. The econ:acct:payment type is derived from the base type: guid.

econ:acquired

A relationship between a purchase event and a purchased item. The econ:acquired type is derived from the base type: comp.

The type econ:acquired has the following options set:

  • fields: (('purchase', 'econ:purchase'), ('item', 'ndef'))

econ:currency

The name of a system of money in general use. The econ:currency type is derived from the base type: str.

An example of econ:currency:

  • usd

The type econ:currency has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

econ:fin:bar

A sample of the open, close, high, low prices of a security in a specific time window. The econ:fin:bar type is derived from the base type: guid.

econ:fin:exchange

A financial exchange where securities are traded. The econ:fin:exchange type is derived from the base type: guid.

econ:fin:security

A financial security which is typically traded on an exchange. The econ:fin:security type is derived from the base type: guid.

econ:fin:tick

A sample of the price of a security at a single moment in time. The econ:fin:tick type is derived from the base type: guid.

econ:pay:card

A single payment card. The econ:pay:card type is derived from the base type: guid.

econ:pay:cvv

A Card Verification Value (CVV). The econ:pay:cvv type is derived from the base type: str.

The type econ:pay:cvv has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[0-9]{1,6}$
  • replace: ()
  • strip: False

econ:pay:iin

An Issuer Id Number (IIN). The econ:pay:iin type is derived from the base type: int.

The type econ:pay:iin has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: 999999
  • min: 0
  • signed: True
  • size: 8

econ:pay:mii

A Major Industry Identifier (MII). The econ:pay:mii type is derived from the base type: int.

The type econ:pay:mii has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: 9
  • min: 0
  • signed: True
  • size: 8

econ:pay:pan

A Primary Account Number (PAN) or card number. The econ:pay:pan type is derived from the base type: str.

The type econ:pay:pan has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^(?<iin>(?<mii>[0-9]{1})[0-9]{5})[0-9]{1,13}$
  • replace: ()
  • strip: False

econ:pay:pin

A Personal Identification Number. The econ:pay:pin type is derived from the base type: str.

The type econ:pay:pin has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[0-9]{3,6}$
  • replace: ()
  • strip: False

econ:price

The amount of money expected, required, or given in payment for something. The econ:price type is derived from the base type: hugenum.

An example of econ:price:

  • 2.20

The type econ:price has the following options set:

  • norm: False

econ:purchase

A purchase event. The econ:purchase type is derived from the base type: guid.

edge:has

A digraph edge which records that N1 has N2. The edge:has type is derived from the base type: edge.

edge:refs

A digraph edge which records that N1 refers to or contains N2. The edge:refs type is derived from the base type: edge.

edge:wentto

A digraph edge which records that N1 went to N2 at a specific time. The edge:wentto type is derived from the base type: timeedge.

edu:class

An instance of an edu:course taught at a given time. The edu:class type is derived from the base type: guid.

edu:course

A course of study taught by an org. The edu:course type is derived from the base type: guid.

file:filepath

The fused knowledge of the association of a file:bytes node and a file:path. The file:filepath type is derived from the base type: comp.

The type file:filepath has the following options set:

  • fields: (('file', 'file:bytes'), ('path', 'file:path'))

file:ismime

Records one, of potentially multiple, mime types for a given file. The file:ismime type is derived from the base type: comp.

The type file:ismime has the following options set:

  • fields: (('file', 'file:bytes'), ('mime', 'file:mime'))

file:mime

A file mime name string. The file:mime type is derived from the base type: str.

An example of file:mime:

  • text/plain

The type file:mime has the following options set:

  • globsuffix: False
  • lower: 1
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

file:mime:gif

The GUID of a set of mime metadata for a .gif file. The file:mime:gif type is derived from the base type: guid.

file:mime:jpg

The GUID of a set of mime metadata for a .jpg file. The file:mime:jpg type is derived from the base type: guid.

file:mime:msdoc

The GUID of a set of mime metadata for a Microsoft Word file. The file:mime:msdoc type is derived from the base type: guid.

file:mime:msppt

The GUID of a set of mime metadata for a Microsoft Powerpoint file. The file:mime:msppt type is derived from the base type: guid.

file:mime:msxls

The GUID of a set of mime metadata for a Microsoft Excel file. The file:mime:msxls type is derived from the base type: guid.

file:mime:pe:export

The fused knowledge of a file:bytes node containing a pe named export. The file:mime:pe:export type is derived from the base type: comp.

The type file:mime:pe:export has the following options set:

  • fields: (('file', 'file:bytes'), ('name', 'str'))

file:mime:pe:resource

The fused knowledge of a file:bytes node containing a pe resource. The file:mime:pe:resource type is derived from the base type: comp.

The type file:mime:pe:resource has the following options set:

  • fields:
[
 [
  "file",
  "file:bytes"
 ],
 [
  "type",
  "pe:resource:type"
 ],
 [
  "langid",
  "pe:langid"
 ],
 [
  "resource",
  "file:bytes"
 ]
]

file:mime:pe:section

The fused knowledge a file:bytes node containing a pe section. The file:mime:pe:section type is derived from the base type: comp.

The type file:mime:pe:section has the following options set:

  • fields: (('file', 'file:bytes'), ('name', 'str'), ('sha256', 'hash:sha256'))

file:mime:pe:vsvers:info

knowledge of a file:bytes node containing vsvers info. The file:mime:pe:vsvers:info type is derived from the base type: comp.

The type file:mime:pe:vsvers:info has the following options set:

  • fields: (('file', 'file:bytes'), ('keyval', 'file:mime:pe:vsvers:keyval'))

file:mime:pe:vsvers:keyval

A key value pair found in a PE vsversion info structure. The file:mime:pe:vsvers:keyval type is derived from the base type: comp.

The type file:mime:pe:vsvers:keyval has the following options set:

  • fields: (('name', 'str'), ('value', 'str'))

file:mime:png

The GUID of a set of mime metadata for a .png file. The file:mime:png type is derived from the base type: guid.

file:mime:rtf

The GUID of a set of mime metadata for a .rtf file. The file:mime:rtf type is derived from the base type: guid.

file:mime:tif

The GUID of a set of mime metadata for a .tif file. The file:mime:tif type is derived from the base type: guid.

file:string

Deprecated. Please use the edge -(refs)> it:dev:str. The file:string type is derived from the base type: comp.

The type file:string has the following options set:

  • fields: (('file', 'file:bytes'), ('string', 'str'))

file:subfile

A parent file that fully contains the specified child file. The file:subfile type is derived from the base type: comp.

The type file:subfile has the following options set:

  • fields: (('parent', 'file:bytes'), ('child', 'file:bytes'))

geo:address

A street/mailing address string. The geo:address type is derived from the base type: str.

The type geo:address has the following options set:

  • globsuffix: False
  • lower: 1
  • onespace: 1
  • regex: None
  • replace: ()
  • strip: True

geo:altitude

A negative or positive offset from Mean Sea Level (6,371.0088km from Earths core). The geo:altitude type is derived from the base type: geo:dist.

An example of geo:altitude:

  • 10 km

The type geo:altitude has the following options set:

  • baseoff: 6371008800
  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

geo:bbox

A geospatial bounding box in (xmin, xmax, ymin, ymax) format. The geo:bbox type is derived from the base type: comp.

The type geo:bbox has the following options set:

  • fields:
[
 [
  "xmin",
  "geo:longitude"
 ],
 [
  "xmax",
  "geo:longitude"
 ],
 [
  "ymin",
  "geo:latitude"
 ],
 [
  "ymax",
  "geo:latitude"
 ]
]
  • sepr: ,

geo:json

GeoJSON structured JSON data. The geo:json type is derived from the base type: data.

