Synapse Data Model - Types

Base Types

Base types are defined via Python classes.

array

A typed array which indexes each field. It is implemented by the following class: synapse.lib.types.Array.

The base type array has the following default options set:

type: int

bool

The base boolean type. It is implemented by the following class: synapse.lib.types.Bool.

comp

The base type for compound node fields. It is implemented by the following class: synapse.lib.types.Comp.

cvss:v2

A CVSS v2 vector string. It is implemented by the following class: synapse.models.risk.CvssV2.

An example of cvss:v2:

(AV:L/AC:L/Au:M/C:P/I:C/A:N)

cvss:v3

A CVSS v3.x vector string. It is implemented by the following class: synapse.models.risk.CvssV3.

An example of cvss:v3:

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

data

Arbitrary json compatible data. It is implemented by the following class: synapse.lib.types.Data.

duration

A duration value. It is implemented by the following class: synapse.lib.types.Duration.

The base type duration has the following default options set:

signed: False

edge

An digraph edge base type. It is implemented by the following class: synapse.lib.types.Edge.

file:base

A file name with no path. It is implemented by the following class: synapse.models.files.FileBase.

An example of file:base:

woot.exe

file:bytes

The file bytes type with SHA256 based primary property. It is implemented by the following class: synapse.models.files.FileBytes.

file:path

A normalized file path. It is implemented by the following class: synapse.models.files.FilePath.

An example of file:path:

c:/windows/system32/calc.exe

float

The base floating point type. It is implemented by the following class: synapse.lib.types.Float.

The base type float has the following default options set:

fmt: %f

min: None

minisvalid: True

max: None

maxisvalid: True

geo:area

A geographic area (base unit is square mm). It is implemented by the following class: synapse.models.geospace.Area.

An example of geo:area:

10 sq.km

geo:dist

A geographic distance (base unit is mm). It is implemented by the following class: synapse.models.geospace.Dist.

An example of geo:dist:

10 km

geo:latlong

A Lat/Long string specifying a point on Earth. It is implemented by the following class: synapse.models.geospace.LatLong.

An example of geo:latlong:

-12.45,56.78

guid

The base GUID type. It is implemented by the following class: synapse.lib.types.Guid.

hex

The base hex type. It is implemented by the following class: synapse.lib.types.Hex.

The base type hex has the following default options set:

size: 0

zeropad: 0

hugenum

A potentially huge/tiny number. [x] <= 730750818665451459101842 with a fractional precision of 24 decimal digits. It is implemented by the following class: synapse.lib.types.HugeNum.

The base type hugenum has the following default options set:

units: None

modulo: None

inet:addr

A network layer URL-like format to represent tcp/udp/icmp clients and servers. It is implemented by the following class: synapse.models.inet.Addr.

An example of inet:addr:

tcp://1.2.3.4:80

inet:cidr4

An IPv4 address block in Classless Inter-Domain Routing (CIDR) notation. It is implemented by the following class: synapse.models.inet.Cidr4.

An example of inet:cidr4:

1.2.3.0/24

inet:cidr6

An IPv6 address block in Classless Inter-Domain Routing (CIDR) notation. It is implemented by the following class: synapse.models.inet.Cidr6.

An example of inet:cidr6:

2001:db8::/101

inet:dns:name

A DNS query name string. Likely an FQDN but not always. It is implemented by the following class: synapse.models.dns.DnsName.

An example of inet:dns:name:

vertex.link

inet:email

An e-mail address. It is implemented by the following class: synapse.models.inet.Email.

inet:fqdn

A Fully Qualified Domain Name (FQDN). It is implemented by the following class: synapse.models.inet.Fqdn.

An example of inet:fqdn:

vertex.link

inet:ipv4

An IPv4 address. It is implemented by the following class: synapse.models.inet.IPv4.

An example of inet:ipv4:

1.2.3.4

inet:ipv4range

An IPv4 address range. It is implemented by the following class: synapse.models.inet.IPv4Range.

An example of inet:ipv4range:

1.2.3.4-1.2.3.8

inet:ipv6

An IPv6 address. It is implemented by the following class: synapse.models.inet.IPv6.

An example of inet:ipv6:

2607:f8b0:4004:809::200e

inet:ipv6range

An IPv6 address range. It is implemented by the following class: synapse.models.inet.IPv6Range.