The type geo:json has the following options set:

  • schema:
{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "definitions": {
  "BoundingBox": {
   "items": {
    "type": "number"
   },
   "minItems": 4,
   "type": "array"
  },
  "Feature": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "geometry": {
     "oneOf": [
      {
       "type": "null"
      },
      {
       "$ref": "#/definitions/Point"
      },
      {
       "$ref": "#/definitions/LineString"
      },
      {
       "$ref": "#/definitions/Polygon"
      },
      {
       "$ref": "#/definitions/MultiPoint"
      },
      {
       "$ref": "#/definitions/MultiLineString"
      },
      {
       "$ref": "#/definitions/MultiPolygon"
      },
      {
       "$ref": "#/definitions/GeometryCollection"
      }
     ]
    },
    "properties": {
     "oneOf": [
      {
       "type": "null"
      },
      {
       "type": "object"
      }
     ]
    },
    "type": {
     "enum": [
      "Feature"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "properties",
    "geometry"
   ],
   "title": "GeoJSON Feature",
   "type": "object"
  },
  "FeatureCollection": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "features": {
     "items": {
      "$ref": "#/definitions/Feature"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "FeatureCollection"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "features"
   ],
   "title": "GeoJSON FeatureCollection",
   "type": "object"
  },
  "GeometryCollection": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "geometries": {
     "items": {
      "oneOf": [
       {
        "$ref": "#/definitions/Point"
       },
       {
        "$ref": "#/definitions/LineString"
       },
       {
        "$ref": "#/definitions/Polygon"
       },
       {
        "$ref": "#/definitions/MultiPoint"
       },
       {
        "$ref": "#/definitions/MultiLineString"
       },
       {
        "$ref": "#/definitions/MultiPolygon"
       }
      ]
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "GeometryCollection"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "geometries"
   ],
   "title": "GeoJSON GeometryCollection",
   "type": "object"
  },
  "LineString": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/LineStringCoordinates"
    },
    "type": {
     "enum": [
      "LineString"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON LineString",
   "type": "object"
  },
  "LineStringCoordinates": {
   "items": {
    "$ref": "#/definitions/PointCoordinates"
   },
   "minItems": 2,
   "type": "array"
  },
  "LinearRingCoordinates": {
   "items": {
    "$ref": "#/definitions/PointCoordinates"
   },
   "minItems": 4,
   "type": "array"
  },
  "MultiLineString": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/LineStringCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiLineString"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiLineString",
   "type": "object"
  },
  "MultiPoint": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/PointCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiPoint"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiPoint",
   "type": "object"
  },
  "MultiPolygon": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/PolygonCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiPolygon"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiPolygon",
   "type": "object"
  },
  "Point": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/PointCoordinates"
    },
    "type": {
     "enum": [
      "Point"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON Point",
   "type": "object"
  },
  "PointCoordinates": {
   "items": {
    "type": "number"
   },
   "minItems": 2,
   "type": "array"
  },
  "Polygon": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/PolygonCoordinates"
    },
    "type": {
     "enum": [
      "Polygon"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON Polygon",
   "type": "object"
  },
  "PolygonCoordinates": {
   "items": {
    "$ref": "#/definitions/LinearRingCoordinates"
   },
   "type": "array"
  }
 },
 "oneOf": [
  {
   "$ref": "#/definitions/Point"
  },
  {
   "$ref": "#/definitions/LineString"
  },
  {
   "$ref": "#/definitions/Polygon"
  },
  {
   "$ref": "#/definitions/MultiPoint"
  },
  {
   "$ref": "#/definitions/MultiLineString"
  },
  {
   "$ref": "#/definitions/MultiPolygon"
  },
  {
   "$ref": "#/definitions/GeometryCollection"
  },
  {
   "$ref": "#/definitions/Feature"
  },
  {
   "$ref": "#/definitions/FeatureCollection"
  }
 ]
}

geo:latitude

A latitude in floating point notation. The geo:latitude type is derived from the base type: float.

An example of geo:latitude:

  • 31.337

The type geo:latitude has the following options set:

  • fmt: %f
  • max: 90.0
  • maxisvalid: True
  • min: -90.0
  • minisvalid: True

geo:longitude

A longitude in floating point notation. The geo:longitude type is derived from the base type: float.

An example of geo:longitude:

  • 31.337

The type geo:longitude has the following options set:

  • fmt: %f
  • max: 180.0
  • maxisvalid: True
  • min: -180.0
  • minisvalid: False

geo:nloc

Records a node latitude/longitude in space-time. The geo:nloc type is derived from the base type: comp.

The type geo:nloc has the following options set:

  • fields: (('ndef', 'ndef'), ('latlong', 'geo:latlong'), ('time', 'time'))

geo:place

A GUID for a geographic place. The geo:place type is derived from the base type: guid.

gov:cn:icp

A Chinese Internet Content Provider ID. The gov:cn:icp type is derived from the base type: int.

The type gov:cn:icp has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

gov:cn:mucd

A Chinese PLA MUCD. The gov:cn:mucd type is derived from the base type: int.

The type gov:cn:mucd has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

gov:intl:un:m49

UN M49 Numeric Country Code. The gov:intl:un:m49 type is derived from the base type: int.

The type gov:intl:un:m49 has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: 999
  • min: 1
  • signed: True
  • size: 8

gov:us:cage

A Commercial and Government Entity (CAGE) code. The gov:us:cage type is derived from the base type: str.

The type gov:us:cage has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

gov:us:ssn

A US Social Security Number (SSN). The gov:us:ssn type is derived from the base type: int.

The type gov:us:ssn has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

gov:us:zip

A US Postal Zip Code. The gov:us:zip type is derived from the base type: int.

The type gov:us:zip has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

graph:cluster

A generic node, used in conjunction with Edge types, to cluster arbitrary nodes to a single node in the model. The graph:cluster type is derived from the base type: guid.

graph:edge

A generic digraph edge to show relationships outside the model. The graph:edge type is derived from the base type: edge.

graph:event

A generic event node to represent events outside the model. The graph:event type is derived from the base type: guid.

graph:node

A generic node used to represent objects outside the model. The graph:node type is derived from the base type: guid.

graph:timeedge

A generic digraph time edge to show relationships outside the model. The graph:timeedge type is derived from the base type: timeedge.

hash:lm

A hex encoded Microsoft Windows LM password hash. The hash:lm type is derived from the base type: hex.

An example of hash:lm:

  • d41d8cd98f00b204e9800998ecf8427e

The type hash:lm has the following options set:

  • size: 32

hash:md5

A hex encoded MD5 hash. The hash:md5 type is derived from the base type: hex.

An example of hash:md5:

  • d41d8cd98f00b204e9800998ecf8427e

The type hash:md5 has the following options set:

  • size: 32

hash:ntlm

A hex encoded Microsoft Windows NTLM password hash. The hash:ntlm type is derived from the base type: hex.

An example of hash:ntlm:

  • d41d8cd98f00b204e9800998ecf8427e

The type hash:ntlm has the following options set:

  • size: 32

hash:sha1

A hex encoded SHA1 hash. The hash:sha1 type is derived from the base type: hex.

An example of hash:sha1:

  • da39a3ee5e6b4b0d3255bfef95601890afd80709

The type hash:sha1 has the following options set:

  • size: 40

hash:sha256

A hex encoded SHA256 hash. The hash:sha256 type is derived from the base type: hex.

An example of hash:sha256:

  • ad9f4fe922b61e674a09530831759843b1880381de686a43460a76864ca0340c

The type hash:sha256 has the following options set:

  • size: 64

hash:sha384

A hex encoded SHA384 hash. The hash:sha384 type is derived from the base type: hex.

An example of hash:sha384:

  • d425f1394e418ce01ed1579069a8bfaa1da8f32cf823982113ccbef531fa36bda9987f389c5af05b5e28035242efab6c

The type hash:sha384 has the following options set:

  • size: 96

hash:sha512

A hex encoded SHA512 hash. The hash:sha512 type is derived from the base type: hex.

An example of hash:sha512:

  • ca74fe2ff2d03b29339ad7d08ba21d192077fece1715291c7b43c20c9136cd132788239189f3441a87eb23ce2660aa243f334295902c904b5520f6e80ab91f11

The type hash:sha512 has the following options set:

  • size: 128

inet:asn

An Autonomous System Number (ASN). The inet:asn type is derived from the base type: int.

The type inet:asn has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

inet:asnet4

An Autonomous System Number (ASN) and its associated IPv4 address range. The inet:asnet4 type is derived from the base type: comp.