An example of inet:ipv6range:

(2607:f8b0:4004:809::200e, 2607:f8b0:4004:809::2011)

inet:rfc2822:addr

An RFC 2822 Address field. It is implemented by the following class: synapse.models.inet.Rfc2822Addr.

An example of inet:rfc2822:addr:

"Visi Kenshoto" <visi@vertex.link>

inet:url

A Universal Resource Locator (URL). It is implemented by the following class: synapse.models.inet.Url.

An example of inet:url:

http://www.woot.com/files/index.html

int

The base 64 bit signed integer type. It is implemented by the following class: synapse.lib.types.Int.

The base type int has the following default options set:

size: 8

signed: True

enums:strict: True

fmt: %d

min: None

max: None

ismin: False

ismax: False

it:sec:cpe

A NIST CPE 2.3 Formatted String. It is implemented by the following class: synapse.models.infotech.Cpe23Str.

The base type it:sec:cpe has the following default options set:

lower: True

it:sec:cpe:v2_2

A NIST CPE 2.2 Formatted String. It is implemented by the following class: synapse.models.infotech.Cpe22Str.

The base type it:sec:cpe:v2_2 has the following default options set:

lower: True

it:semver

Semantic Version type. It is implemented by the following class: synapse.models.infotech.SemVer.

ival

A time window/interval. It is implemented by the following class: synapse.lib.types.Ival.

loc

The base geo political location type. It is implemented by the following class: synapse.lib.types.Loc.

ndef

The node definition type for a (form,valu) compound field. It is implemented by the following class: synapse.lib.types.Ndef.

nodeprop

The nodeprop type for a (prop,valu) compound field. It is implemented by the following class: synapse.lib.types.NodeProp.

range

A base range type. It is implemented by the following class: synapse.lib.types.Range.

The base type range has the following default options set:

type: ('int', {})

str

The base string type. It is implemented by the following class: synapse.lib.types.Str.

The base type str has the following default options set:

enums: None

regex: None

lower: False

strip: False

replace: ()

onespace: False

globsuffix: False

syn:tag

The base type for a synapse tag. It is implemented by the following class: synapse.lib.types.Tag.

The base type syn:tag has the following default options set:

enums: None

regex: None

lower: False

strip: False

replace: ()

onespace: False

globsuffix: False

syn:tag:part

A tag component string. It is implemented by the following class: synapse.lib.types.TagPart.

The base type syn:tag:part has the following default options set:

enums: None

regex: None

lower: False

strip: False

replace: ()

onespace: False

globsuffix: False

taxon

A component of a hierarchical taxonomy. It is implemented by the following class: synapse.lib.types.Taxon.

The base type taxon has the following default options set:

enums: None

regex: None

lower: False

strip: False

replace: ()

onespace: False

globsuffix: False

taxonomy

A hierarchical taxonomy. It is implemented by the following class: synapse.lib.types.Taxonomy.

The base type taxonomy has the following default options set:

enums: None

regex: None

lower: False

strip: False

replace: ()

onespace: False

globsuffix: False

tel:mob:imei

An International Mobile Equipment Id. It is implemented by the following class: synapse.models.telco.Imei.

An example of tel:mob:imei:

490154203237518

tel:mob:imsi

An International Mobile Subscriber Id. It is implemented by the following class: synapse.models.telco.Imsi.

An example of tel:mob:imsi:

310150123456789

tel:phone

A phone number. It is implemented by the following class: synapse.models.telco.Phone.

An example of tel:phone:

+15558675309

time

A date/time value. It is implemented by the following class: synapse.lib.types.Time.

The base type time has the following default options set:

ismin: False

ismax: False

timeedge

An digraph edge base type with a unique time. It is implemented by the following class: synapse.lib.types.TimeEdge.

velocity

A velocity with base units in mm/sec. It is implemented by the following class: synapse.lib.types.Velocity.

The base type velocity has the following default options set:

relative: False

Types

Regular types are derived from BaseTypes.

auth:access

An instance of using creds to access a resource. The auth:access type is derived from the base type: guid.

auth:creds

A unique set of credentials used to access a resource. The auth:creds type is derived from the base type: guid.

belief:subscriber

A contact which subscribes to a belief system. The belief:subscriber type is derived from the base type: guid.

belief:system

A belief system such as an ideology, philosophy, or religion. The belief:system type is derived from the base type: guid.

belief:system:type:taxonomy

A hierarchical taxonomy of belief system types. The belief:system:type:taxonomy type is derived from the base type: taxonomy.