An example of inet:asnet4:

  • (54959, (1.2.3.4, 1.2.3.20))

The type inet:asnet4 has the following options set:

  • fields: (('asn', 'inet:asn'), ('net4', 'inet:net4'))

inet:asnet6

An Autonomous System Number (ASN) and its associated IPv6 address range. The inet:asnet6 type is derived from the base type: comp.

An example of inet:asnet6:

  • (54959, (ff::00, ff::02))

The type inet:asnet6 has the following options set:

  • fields: (('asn', 'inet:asn'), ('net6', 'inet:net6'))

inet:banner

A network protocol banner string presented by a server. The inet:banner type is derived from the base type: comp.

The type inet:banner has the following options set:

  • fields: (('server', 'inet:server'), ('text', 'it:dev:str'))

inet:client

A network client address. The inet:client type is derived from the base type: inet:addr.

An example of inet:client:

  • tcp://1.2.3.4:80

The type inet:client has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:dns:a

The result of a DNS A record lookup. The inet:dns:a type is derived from the base type: comp.

An example of inet:dns:a:

  • (vertex.link,1.2.3.4)

The type inet:dns:a has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('ipv4', 'inet:ipv4'))

inet:dns:aaaa

The result of a DNS AAAA record lookup. The inet:dns:aaaa type is derived from the base type: comp.

An example of inet:dns:aaaa:

  • (vertex.link,2607:f8b0:4004:809::200e)

The type inet:dns:aaaa has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('ipv6', 'inet:ipv6'))

inet:dns:answer

A single answer from within a DNS reply. The inet:dns:answer type is derived from the base type: guid.

inet:dns:cname

The result of a DNS CNAME record lookup. The inet:dns:cname type is derived from the base type: comp.

An example of inet:dns:cname:

  • (foo.vertex.link,vertex.link)

The type inet:dns:cname has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('cname', 'inet:fqdn'))

inet:dns:mx

The result of a DNS MX record lookup. The inet:dns:mx type is derived from the base type: comp.

An example of inet:dns:mx:

  • (vertex.link,mail.vertex.link)

The type inet:dns:mx has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('mx', 'inet:fqdn'))

inet:dns:ns

The result of a DNS NS record lookup. The inet:dns:ns type is derived from the base type: comp.

An example of inet:dns:ns:

  • (vertex.link,ns.dnshost.com)

The type inet:dns:ns has the following options set:

  • fields: (('zone', 'inet:fqdn'), ('ns', 'inet:fqdn'))

inet:dns:query

A DNS query unique to a given client. The inet:dns:query type is derived from the base type: comp.

An example of inet:dns:query:

  • (1.2.3.4, woot.com, 1)

The type inet:dns:query has the following options set:

  • fields: (('client', 'inet:client'), ('name', 'inet:dns:name'), ('type', 'int'))

inet:dns:request

A single instance of a DNS resolver request and optional reply info. The inet:dns:request type is derived from the base type: guid.

inet:dns:rev

The transformed result of a DNS PTR record lookup. The inet:dns:rev type is derived from the base type: comp.

An example of inet:dns:rev:

  • (1.2.3.4,vertex.link)

The type inet:dns:rev has the following options set:

  • fields: (('ipv4', 'inet:ipv4'), ('fqdn', 'inet:fqdn'))

inet:dns:rev6

The transformed result of a DNS PTR record for an IPv6 address. The inet:dns:rev6 type is derived from the base type: comp.

An example of inet:dns:rev6:

  • (2607:f8b0:4004:809::200e,vertex.link)

The type inet:dns:rev6 has the following options set:

  • fields: (('ipv6', 'inet:ipv6'), ('fqdn', 'inet:fqdn'))

inet:dns:soa

The result of a DNS SOA record lookup. The inet:dns:soa type is derived from the base type: guid.

inet:dns:txt

The result of a DNS MX record lookup. The inet:dns:txt type is derived from the base type: comp.

An example of inet:dns:txt:

  • (hehe.vertex.link,"fancy TXT record")

The type inet:dns:txt has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('txt', 'str'))

inet:dns:type

A DNS query/answer type integer. The inet:dns:type type is derived from the base type: int.

The type inet:dns:type has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

inet:dns:wild:a

A DNS A wild card record and the IPv4 it resolves to. The inet:dns:wild:a type is derived from the base type: comp.

The type inet:dns:wild:a has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('ipv4', 'inet:ipv4'))

inet:dns:wild:aaaa

A DNS AAAA wild card record and the IPv6 it resolves to. The inet:dns:wild:aaaa type is derived from the base type: comp.

The type inet:dns:wild:aaaa has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('ipv6', 'inet:ipv6'))

inet:download

An instance of a file downloaded from a server. The inet:download type is derived from the base type: guid.

inet:email:header

A unique email message header. The inet:email:header type is derived from the base type: comp.

The type inet:email:header has the following options set:

  • fields: (('name', 'inet:email:header:name'), ('value', 'str'))

inet:email:header:name

An email header name. The inet:email:header:name type is derived from the base type: str.

An example of inet:email:header:name:

  • subject

The type inet:email:header:name has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:email:message

A unique email message. The inet:email:message type is derived from the base type: guid.

inet:email:message:attachment

A file which was attached to an email message. The inet:email:message:attachment type is derived from the base type: comp.

The type inet:email:message:attachment has the following options set:

  • fields: (('message', 'inet:email:message'), ('file', 'file:bytes'))

inet:flow

An individual network connection between a given source and destination. The inet:flow type is derived from the base type: guid.

inet:group

A group name string. The inet:group type is derived from the base type: str.

The type inet:group has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:http:header

An HTTP protocol header key/value. The inet:http:header type is derived from the base type: comp.

The type inet:http:header has the following options set:

  • fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:http:header:name

The base string type. The inet:http:header:name type is derived from the base type: str.

The type inet:http:header:name has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:http:param

An HTTP request path query parameter. The inet:http:param type is derived from the base type: comp.

The type inet:http:param has the following options set:

  • fields: (('name', 'str'), ('value', 'str'))

inet:http:request

A single HTTP request. The inet:http:request type is derived from the base type: guid.

inet:http:request:header

An HTTP request header. The inet:http:request:header type is derived from the base type: inet:http:header.

The type inet:http:request:header has the following options set:

  • fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:http:response:header

An HTTP response header. The inet:http:response:header type is derived from the base type: inet:http:header.

The type inet:http:response:header has the following options set:

  • fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:iface

A network interface with a set of associated protocol addresses. The inet:iface type is derived from the base type: guid.

inet:mac

A 48-bit Media Access Control (MAC) address. The inet:mac type is derived from the base type: str.

An example of inet:mac:

  • aa:bb:cc:dd:ee:ff

The type inet:mac has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^([0-9a-f]{2}[:]){5}([0-9a-f]{2})$
  • replace: ()
  • strip: False

inet:net4

An IPv4 address range. The inet:net4 type is derived from the base type: inet:ipv4range.

An example of inet:net4:

  • (1.2.3.4, 1.2.3.20)

The type inet:net4 has the following options set:

  • type: ('inet:ipv4', {})

inet:net6

An IPv6 address range. The inet:net6 type is derived from the base type: inet:ipv6range.

An example of inet:net6:

  • ('ff::00', 'ff::30')

The type inet:net6 has the following options set:

  • type: ('inet:ipv6', {})

inet:passwd

A password string. The inet:passwd type is derived from the base type: str.

The type inet:passwd has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:port

A network port. The inet:port type is derived from the base type: int.

An example of inet:port:

  • 80

The type inet:port has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: 65535
  • min: 0
  • signed: True
  • size: 8

inet:search:query

An instance of a search query issued to a search engine. The inet:search:query type is derived from the base type: guid.

inet:search:result

A single result from a web search. The inet:search:result type is derived from the base type: guid.

inet:server

A network server address. The inet:server type is derived from the base type: inet:addr.

An example of inet:server:

  • tcp://1.2.3.4:80

The type inet:server has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:servfile

A file hosted on a server for access over a network protocol. The inet:servfile type is derived from the base type: comp.

The type inet:servfile has the following options set:

  • fields: (('server', 'inet:server'), ('file', 'file:bytes'))

inet:ssl:cert

An SSL certificate file served by a server. The inet:ssl:cert type is derived from the base type: comp.

An example of inet:ssl:cert:

  • (1.2.3.4:443, guid:d41d8cd98f00b204e9800998ecf8427e)

The type inet:ssl:cert has the following options set:

  • fields: (('server', 'inet:server'), ('file', 'file:bytes'))

inet:url:mirror

A URL mirror site. The inet:url:mirror type is derived from the base type: comp.

The type inet:url:mirror has the following options set:

  • fields: (('of', 'inet:url'), ('at', 'inet:url'))

inet:urlfile

A file hosted at a specific Universal Resource Locator (URL). The inet:urlfile type is derived from the base type: comp.

The type inet:urlfile has the following options set:

  • fields: (('url', 'inet:url'), ('file', 'file:bytes'))

inet:urlredir

A URL that redirects to another URL, such as via a URL shortening service or an HTTP 302 response. The inet:urlredir type is derived from the base type: comp.

An example of inet:urlredir:

  • (http://foo.com/,http://bar.com/)

The type inet:urlredir has the following options set:

  • fields: (('src', 'inet:url'), ('dst', 'inet:url'))

inet:user

A username string. The inet:user type is derived from the base type: str.

The type inet:user has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:web:acct

An account with a given Internet-based site or service. The inet:web:acct type is derived from the base type: comp.

An example of inet:web:acct:

  • twitter.com/invisig0th

The type inet:web:acct has the following options set:

  • fields: (('site', 'inet:fqdn'), ('user', 'inet:user'))
  • sepr: /

inet:web:action

An instance of an account performing an action at an Internet-based site or service. The inet:web:action type is derived from the base type: guid.

inet:web:chprofile

A change to a web account. Used to capture historical properties associated with an account, as opposed to current data in the inet:web:acct node. The inet:web:chprofile type is derived from the base type: guid.

inet:web:file

A file posted by a web account. The inet:web:file type is derived from the base type: comp.

The type inet:web:file has the following options set:

  • fields: (('acct', 'inet:web:acct'), ('file', 'file:bytes'))

inet:web:follows

A web account follows or is connected to another web account. The inet:web:follows type is derived from the base type: comp.

The type inet:web:follows has the following options set:

  • fields: (('follower', 'inet:web:acct'), ('followee', 'inet:web:acct'))

inet:web:group

A group hosted within or registered with a given Internet-based site or service. The inet:web:group type is derived from the base type: comp.

An example of inet:web:group:

  • somesite.com/mycoolgroup

The type inet:web:group has the following options set:

  • fields: (('site', 'inet:fqdn'), ('id', 'inet:group'))
  • sepr: /

inet:web:hashtag

A hashtag used in a web post. The inet:web:hashtag type is derived from the base type: str.

The type inet:web:hashtag has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^#[\w]+$
  • replace: ()
  • strip: False

inet:web:logon

An instance of an account authenticating to an Internet-based site or service. The inet:web:logon type is derived from the base type: guid.

inet:web:memb

A web account that is a member of a web group. The inet:web:memb type is derived from the base type: comp.

The type inet:web:memb has the following options set:

  • fields: (('acct', 'inet:web:acct'), ('group', 'inet:web:group'))

inet:web:mesg

A message sent from one web account to another web account. The inet:web:mesg type is derived from the base type: comp.

An example of inet:web:mesg:

  • ((twitter.com, invisig0th), (twitter.com, gobbles), 20041012130220)

The type inet:web:mesg has the following options set:

  • fields: (('from', 'inet:web:acct'), ('to', 'inet:web:acct'), ('time', 'time'))

inet:web:post

A post made by a web account. The inet:web:post type is derived from the base type: guid.

inet:whois:contact

An individual contact from a domain whois record. The inet:whois:contact type is derived from the base type: comp.

The type inet:whois:contact has the following options set:

  • fields: (('rec', 'inet:whois:rec'), ('type', ('str', {'lower': True})))

inet:whois:email

An email address associated with an FQDN via whois registration text. The inet:whois:email type is derived from the base type: comp.

The type inet:whois:email has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('email', 'inet:email'))

inet:whois:ipcontact

An individual contact from an IP block record. The inet:whois:ipcontact type is derived from the base type: guid.

inet:whois:ipquery

Query details used to retrieve an IP record. The inet:whois:ipquery type is derived from the base type: guid.

inet:whois:iprec

An IPv4/IPv6 block registration record. The inet:whois:iprec type is derived from the base type: guid.

inet:whois:rar

A domain registrar. The inet:whois:rar type is derived from the base type: str.

An example of inet:whois:rar:

  • godaddy, inc.

The type inet:whois:rar has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:whois:rec

A domain whois record. The inet:whois:rec type is derived from the base type: comp.

The type inet:whois:rec has the following options set:

  • fields: (('fqdn', 'inet:fqdn'), ('asof', 'time'))

inet:whois:recns

A nameserver associated with a domain whois record. The inet:whois:recns type is derived from the base type: comp.

The type inet:whois:recns has the following options set:

  • fields: (('ns', 'inet:fqdn'), ('rec', 'inet:whois:rec'))

inet:whois:reg

A domain registrant. The inet:whois:reg type is derived from the base type: str.

An example of inet:whois:reg:

  • woot hostmaster

The type inet:whois:reg has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:whois:regid

The registry unique identifier of the registration record. The inet:whois:regid type is derived from the base type: str.

An example of inet:whois:regid:

  • NET-10-0-0-0-1

The type inet:whois:regid has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

inet:wifi:ap

An SSID/MAC address combination for a wireless access point. The inet:wifi:ap type is derived from the base type: comp.

The type inet:wifi:ap has the following options set:

  • fields: (('ssid', 'inet:wifi:ssid'), ('bssid', 'inet:mac'))

inet:wifi:ssid

A WiFi service set identifier (SSID) name. The inet:wifi:ssid type is derived from the base type: str.

An example of inet:wifi:ssid:

  • The Vertex Project

The type inet:wifi:ssid has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

iso:3166:cc

An ISO 3166 2 digit country code. The iso:3166:cc type is derived from the base type: str.

The type iso:3166:cc has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z]{2}$
  • replace: ()
  • strip: False

iso:oid

An ISO Object Identifier string. The iso:oid type is derived from the base type: str.

The type iso:oid has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^([0-2])((\.0)|(\.[1-9][0-9]*))*$
  • replace: ()
  • strip: False

it:account

A GUID that represents an account on a host or network. The it:account type is derived from the base type: guid.

it:adid

An advertising identification string. The it:adid type is derived from the base type: str.

The type it:adid has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

it:app:snort:hit

An instance of a snort rule hit. The it:app:snort:hit type is derived from the base type: guid.

it:app:snort:rule

A snort rule unique identifier. The it:app:snort:rule type is derived from the base type: guid.

it:app:yara:match

A yara rule match to a file. The it:app:yara:match type is derived from the base type: comp.

The type it:app:yara:match has the following options set:

  • fields: (('rule', 'it:app:yara:rule'), ('file', 'file:bytes'))

it:app:yara:rule

A yara rule unique identifier. The it:app:yara:rule type is derived from the base type: guid.

it:auth:passwdhash

An instance of a password hash. The it:auth:passwdhash type is derived from the base type: guid.

it:av:filehit

A file that triggered an alert on a specific antivirus signature. The it:av:filehit type is derived from the base type: comp.

The type it:av:filehit has the following options set:

  • fields: (('file', 'file:bytes'), ('sig', 'it:av:sig'))

it:av:sig

A signature name within the namespace of an antivirus engine name. The it:av:sig type is derived from the base type: comp.

The type it:av:sig has the following options set:

  • fields: (('soft', 'it:prod:soft'), ('name', ('str', {'lower': True})))

it:cmd

A unique command-line string. The it:cmd type is derived from the base type: str.

An example of it:cmd:

  • foo.exe --dostuff bar

The type it:cmd has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

it:dev:int

A developer selected integer constant. The it:dev:int type is derived from the base type: int.