The type belief:system:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

belief:tenet

A concrete tenet potentially shared by multiple belief systems. The belief:tenet type is derived from the base type: guid.

biz:bundle

A bundle allows construction of products which bundle instances of other products. The biz:bundle type is derived from the base type: guid.

biz:deal

A sales or procurement effort in pursuit of a purchase. The biz:deal type is derived from the base type: guid.

biz:dealstatus

A deal/rfp status taxonomy. The biz:dealstatus type is derived from the base type: taxonomy.

The type biz:dealstatus has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

biz:dealtype

A deal type taxonomy. The biz:dealtype type is derived from the base type: taxonomy.

The type biz:dealtype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

biz:listing

A product or service being listed for sale at a given price by a specific seller. The biz:listing type is derived from the base type: guid.

biz:prodtype

A product type taxonomy. The biz:prodtype type is derived from the base type: taxonomy.

The type biz:prodtype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

biz:product

A product which is available for purchase. The biz:product type is derived from the base type: guid.

biz:rfp

An RFP (Request for Proposal) soliciting proposals. The biz:rfp type is derived from the base type: guid.

biz:service

A service which is performed by a specific organization. The biz:service type is derived from the base type: guid.

biz:service:type:taxonomy

A taxonomy of service offering types. The biz:service:type:taxonomy type is derived from the base type: taxonomy.

The type biz:service:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

biz:stake

A stake or partial ownership in a company. The biz:stake type is derived from the base type: guid.

crypto:algorithm

A cryptographic algorithm name. The crypto:algorithm type is derived from the base type: str.

An example of crypto:algorithm:

aes256

The type crypto:algorithm has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

crypto:currency:address

An individual crypto currency address. The crypto:currency:address type is derived from the base type: comp.

An example of crypto:currency:address:

btc/1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2

The type crypto:currency:address has the following options set:

fields: (('coin', 'crypto:currency:coin'), ('iden', 'str'))

sepr: /

crypto:currency:block

An individual crypto currency block record on the blockchain. The crypto:currency:block type is derived from the base type: comp.

The type crypto:currency:block has the following options set:

fields: (('coin', 'crypto:currency:coin'), ('offset', 'int'))

sepr: /

crypto:currency:client

A fused node representing a crypto currency address used by an Internet client. The crypto:currency:client type is derived from the base type: comp.

An example of crypto:currency:client:

(1.2.3.4, (btc, 1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2))

The type crypto:currency:client has the following options set:

fields: (('inetaddr', 'inet:client'), ('coinaddr', 'crypto:currency:address'))

crypto:currency:coin

An individual crypto currency type. The crypto:currency:coin type is derived from the base type: str.

An example of crypto:currency:coin:

btc

The type crypto:currency:coin has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

crypto:currency:transaction

An individual crypto currency transaction recorded on the blockchain. The crypto:currency:transaction type is derived from the base type: guid.

crypto:key

A cryptographic key and algorithm. The crypto:key type is derived from the base type: guid.

crypto:payment:input

A payment made into a transaction. The crypto:payment:input type is derived from the base type: guid.

crypto:payment:output

A payment received from a transaction. The crypto:payment:output type is derived from the base type: guid.

crypto:smart:contract

A smart contract. The crypto:smart:contract type is derived from the base type: guid.

crypto:smart:effect:burntoken

A smart contract effect which destroys a non-fungible token. The crypto:smart:effect:burntoken type is derived from the base type: guid.

crypto:smart:effect:edittokensupply

A smart contract effect which increases or decreases the supply of a fungible token. The crypto:smart:effect:edittokensupply type is derived from the base type: guid.

crypto:smart:effect:minttoken

A smart contract effect which creates a new non-fungible token. The crypto:smart:effect:minttoken type is derived from the base type: guid.

crypto:smart:effect:proxytoken

A smart contract effect which grants a non-owner address the ability to manipulate a specific non-fungible token. The crypto:smart:effect:proxytoken type is derived from the base type: guid.

crypto:smart:effect:proxytokenall

A smart contract effect which grants a non-owner address the ability to manipulate all non-fungible tokens of the owner. The crypto:smart:effect:proxytokenall type is derived from the base type: guid.

crypto:smart:effect:proxytokens

A smart contract effect which grants a non-owner address the ability to manipulate fungible tokens. The crypto:smart:effect:proxytokens type is derived from the base type: guid.

crypto:smart:effect:transfertoken

A smart contract effect which transfers ownership of a non-fungible token. The crypto:smart:effect:transfertoken type is derived from the base type: guid.

crypto:smart:effect:transfertokens

A smart contract effect which transfers fungible tokens. The crypto:smart:effect:transfertokens type is derived from the base type: guid.

crypto:smart:token

A token managed by a smart contract. The crypto:smart:token type is derived from the base type: comp.