The type it:dev:int has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

it:dev:mutex

A string representing a mutex. The it:dev:mutex type is derived from the base type: str.

The type it:dev:mutex has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:dev:pipe

A string representing a named pipe. The it:dev:pipe type is derived from the base type: str.

The type it:dev:pipe has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:dev:regkey

A Windows registry key. The it:dev:regkey type is derived from the base type: str.

An example of it:dev:regkey:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The type it:dev:regkey has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:dev:regval

A Windows registry key/value pair. The it:dev:regval type is derived from the base type: guid.

it:dev:str

A developer-selected string. The it:dev:str type is derived from the base type: str.

The type it:dev:str has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:domain

A logical boundary of authentication and configuration such as a windows domain. The it:domain type is derived from the base type: guid.

it:exec:bind

An instance of a host binding a listening port. The it:exec:bind type is derived from the base type: guid.

it:exec:file:add

An instance of a host adding a file to a filesystem. The it:exec:file:add type is derived from the base type: guid.

it:exec:file:del

An instance of a host deleting a file from a filesystem. The it:exec:file:del type is derived from the base type: guid.

it:exec:file:read

An instance of a host reading a file from a filesystem. The it:exec:file:read type is derived from the base type: guid.

it:exec:file:write

An instance of a host writing a file to a filesystem. The it:exec:file:write type is derived from the base type: guid.

it:exec:mutex

A mutex created by a process at runtime. The it:exec:mutex type is derived from the base type: guid.

it:exec:pipe

A named pipe created by a process at runtime. The it:exec:pipe type is derived from the base type: guid.

it:exec:proc

A process executing on a host. May be an actual (e.g., endpoint) or virtual (e.g., malware sandbox) host. The it:exec:proc type is derived from the base type: guid.

it:exec:reg:del

An instance of a host deleting a registry key. The it:exec:reg:del type is derived from the base type: guid.

it:exec:reg:get

An instance of a host getting a registry key. The it:exec:reg:get type is derived from the base type: guid.

it:exec:reg:set

An instance of a host creating or setting a registry key. The it:exec:reg:set type is derived from the base type: guid.

it:exec:url

An instance of a host requesting a URL. The it:exec:url type is derived from the base type: guid.

it:fs:file

A file on a host. The it:fs:file type is derived from the base type: guid.

it:group

A GUID that represents a group on a host or network. The it:group type is derived from the base type: guid.

it:host

A GUID that represents a host or system. The it:host type is derived from the base type: guid.

it:hostname

The name of a host or system. The it:hostname type is derived from the base type: str.

The type it:hostname has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

it:hostsoft

A version of a software product which is present on a given host. The it:hostsoft type is derived from the base type: comp.

The type it:hostsoft has the following options set:

  • fields: (('host', 'it:host'), ('softver', 'it:prod:softver'))

it:hosturl

A url hosted on or served by a host or system. The it:hosturl type is derived from the base type: comp.

The type it:hosturl has the following options set:

  • fields: (('host', 'it:host'), ('url', 'inet:url'))

it:log:event

A GUID representing an individual log event. The it:log:event type is derived from the base type: guid.

it:logon

A GUID that represents an individual logon/logoff event. The it:logon type is derived from the base type: guid.

it:mitre:attack:group

A Mitre ATT&CK Group ID. The it:mitre:attack:group type is derived from the base type: str.

An example of it:mitre:attack:group:

  • G0100

The type it:mitre:attack:group has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^G[0-9]{4}$
  • replace: ()
  • strip: False

it:mitre:attack:mitigation

A Mitre ATT&CK Mitigation ID. The it:mitre:attack:mitigation type is derived from the base type: str.

An example of it:mitre:attack:mitigation:

  • M1036

The type it:mitre:attack:mitigation has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^M[0-9]{4}$
  • replace: ()
  • strip: False

it:mitre:attack:software

A Mitre ATT&CK Software ID. The it:mitre:attack:software type is derived from the base type: str.

An example of it:mitre:attack:software:

  • S0154

The type it:mitre:attack:software has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^S[0-9]{4}$
  • replace: ()
  • strip: False

it:mitre:attack:status

A Mitre ATT&CK element status. The it:mitre:attack:status type is derived from the base type: str.

An example of it:mitre:attack:status:

  • current

The type it:mitre:attack:status has the following options set:

  • enums:

    valu
    current
    deprecated
    withdrawn
  • globsuffix: False

  • lower: False

  • onespace: False

  • regex: None

  • replace: ()

  • strip: False

it:mitre:attack:tactic

A Mitre ATT&CK Tactic ID. The it:mitre:attack:tactic type is derived from the base type: str.

An example of it:mitre:attack:tactic:

  • TA0040

The type it:mitre:attack:tactic has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^TA[0-9]{4}$
  • replace: ()
  • strip: False

it:mitre:attack:technique

A Mitre ATT&CK Technique ID. The it:mitre:attack:technique type is derived from the base type: str.

An example of it:mitre:attack:technique:

  • T1548

The type it:mitre:attack:technique has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^T[0-9]{4}(.[0-9]{3})?$
  • replace: ()
  • strip: False

it:network

A GUID that represents a logical network. The it:network type is derived from the base type: guid.

it:os:android:aaid

An android advertising identification string. The it:os:android:aaid type is derived from the base type: it:adid.

The type it:os:android:aaid has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

it:os:android:ibroadcast

The given software broadcasts the given Android intent. The it:os:android:ibroadcast type is derived from the base type: comp.

The type it:os:android:ibroadcast has the following options set:

  • fields: (('app', 'it:prod:soft'), ('intent', 'it:os:android:intent'))

it:os:android:ilisten

The given software listens for an android intent. The it:os:android:ilisten type is derived from the base type: comp.

The type it:os:android:ilisten has the following options set:

  • fields: (('app', 'it:prod:soft'), ('intent', 'it:os:android:intent'))

it:os:android:intent

An android intent string. The it:os:android:intent type is derived from the base type: str.

The type it:os:android:intent has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:os:android:perm

An android permission string. The it:os:android:perm type is derived from the base type: str.

The type it:os:android:perm has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:os:android:reqperm

The given software requests the android permission. The it:os:android:reqperm type is derived from the base type: comp.

The type it:os:android:reqperm has the following options set:

  • fields: (('app', 'it:prod:soft'), ('perm', 'it:os:android:perm'))

it:os:ios:idfa

An iOS advertising identification string. The it:os:ios:idfa type is derived from the base type: it:adid.

The type it:os:ios:idfa has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

it:os:windows:sid

A Microsoft Windows Security Identifier. The it:os:windows:sid type is derived from the base type: str.

An example of it:os:windows:sid:

  • S-1-5-21-1220945662-1202665555-839525555-5555

The type it:os:windows:sid has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3}$
  • replace: ()
  • strip: False

it:prod:soft

A arbitrary, unversioned software product. The it:prod:soft type is derived from the base type: guid.

it:prod:softfile

A file is distributed by a specific software version. The it:prod:softfile type is derived from the base type: comp.

The type it:prod:softfile has the following options set:

  • fields: (('soft', 'it:prod:softver'), ('file', 'file:bytes'))

it:prod:softlib

A software version contains a library software version. The it:prod:softlib type is derived from the base type: comp.

The type it:prod:softlib has the following options set:

  • fields: (('soft', 'it:prod:softver'), ('lib', 'it:prod:softver'))

it:prod:softos

The software version is known to be compatible with the given os software version. The it:prod:softos type is derived from the base type: comp.

The type it:prod:softos has the following options set:

  • fields: (('soft', 'it:prod:softver'), ('os', 'it:prod:softver'))

it:prod:softver

A specific version of a software product. The it:prod:softver type is derived from the base type: guid.

it:reveng:filefunc

An instance of a function in an executable. The it:reveng:filefunc type is derived from the base type: comp.

The type it:reveng:filefunc has the following options set:

  • fields: (('file', 'file:bytes'), ('function', 'it:reveng:function'))

it:reveng:funcstr

A reference to a string inside a function. The it:reveng:funcstr type is derived from the base type: comp.

The type it:reveng:funcstr has the following options set:

  • fields: (('function', 'it:reveng:function'), ('string', 'str'))

it:reveng:function

A function inside an executable. The it:reveng:function type is derived from the base type: guid.

it:reveng:impfunc

A function from an imported library. The it:reveng:impfunc type is derived from the base type: str.

The type it:reveng:impfunc has the following options set:

  • globsuffix: False
  • lower: 1
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

it:sec:cve

A vulnerability as designated by a Common Vulnerabilities and Exposures (CVE) number. The it:sec:cve type is derived from the base type: str.

An example of it:sec:cve:

  • cve-2012-0158

The type it:sec:cve has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: (?i)^CVE-[0-9]{4}-[0-9]{4,}$
  • replace: ()
  • strip: False

it:sec:cwe

NIST NVD Common Weaknesses Enumeration Specification. The it:sec:cwe type is derived from the base type: str.

An example of it:sec:cwe:

  • CWE-120

The type it:sec:cwe has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^CWE-[0-9]{1,8}$
  • replace: ()
  • strip: False

lang:code

An optionally 2 part language code. The lang:code type is derived from the base type: str.

An example of lang:code:

  • pt.br

The type lang:code has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z]{2}(.[a-z]{2})?$
  • replace: ()
  • strip: False

lang:idiom

Deprecated. Please use lang:translation. The lang:idiom type is derived from the base type: str.

The type lang:idiom has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

lang:trans

Deprecated. Please use lang:translation. The lang:trans type is derived from the base type: str.

The type lang:trans has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

lang:translation

A translation of text from one language to another. The lang:translation type is derived from the base type: guid.

mat:item

A GUID assigned to a material object. The mat:item type is derived from the base type: guid.

mat:itemimage

The base type for compound node fields. The mat:itemimage type is derived from the base type: comp.

The type mat:itemimage has the following options set:

  • fields: (('item', 'mat:item'), ('file', 'file:bytes'))

mat:spec

A GUID assigned to a material specification. The mat:spec type is derived from the base type: guid.

mat:specimage

The base type for compound node fields. The mat:specimage type is derived from the base type: comp.

The type mat:specimage has the following options set:

  • fields: (('spec', 'mat:spec'), ('file', 'file:bytes'))

media:news

A GUID for a news article or report. The media:news type is derived from the base type: guid.

meta:seen

Annotates that the data in a node was obtained from or observed by a given source. The meta:seen type is derived from the base type: comp.

The type meta:seen has the following options set:

  • fields: (('source', 'meta:source'), ('node', 'ndef'))

meta:source

A data source unique identifier. The meta:source type is derived from the base type: guid.

ou:alias

An alias for the org GUID. The ou:alias type is derived from the base type: str.

An example of ou:alias:

  • vertexproject

The type ou:alias has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[0-9a-z_]+$
  • replace: ()
  • strip: False

ou:attendee

A node representing a person attending a meeting, conference, or event. The ou:attendee type is derived from the base type: guid.

ou:award

An award issued by an organization. The ou:award type is derived from the base type: guid.

ou:campaign

Represents an orgs activity in pursuit of a goal. The ou:campaign type is derived from the base type: guid.

ou:conference

A conference with a name and sponsoring org. The ou:conference type is derived from the base type: guid.

ou:conference:attendee

Deprecated. Please use ou:attendee. The ou:conference:attendee type is derived from the base type: comp.

The type ou:conference:attendee has the following options set:

  • fields: (('conference', 'ou:conference'), ('person', 'ps:person'))

ou:conference:event

A conference event with a name and associated conference. The ou:conference:event type is derived from the base type: guid.

ou:conference:event:attendee

Deprecated. Please use ou:attendee. The ou:conference:event:attendee type is derived from the base type: comp.

The type ou:conference:event:attendee has the following options set:

  • fields: (('conference', 'ou:conference:event'), ('person', 'ps:person'))

ou:contest

A competitive event resulting in a ranked set of participants. The ou:contest type is derived from the base type: guid.

ou:contest:result

The results from a single contest participant. The ou:contest:result type is derived from the base type: comp.

The type ou:contest:result has the following options set:

  • fields: (('contest', 'ou:contest'), ('participant', 'ps:contact'))

ou:contract

An contract between multiple entities. The ou:contract type is derived from the base type: guid.

ou:contract:type

A pre-defined set of contract types. The ou:contract:type type is derived from the base type: str.

The type ou:contract:type has the following options set:

  • enum: ('nda', 'other', 'grant', 'treaty', 'purchase', 'indemnity', 'partnership')
  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

ou:goal

An assessed or stated goal which may be abstract or org specific. The ou:goal type is derived from the base type: guid.

ou:hasalias

The knowledge that an organization has an alias. The ou:hasalias type is derived from the base type: comp.

The type ou:hasalias has the following options set:

  • fields: (('org', 'ou:org'), ('alias', 'ou:alias'))

ou:hasgoal

An org has an assessed or stated goal. The ou:hasgoal type is derived from the base type: comp.

The type ou:hasgoal has the following options set:

  • fields: (('org', 'ou:org'), ('goal', 'ou:goal'))

ou:id:number

A unique id number issued by a specific organization. The ou:id:number type is derived from the base type: comp.

The type ou:id:number has the following options set:

  • fields: (('type', 'ou:id:type'), ('value', 'ou:id:value'))

ou:id:type

A type of id number issued by an org. The ou:id:type type is derived from the base type: guid.

ou:id:update

A status update to an org:id:number. The ou:id:update type is derived from the base type: guid.

ou:id:value

The value of an org:id:number. The ou:id:value type is derived from the base type: str.

The type ou:id:value has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

ou:industry

An industry classification type. The ou:industry type is derived from the base type: guid.

ou:isic

An International Standard Industrial Classification of All Economic Activities (ISIC) code. The ou:isic type is derived from the base type: str.

An example of ou:isic:

  • C1393

The type ou:isic has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[A-Z]([0-9]{2}[0-9]{0,2})?$
  • replace: ()
  • strip: False

ou:meet

An informal meeting of people which has no title or sponsor. See also: ou:conference. The ou:meet type is derived from the base type: guid.

ou:meet:attendee

Deprecated. Please use ou:attendee. The ou:meet:attendee type is derived from the base type: comp.

The type ou:meet:attendee has the following options set:

  • fields: (('meet', 'ou:meet'), ('person', 'ps:person'))

ou:member

Deprecated. Please use ou:position. The ou:member type is derived from the base type: comp.

The type ou:member has the following options set:

  • fields: (('org', 'ou:org'), ('person', 'ps:person'))

ou:naics

The five or six digit North American Industry Classification System code. The ou:naics type is derived from the base type: str.

An example of ou:naics:

  • 541715

The type ou:naics has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[1-9][0-9]{4}[0-9]?$
  • replace: ()
  • strip: False

ou:name

The name of an organization. This may be a formal name or informal name of the organization. The ou:name type is derived from the base type: str.

An example of ou:name:

  • acme corporation

The type ou:name has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

ou:org

A GUID for a human organization such as a company or military unit. The ou:org type is derived from the base type: guid.

ou:org:has

An org owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ou:org:has type is derived from the base type: comp.

The type ou:org:has has the following options set:

  • fields: (('org', 'ou:org'), ('node', 'ndef'))

ou:orgnet4

An organization’s IPv4 netblock. The ou:orgnet4 type is derived from the base type: comp.

The type ou:orgnet4 has the following options set:

  • fields: (('org', 'ou:org'), ('net', 'inet:net4'))

ou:orgnet6

An organization’s IPv6 netblock. The ou:orgnet6 type is derived from the base type: comp.

The type ou:orgnet6 has the following options set:

  • fields: (('org', 'ou:org'), ('net', 'inet:net6'))

ou:position

A position within an org. May be organized into an org chart. The ou:position type is derived from the base type: guid.

ou:preso

A webinar, conference talk, or other type of presentation. The ou:preso type is derived from the base type: guid.

ou:role

A named role when participating in an event. The ou:role type is derived from the base type: str.

An example of ou:role:

  • staff

The type ou:role has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^\w+$
  • replace: ()
  • strip: False

ou:sic

The four digit Standard Industrial Classification Code. The ou:sic type is derived from the base type: str.