The type crypto:smart:token has the following options set:

fields: (('contract', 'crypto:smart:contract'), ('tokenid', 'hugenum'))

crypto:x509:cert

A unique X.509 certificate. The crypto:x509:cert type is derived from the base type: guid.

crypto:x509:crl

A unique X.509 Certificate Revocation List. The crypto:x509:crl type is derived from the base type: guid.

crypto:x509:revoked

A revocation relationship between a CRL and an X.509 certificate. The crypto:x509:revoked type is derived from the base type: comp.

The type crypto:x509:revoked has the following options set:

fields: (('crl', 'crypto:x509:crl'), ('cert', 'crypto:x509:cert'))

crypto:x509:san

An X.509 Subject Alternative Name (SAN). The crypto:x509:san type is derived from the base type: comp.

The type crypto:x509:san has the following options set:

fields: (('type', 'str'), ('value', 'str'))

crypto:x509:signedfile

A digital signature relationship between an X.509 certificate and a file. The crypto:x509:signedfile type is derived from the base type: comp.

The type crypto:x509:signedfile has the following options set:

fields: (('cert', 'crypto:x509:cert'), ('file', 'file:bytes'))

econ:acct:balance

A snapshot of the balance of an account at a point in time. The econ:acct:balance type is derived from the base type: guid.

econ:acct:invoice

An invoice issued requesting payment. The econ:acct:invoice type is derived from the base type: guid.

econ:acct:payment

A payment or crypto currency transaction. The econ:acct:payment type is derived from the base type: guid.

econ:acct:receipt

A receipt issued as proof of payment. The econ:acct:receipt type is derived from the base type: guid.

econ:acquired

Deprecated. Please use econ:purchase -(acquired)> *. The econ:acquired type is derived from the base type: comp.

The type econ:acquired has the following options set:

fields: (('purchase', 'econ:purchase'), ('item', 'ndef'))

econ:bank:aba:rtn

An American Bank Association (ABA) routing transit number (RTN). The econ:bank:aba:rtn type is derived from the base type: str.

The type econ:bank:aba:rtn has the following options set:

globsuffix: False

lower: False

onespace: False

regex: [0-9]{9}

replace: ()

strip: False

econ:bank:account

A bank account. The econ:bank:account type is derived from the base type: guid.

econ:bank:account:type:taxonomy

A bank account type taxonomy. The econ:bank:account:type:taxonomy type is derived from the base type: taxonomy.

The type econ:bank:account:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

econ:bank:balance

A balance contained by a bank account at a point in time. The econ:bank:balance type is derived from the base type: guid.

econ:bank:iban

An International Bank Account Number. The econ:bank:iban type is derived from the base type: str.

The type econ:bank:iban has the following options set:

globsuffix: False

lower: False

onespace: False

regex: [A-Z]{2}[0-9]{2}[a-zA-Z0-9]{1,30}

replace: ()

strip: False

econ:bank:statement

A statement of bank account payment activity over a period of time. The econ:bank:statement type is derived from the base type: guid.

econ:bank:swift:bic

A Society for Worldwide Interbank Financial Telecommunication (SWIFT) Business Identifier Code (BIC). The econ:bank:swift:bic type is derived from the base type: str.

The type econ:bank:swift:bic has the following options set:

globsuffix: False

lower: False

onespace: False

regex: [A-Z]{6}[A-Z0-9]{5}

replace: ()

strip: False

econ:currency

The name of a system of money in general use. The econ:currency type is derived from the base type: str.

An example of econ:currency:

usd

The type econ:currency has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

econ:fin:bar

A sample of the open, close, high, low prices of a security in a specific time window. The econ:fin:bar type is derived from the base type: guid.

econ:fin:exchange

A financial exchange where securities are traded. The econ:fin:exchange type is derived from the base type: guid.

econ:fin:security

A financial security which is typically traded on an exchange. The econ:fin:security type is derived from the base type: guid.

econ:fin:tick

A sample of the price of a security at a single moment in time. The econ:fin:tick type is derived from the base type: guid.

econ:pay:card

A single payment card. The econ:pay:card type is derived from the base type: guid.

econ:pay:cvv

A Card Verification Value (CVV). The econ:pay:cvv type is derived from the base type: str.