An example of ou:sic:

  • 0111

The type ou:sic has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[0-9]{4}$
  • replace: ()
  • strip: False

ou:suborg

Any parent/child relationship between two orgs. May represent ownership, organizational structure, etc. The ou:suborg type is derived from the base type: comp.

The type ou:suborg has the following options set:

  • fields: (('org', 'ou:org'), ('sub', 'ou:org'))

ou:user

A user name within an organization. The ou:user type is derived from the base type: comp.

The type ou:user has the following options set:

  • fields: (('org', 'ou:org'), ('user', 'inet:user'))

pe:langid

The PE language id. The pe:langid type is derived from the base type: int.

The type pe:langid has the following options set:

  • enums:

    int valu
    0 neutral
    4 zh-Hans
    26 hr
    127 invariant
    1024 default
    1025 ar-SA
    1026 bg-BG
    1027 ca-ES
    1029 cs-CZ
    1030 da-DK
    1031 de-DE
    1032 el-GR
    1033 en-US
    1034 es-ES-traditional
    1035 fi-FI
    1036 fr-FR
    1037 he-IL
    1038 hu-HU
    1039 is-IS
    1040 it-IT
    1041 ja-JP
    1042 ko-KR
    1043 nl-NL
    1044 nb-NO
    1045 pl-PL
    1046 pt-BR
    1047 rm-CH
    1048 ro-RO
    1049 ru-RU
    1050 hr-HR
    1051 sk-SK
    1052 sq-AL
    1053 sv-SE
    1054 th-TH
    1055 tr-TR
    1056 ur-PK
    1057 id-ID
    1058 uk-UA
    1059 be-BY
    1060 sl-SI
    1061 et-EE
    1062 lv-LV
    1063 lt-LT
    1064 tg-TJ
    1065 fa-IR
    1066 vi-VN
    1067 hy-AM
    1068 az-AZ-Latin
    1069 Basque-Basque
    1070 hsb-DE
    1071 mk-MK
    1074 tn-ZA
    1076 xh-ZA
    1077 zu-ZA
    1078 af-ZA
    1079 ka-GE
    1080 fo-FO
    1081 hi-IN
    1082 mt-MT
    1083 se-NO
    1086 ms-MY
    1087 kk-KZ
    1088 ky-KG
    1089 sw-KE
    1090 tk-TM
    1091 uz-UZ-Latin
    1092 tt-RU
    1093 bn-Bangledesh
    1094 pa-IN
    1095 gu-IN
    1096 or-IN
    1097 ta-IN
    1098 te-IN
    1099 kn-IN
    1100 ml-IN
    1101 as-IN
    1102 mr-IN
    1103 sa-IN
    1104 mn-MN-Cyrllic
    1105 bo-CN
    1106 cy-GB
    1107 kh-KH
    1108 lo-LA
    1110 gl-ES
    1111 kok-IN
    1114 syr-SY
    1115 si-LK
    1116 chr-Cher
    1117 iu-CA
    1118 am-ET
    1121 ne-NP
    1122 fy-NL
    1123 ps-AF
    1124 fil-PH
    1125 dv-MV
    1128 ha-NG
    1130 yo-NG
    1131 quz-BO
    1132 nso-ZA
    1133 ba-RU
    1134 lb-LU
    1135 kl-GL
    1136 ig-NG
    1139 ti-ET
    1141 haw-US
    1144 ii-CN
    1146 arn-CL
    1148 moh-CA
    1150 br-FR
    1152 ug-CN
    1153 mi-NZ
    1154 oc-FR
    1155 co-FR
    1156 gsw-FR
    1157 sah-RU
    1158 qut-GT
    1159 rw-RW
    1160 wo-SN
    1164 prs-AF
    1170 ku-IQ
    2048 sys default
    2049 ar-IQ
    2051 ca-ES-Valencia
    2055 de-CH
    2057 en-GB
    2058 es-MX
    2060 fr-BE
    2064 it-CH
    2067 nl-BE
    2068 no-NO
    2070 pt-PT
    2074 sr-CS-Latin
    2077 sv-FI
    2080 ur-IN
    2092 az-AZ-Cyrillic
    2094 dsb-DE
    2098 tn-BW
    2107 se-SE
    2108 ga-IE
    2110 ms-BN
    2115 uz-UZ-Cyrillic
    2117 bn-IN
    2118 pa-PK
    2121 ta-LK
    2128 mn-MN-Prc
    2137 sd-PK
    2141 iu-CA-Latin
    2143 tzm-DZ
    2151 ff-SN
    2155 quz-EC
    2163 ti-ER
    3072 custom default
    3073 ar-EG
    3076 zh-HK
    3079 de-AT
    3081 en-AU
    3082 es-ES-modern
    3084 fr-CA
    3098 sr-CS-Cyrillic
    3131 se-FI
    3179 quz-PE
    4096 custom unspecified
    4097 ar-LY
    4100 zh-SG
    4103 de-LU
    4105 en-CA
    4106 es-GT
    4108 fr-CH
    4122 hr-BA
    4155 smj-NO
    5120 ui_custom_default
    5121 ar-DZ
    5124 zh-MO
    5127 de-LI
    5129 en-NZ
    5130 es-CR
    5132 fr-LU
    5146 bs-BA-Latin
    5179 smj-SE
    6145 ar-MA
    6153 en-IE
    6154 es-PA
    6156 fr-MC
    6170 sr-code-Latin
    6203 sma-NO
    7169 ar-TN
    7177 en-ZA
    7178 es-DO
    7194 sr-BA
    7227 sma-SE
    8193 ar-OM
    8201 en-JM
    8202 es-VE
    8218 bs-BA-Cyrillic
    8251 sms-FI
    9217 ar-YE
    9225 en-029
    9226 es-CO
    9275 smn-FIl
    10241 ar-SY
    10249 en-BZ
    10250 es-PE
    11265 ar-JO
    11273 en-TT
    11274 es-AR
    12289 ar-LB
    12297 en-ZW
    12298 es-EC
    13313 ar-KW
    13321 en-PH
    13322 es-CL
    14337 ar-AE
    14346 es-UY
    15361 ar-BH
    15370 es-PY
    16385 ar-QA
    16393 en-IN
    16394 es-BO
    17417 en-MY
    17418 es-SV
    18441 en-SG
    18442 es-HN
    19466 es-NI
    20490 es-PR
    21514 es-US
    30746 bs-neutral
    31748 zh-Hant
    31770 sr-Neutral
  • fmt: %d

  • ismax: False

  • ismin: False

  • max: None

  • min: None

  • signed: True

  • size: 8

pe:resource:type

The typecode for the resource. The pe:resource:type type is derived from the base type: int.

The type pe:resource:type has the following options set:

  • enums:

    int valu
    1 RT_CURSOR
    2 RT_BITMAP
    3 RT_ICON
    4 RT_MENU
    5 RT_DIALOG
    6 RT_STRING
    7 RT_FONTDIR
    8 RT_FONT
    9 RT_ACCELERATOR
    10 RT_RCDATA
    11 RT_MESSAGETABLE
    12 RT_GROUP_CURSOR
    14 RT_GROUP_ICON
    16 RT_VERSION
    17 RT_DLGINCLUDE
    19 RT_PLUGPLAY
    20 RT_VXD
    21 RT_ANICURSOR
    22 RT_ANIICON
    23 RT_HTML
    24 RT_MANIFEST
  • fmt: %d

  • ismax: False

  • ismin: False

  • max: None

  • min: None

  • signed: True

  • size: 8

pol:country

A GUID for a country. The pol:country type is derived from the base type: guid.

pol:iso2

The 2 digit ISO country code. The pol:iso2 type is derived from the base type: str.

An example of pol:iso2:

  • us

The type pol:iso2 has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z0-9]{2}$
  • replace: ()
  • strip: False

pol:iso3

The 3 digit ISO country code. The pol:iso3 type is derived from the base type: str.

An example of pol:iso3:

  • usa

The type pol:iso3 has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z0-9]{3}$
  • replace: ()
  • strip: False

pol:isonum

The ISO integer country code. The pol:isonum type is derived from the base type: int.

An example of pol:isonum:

  • 840

The type pol:isonum has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

proj:comment

The base GUID type. The proj:comment type is derived from the base type: guid.

proj:epic

The base GUID type. The proj:epic type is derived from the base type: guid.

proj:project

The base GUID type. The proj:project type is derived from the base type: guid.

proj:sprint

The base GUID type. The proj:sprint type is derived from the base type: guid.

proj:ticket

The base GUID type. The proj:ticket type is derived from the base type: guid.

ps:achievement

An instance of an individual receiving an award. The ps:achievement type is derived from the base type: guid.

ps:contact

A GUID for a contact info record. The ps:contact type is derived from the base type: guid.

ps:contactlist

A GUID for a list of associated contacts. The ps:contactlist type is derived from the base type: guid.

ps:education

A period of education for an individual. The ps:education type is derived from the base type: guid.

ps:name

An arbitrary, lower spaced string with normalized whitespace. The ps:name type is derived from the base type: str.

An example of ps:name:

  • robert grey

The type ps:name has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: True
  • regex: None
  • replace: ()
  • strip: False

ps:person

A GUID for a person. The ps:person type is derived from the base type: guid.

ps:person:has

A person owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ps:person:has type is derived from the base type: comp.

The type ps:person:has has the following options set:

  • fields: (('person', 'ps:person'), ('node', 'ndef'))

ps:persona

A GUID for a suspected person. The ps:persona type is derived from the base type: guid.

ps:persona:has

A persona owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ps:persona:has type is derived from the base type: comp.

The type ps:persona:has has the following options set:

  • fields: (('persona', 'ps:persona'), ('node', 'ndef'))

ps:tokn

A single name element (potentially given or sur). The ps:tokn type is derived from the base type: str.

An example of ps:tokn:

  • robert

The type ps:tokn has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

risk:attack

An instance of an actor attacking a target. The risk:attack type is derived from the base type: guid.

risk:hasvuln

An instance of a vulnerability present in a target. The risk:hasvuln type is derived from the base type: guid.

risk:vuln

A unique vulnerability. The risk:vuln type is derived from the base type: guid.

rsa:key

An RSA keypair modulus and public exponent. The rsa:key type is derived from the base type: comp.

The type rsa:key has the following options set:

  • fields: (('mod', 'hex'), ('pub:exp', 'int'))

syn:cmd

A Synapse storm command. The syn:cmd type is derived from the base type: str.

The type syn:cmd has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

syn:cron

A Cortex cron job. The syn:cron type is derived from the base type: guid.

syn:form

A Synapse form used for representing nodes in the graph. The syn:form type is derived from the base type: str.

The type syn:form has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

syn:nodedata

A nodedata key and the form it may be present on. The syn:nodedata type is derived from the base type: comp.

The type syn:nodedata has the following options set:

  • fields: (('key', 'str'), ('form', 'syn:form'))

syn:prop

A Synapse property. The syn:prop type is derived from the base type: str.

The type syn:prop has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

syn:role

A Synapse role GUID. The syn:role type is derived from the base type: guid.

The type syn:role has the following options set:

  • strip: True

syn:splice

A splice from a layer. The syn:splice type is derived from the base type: guid.

The type syn:splice has the following options set:

  • strip: True

syn:tagprop

A user defined tag property. The syn:tagprop type is derived from the base type: str.

The type syn:tagprop has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

syn:trigger

A Cortex trigger. The syn:trigger type is derived from the base type: guid.

syn:type

A Synapse type used for normalizing nodes and properties. The syn:type type is derived from the base type: str.

The type syn:type has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: None
  • replace: ()
  • strip: True

syn:user

A Synapse user GUID. The syn:user type is derived from the base type: guid.

The type syn:user has the following options set:

  • strip: True

tel:call

A guid for a telephone call record. The tel:call type is derived from the base type: guid.

tel:mob:carrier

The fusion of a MCC/MNC. The tel:mob:carrier type is derived from the base type: comp.

The type tel:mob:carrier has the following options set:

  • fields: (('mcc', 'tel:mob:mcc'), ('mnc', 'tel:mob:mnc'))

tel:mob:cell

A mobile cell site which a phone may connect to. The tel:mob:cell type is derived from the base type: comp.

The type tel:mob:cell has the following options set:

  • fields: (('carrier', 'tel:mob:carrier'), ('lac', ('int', {})), ('cid', ('int', {})))

tel:mob:imid

Fused knowledge of an IMEI/IMSI used together. The tel:mob:imid type is derived from the base type: comp.

An example of tel:mob:imid:

  • (490154203237518, 310150123456789)

The type tel:mob:imid has the following options set:

  • fields: (('imei', 'tel:mob:imei'), ('imsi', 'tel:mob:imsi'))

tel:mob:imsiphone

Fused knowledge of an IMSI assigned phone number. The tel:mob:imsiphone type is derived from the base type: comp.

An example of tel:mob:imsiphone:

  • (310150123456789, "+7(495) 124-59-83")

The type tel:mob:imsiphone has the following options set:

  • fields: (('imsi', 'tel:mob:imsi'), ('phone', 'tel:phone'))

tel:mob:mcc

ITU Mobile Country Code. The tel:mob:mcc type is derived from the base type: str.

The type tel:mob:mcc has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[0-9]{3}$
  • replace: ()
  • strip: 1

tel:mob:mnc

ITU Mobile Network Code. The tel:mob:mnc type is derived from the base type: str.

The type tel:mob:mnc has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: ^[0-9]{2,3}$
  • replace: ()
  • strip: 1

tel:mob:tac

A mobile Type Allocation Code. The tel:mob:tac type is derived from the base type: int.

An example of tel:mob:tac:

  • 49015420

The type tel:mob:tac has the following options set:

  • fmt: %d
  • ismax: False
  • ismin: False
  • max: None
  • min: None
  • signed: True
  • size: 8

tel:mob:telem

A single mobile telemetry measurement. The tel:mob:telem type is derived from the base type: guid.

tel:txtmesg

A guid for an individual text message. The tel:txtmesg type is derived from the base type: guid.

transport:air:craft

An individual aircraft. The transport:air:craft type is derived from the base type: guid.

transport:air:flight

An individual instance of a flight. The transport:air:flight type is derived from the base type: guid.

transport:air:flightnum

A commercial flight designator including airline and serial. The transport:air:flightnum type is derived from the base type: str.

An example of transport:air:flightnum:

  • ua2437

The type transport:air:flightnum has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z]{2}[0-9]{1,4}$
  • replace: ((' ', ''),)
  • strip: True

transport:air:occupant

An occupant of a specific flight. The transport:air:occupant type is derived from the base type: guid.

transport:air:port

An IATA assigned airport code. The transport:air:port type is derived from the base type: str.

The type transport:air:port has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: None
  • replace: ()
  • strip: False

transport:air:tailnum

An aircraft registration number or military aircraft serial number. The transport:air:tailnum type is derived from the base type: str.

An example of transport:air:tailnum:

  • ff023

The type transport:air:tailnum has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^[a-z0-9-]{2,}$
  • replace: ()
  • strip: True

transport:air:telem

A telemtry sample from an aircraft in transit. The transport:air:telem type is derived from the base type: guid.

transport:sea:imo

An International Maritime Organization registration number. The transport:sea:imo type is derived from the base type: str.

The type transport:sea:imo has the following options set:

  • globsuffix: False
  • lower: True
  • onespace: False
  • regex: ^imo[0-9]{7}$
  • replace: ((' ', ''),)
  • strip: True

transport:sea:mmsi

A Maritime Mobile Service Identifier. The transport:sea:mmsi type is derived from the base type: str.

The type transport:sea:mmsi has the following options set:

  • globsuffix: False
  • lower: False
  • onespace: False
  • regex: [0-9]{9}
  • replace: ()
  • strip: False

transport:sea:telem

A telemetry sample from a vessel in transit. The transport:sea:telem type is derived from the base type: guid.

transport:sea:vessel

An individual sea vessel. The transport:sea:vessel type is derived from the base type: guid.