The type econ:pay:cvv has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[0-9]{1,6}$

replace: ()

strip: False

econ:pay:iin

An Issuer Id Number (IIN). The econ:pay:iin type is derived from the base type: int.

The type econ:pay:iin has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: 999999

min: 0

signed: True

size: 8

econ:pay:mii

A Major Industry Identifier (MII). The econ:pay:mii type is derived from the base type: int.

The type econ:pay:mii has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: 9

min: 0

signed: True

size: 8

econ:pay:pan

A Primary Account Number (PAN) or card number. The econ:pay:pan type is derived from the base type: str.

The type econ:pay:pan has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^(?<iin>(?<mii>[0-9]{1})[0-9]{5})[0-9]{1,13}$

replace: ()

strip: False

econ:pay:pin

A Personal Identification Number (PIN). The econ:pay:pin type is derived from the base type: str.

The type econ:pay:pin has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[0-9]{3,6}$

replace: ()

strip: False

econ:price

The amount of money expected, required, or given in payment for something. The econ:price type is derived from the base type: hugenum.

An example of econ:price:

2.20

The type econ:price has the following options set:

modulo: None

norm: False

units: None

econ:purchase

A purchase event. The econ:purchase type is derived from the base type: guid.

econ:receipt:item

A line item included as part of a purchase. The econ:receipt:item type is derived from the base type: guid.

edge:has

A digraph edge which records that N1 has N2. The edge:has type is derived from the base type: edge.

edge:refs

A digraph edge which records that N1 refers to or contains N2. The edge:refs type is derived from the base type: edge.

edge:wentto

A digraph edge which records that N1 went to N2 at a specific time. The edge:wentto type is derived from the base type: timeedge.

edu:class

An instance of an edu:course taught at a given time. The edu:class type is derived from the base type: guid.

edu:course

A course of study taught by an org. The edu:course type is derived from the base type: guid.

file:archive:entry

An archive entry representing a file and metadata within a parent archive file. The file:archive:entry type is derived from the base type: guid.

file:filepath

The fused knowledge of the association of a file:bytes node and a file:path. The file:filepath type is derived from the base type: comp.

The type file:filepath has the following options set:

fields: (('file', 'file:bytes'), ('path', 'file:path'))

file:ismime

Records one, of potentially multiple, mime types for a given file. The file:ismime type is derived from the base type: comp.

The type file:ismime has the following options set:

fields: (('file', 'file:bytes'), ('mime', 'file:mime'))

file:mime

A file mime name string. The file:mime type is derived from the base type: str.

An example of file:mime:

text/plain

The type file:mime has the following options set:

globsuffix: False

lower: 1

onespace: False

regex: None

replace: ()

strip: False

file:mime:gif

The GUID of a set of mime metadata for a .gif file. The file:mime:gif type is derived from the base type: guid.

file:mime:jpg

The GUID of a set of mime metadata for a .jpg file. The file:mime:jpg type is derived from the base type: guid.

file:mime:macho:loadcmd

A generic load command pulled from the Mach-O headers. The file:mime:macho:loadcmd type is derived from the base type: guid.

file:mime:macho:section

A section inside a Mach-O binary denoting a named region of bytes inside a segment. The file:mime:macho:section type is derived from the base type: guid.

file:mime:macho:segment

A named region of bytes inside a Mach-O binary. The file:mime:macho:segment type is derived from the base type: guid.

file:mime:macho:uuid

A specific load command denoting a UUID used to uniquely identify the Mach-O binary. The file:mime:macho:uuid type is derived from the base type: guid.

file:mime:macho:version

A specific load command used to denote the version of the source used to build the Mach-O binary. The file:mime:macho:version type is derived from the base type: guid.

file:mime:msdoc

The GUID of a set of mime metadata for a Microsoft Word file. The file:mime:msdoc type is derived from the base type: guid.

file:mime:msppt

The GUID of a set of mime metadata for a Microsoft Powerpoint file. The file:mime:msppt type is derived from the base type: guid.

file:mime:msxls

The GUID of a set of mime metadata for a Microsoft Excel file. The file:mime:msxls type is derived from the base type: guid.

file:mime:pe:export

The fused knowledge of a file:bytes node containing a pe named export. The file:mime:pe:export type is derived from the base type: comp.

The type file:mime:pe:export has the following options set:

fields: (('file', 'file:bytes'), ('name', 'str'))

file:mime:pe:resource

The fused knowledge of a file:bytes node containing a pe resource. The file:mime:pe:resource type is derived from the base type: comp.

The type file:mime:pe:resource has the following options set:

fields:

[
 [
  "file",
  "file:bytes"
 ],
 [
  "type",
  "pe:resource:type"
 ],
 [
  "langid",
  "pe:langid"
 ],
 [
  "resource",
  "file:bytes"
 ]
]

file:mime:pe:section

The fused knowledge a file:bytes node containing a pe section. The file:mime:pe:section type is derived from the base type: comp.

The type file:mime:pe:section has the following options set:

fields: (('file', 'file:bytes'), ('name', 'str'), ('sha256', 'hash:sha256'))

file:mime:pe:vsvers:info

knowledge of a file:bytes node containing vsvers info. The file:mime:pe:vsvers:info type is derived from the base type: comp.

The type file:mime:pe:vsvers:info has the following options set:

fields: (('file', 'file:bytes'), ('keyval', 'file:mime:pe:vsvers:keyval'))

file:mime:pe:vsvers:keyval

A key value pair found in a PE vsversion info structure. The file:mime:pe:vsvers:keyval type is derived from the base type: comp.

The type file:mime:pe:vsvers:keyval has the following options set:

fields: (('name', 'str'), ('value', 'str'))

file:mime:png

The GUID of a set of mime metadata for a .png file. The file:mime:png type is derived from the base type: guid.

file:mime:rtf

The GUID of a set of mime metadata for a .rtf file. The file:mime:rtf type is derived from the base type: guid.

file:mime:tif

The GUID of a set of mime metadata for a .tif file. The file:mime:tif type is derived from the base type: guid.

file:string

Deprecated. Please use the edge -(refs)> it:dev:str. The file:string type is derived from the base type: comp.

The type file:string has the following options set:

fields: (('file', 'file:bytes'), ('string', 'str'))

file:subfile

A parent file that fully contains the specified child file. The file:subfile type is derived from the base type: comp.

The type file:subfile has the following options set:

fields: (('parent', 'file:bytes'), ('child', 'file:bytes'))

geo:address

A street/mailing address string. The geo:address type is derived from the base type: str.

The type geo:address has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

geo:altitude

A negative or positive offset from Mean Sea Level (6,371.0088km from Earths core). The geo:altitude type is derived from the base type: geo:dist.

An example of geo:altitude:

10 km

The type geo:altitude has the following options set:

baseoff: 6371008800

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

geo:bbox

A geospatial bounding box in (xmin, xmax, ymin, ymax) format. The geo:bbox type is derived from the base type: comp.

The type geo:bbox has the following options set:

fields:

[
 [
  "xmin",
  "geo:longitude"
 ],
 [
  "xmax",
  "geo:longitude"
 ],
 [
  "ymin",
  "geo:latitude"
 ],
 [
  "ymax",
  "geo:latitude"
 ]
]

sepr: ,

geo:json

GeoJSON structured JSON data. The geo:json type is derived from the base type: data.

The type geo:json has the following options set:

schema:

{
 "$schema": "http://json-schema.org/draft-07/schema#",
 "definitions": {
  "BoundingBox": {
   "items": {
    "type": "number"
   },
   "minItems": 4,
   "type": "array"
  },
  "Feature": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "geometry": {
     "oneOf": [
      {
       "type": "null"
      },
      {
       "$ref": "#/definitions/Point"
      },
      {
       "$ref": "#/definitions/LineString"
      },
      {
       "$ref": "#/definitions/Polygon"
      },
      {
       "$ref": "#/definitions/MultiPoint"
      },
      {
       "$ref": "#/definitions/MultiLineString"
      },
      {
       "$ref": "#/definitions/MultiPolygon"
      },
      {
       "$ref": "#/definitions/GeometryCollection"
      }
     ]
    },
    "properties": {
     "oneOf": [
      {
       "type": "null"
      },
      {
       "type": "object"
      }
     ]
    },
    "type": {
     "enum": [
      "Feature"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "properties",
    "geometry"
   ],
   "title": "GeoJSON Feature",
   "type": "object"
  },
  "FeatureCollection": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "features": {
     "items": {
      "$ref": "#/definitions/Feature"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "FeatureCollection"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "features"
   ],
   "title": "GeoJSON FeatureCollection",
   "type": "object"
  },
  "GeometryCollection": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "geometries": {
     "items": {
      "oneOf": [
       {
        "$ref": "#/definitions/Point"
       },
       {
        "$ref": "#/definitions/LineString"
       },
       {
        "$ref": "#/definitions/Polygon"
       },
       {
        "$ref": "#/definitions/MultiPoint"
       },
       {
        "$ref": "#/definitions/MultiLineString"
       },
       {
        "$ref": "#/definitions/MultiPolygon"
       }
      ]
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "GeometryCollection"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "geometries"
   ],
   "title": "GeoJSON GeometryCollection",
   "type": "object"
  },
  "LineString": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/LineStringCoordinates"
    },
    "type": {
     "enum": [
      "LineString"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON LineString",
   "type": "object"
  },
  "LineStringCoordinates": {
   "items": {
    "$ref": "#/definitions/PointCoordinates"
   },
   "minItems": 2,
   "type": "array"
  },
  "LinearRingCoordinates": {
   "items": {
    "$ref": "#/definitions/PointCoordinates"
   },
   "minItems": 4,
   "type": "array"
  },
  "MultiLineString": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/LineStringCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiLineString"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiLineString",
   "type": "object"
  },
  "MultiPoint": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/PointCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiPoint"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiPoint",
   "type": "object"
  },
  "MultiPolygon": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "items": {
      "$ref": "#/definitions/PolygonCoordinates"
     },
     "type": "array"
    },
    "type": {
     "enum": [
      "MultiPolygon"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON MultiPolygon",
   "type": "object"
  },
  "Point": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/PointCoordinates"
    },
    "type": {
     "enum": [
      "Point"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON Point",
   "type": "object"
  },
  "PointCoordinates": {
   "items": {
    "type": "number"
   },
   "minItems": 2,
   "type": "array"
  },
  "Polygon": {
   "properties": {
    "bbox": {
     "$ref": "#/definitions/BoundingBox"
    },
    "coordinates": {
     "$ref": "#/definitions/PolygonCoordinates"
    },
    "type": {
     "enum": [
      "Polygon"
     ],
     "type": "string"
    }
   },
   "required": [
    "type",
    "coordinates"
   ],
   "title": "GeoJSON Polygon",
   "type": "object"
  },
  "PolygonCoordinates": {
   "items": {
    "$ref": "#/definitions/LinearRingCoordinates"
   },
   "type": "array"
  }
 },
 "oneOf": [
  {
   "$ref": "#/definitions/Point"
  },
  {
   "$ref": "#/definitions/LineString"
  },
  {
   "$ref": "#/definitions/Polygon"
  },
  {
   "$ref": "#/definitions/MultiPoint"
  },
  {
   "$ref": "#/definitions/MultiLineString"
  },
  {
   "$ref": "#/definitions/MultiPolygon"
  },
  {
   "$ref": "#/definitions/GeometryCollection"
  },
  {
   "$ref": "#/definitions/Feature"
  },
  {
   "$ref": "#/definitions/FeatureCollection"
  }
 ]
}

geo:latitude

A latitude in floating point notation. The geo:latitude type is derived from the base type: float.

An example of geo:latitude:

31.337

The type geo:latitude has the following options set:

fmt: %f

max: 90.0

maxisvalid: True

min: -90.0

minisvalid: True

geo:longitude

A longitude in floating point notation. The geo:longitude type is derived from the base type: float.

An example of geo:longitude:

31.337

The type geo:longitude has the following options set:

fmt: %f

max: 180.0

maxisvalid: True

min: -180.0

minisvalid: False

geo:name

An unstructured place name or address. The geo:name type is derived from the base type: str.

The type geo:name has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

geo:nloc

Records a node latitude/longitude in space-time. The geo:nloc type is derived from the base type: comp.

The type geo:nloc has the following options set:

fields: (('ndef', 'ndef'), ('latlong', 'geo:latlong'), ('time', 'time'))

geo:place

A GUID for a geographic place. The geo:place type is derived from the base type: guid.

geo:place:taxonomy

A taxonomy of place types. The geo:place:taxonomy type is derived from the base type: taxonomy.

The type geo:place:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

geo:telem

A geospatial position of a node at a given time. The node should be linked via -(seenat)> edges. The geo:telem type is derived from the base type: guid.

gov:cn:icp

A Chinese Internet Content Provider ID. The gov:cn:icp type is derived from the base type: int.

The type gov:cn:icp has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

gov:cn:mucd

A Chinese PLA MUCD. The gov:cn:mucd type is derived from the base type: int.

The type gov:cn:mucd has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

gov:intl:un:m49

UN M49 Numeric Country Code. The gov:intl:un:m49 type is derived from the base type: int.

The type gov:intl:un:m49 has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: 999

min: 1

signed: True

size: 8

gov:us:cage

A Commercial and Government Entity (CAGE) code. The gov:us:cage type is derived from the base type: str.

The type gov:us:cage has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

gov:us:ssn

A US Social Security Number (SSN). The gov:us:ssn type is derived from the base type: int.

The type gov:us:ssn has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

gov:us:zip

A US Postal Zip Code. The gov:us:zip type is derived from the base type: int.

The type gov:us:zip has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

graph:cluster

A generic node, used in conjunction with Edge types, to cluster arbitrary nodes to a single node in the model. The graph:cluster type is derived from the base type: guid.

graph:edge

A generic digraph edge to show relationships outside the model. The graph:edge type is derived from the base type: edge.

graph:event

A generic event node to represent events outside the model. The graph:event type is derived from the base type: guid.

graph:node

A generic node used to represent objects outside the model. The graph:node type is derived from the base type: guid.

graph:timeedge

A generic digraph time edge to show relationships outside the model. The graph:timeedge type is derived from the base type: timeedge.

hash:lm

A hex encoded Microsoft Windows LM password hash. The hash:lm type is derived from the base type: hex.

An example of hash:lm:

d41d8cd98f00b204e9800998ecf8427e

The type hash:lm has the following options set:

size: 32

zeropad: 0

hash:md5

A hex encoded MD5 hash. The hash:md5 type is derived from the base type: hex.

An example of hash:md5:

d41d8cd98f00b204e9800998ecf8427e

The type hash:md5 has the following options set:

size: 32

zeropad: 0

hash:ntlm

A hex encoded Microsoft Windows NTLM password hash. The hash:ntlm type is derived from the base type: hex.

An example of hash:ntlm:

d41d8cd98f00b204e9800998ecf8427e

The type hash:ntlm has the following options set:

size: 32

zeropad: 0

hash:sha1

A hex encoded SHA1 hash. The hash:sha1 type is derived from the base type: hex.

An example of hash:sha1:

da39a3ee5e6b4b0d3255bfef95601890afd80709

The type hash:sha1 has the following options set:

size: 40

zeropad: 0

hash:sha256

A hex encoded SHA256 hash. The hash:sha256 type is derived from the base type: hex.

An example of hash:sha256:

ad9f4fe922b61e674a09530831759843b1880381de686a43460a76864ca0340c

The type hash:sha256 has the following options set:

size: 64

zeropad: 0

hash:sha384

A hex encoded SHA384 hash. The hash:sha384 type is derived from the base type: hex.

An example of hash:sha384:

d425f1394e418ce01ed1579069a8bfaa1da8f32cf823982113ccbef531fa36bda9987f389c5af05b5e28035242efab6c

The type hash:sha384 has the following options set:

size: 96

zeropad: 0

hash:sha512

A hex encoded SHA512 hash. The hash:sha512 type is derived from the base type: hex.

An example of hash:sha512:

ca74fe2ff2d03b29339ad7d08ba21d192077fece1715291c7b43c20c9136cd132788239189f3441a87eb23ce2660aa243f334295902c904b5520f6e80ab91f11

The type hash:sha512 has the following options set:

size: 128

zeropad: 0

inet:asn

An Autonomous System Number (ASN). The inet:asn type is derived from the base type: int.

The type inet:asn has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

inet:asnet4

An Autonomous System Number (ASN) and its associated IPv4 address range. The inet:asnet4 type is derived from the base type: comp.

An example of inet:asnet4:

(54959, (1.2.3.4, 1.2.3.20))

The type inet:asnet4 has the following options set:

fields: (('asn', 'inet:asn'), ('net4', 'inet:net4'))

inet:asnet6

An Autonomous System Number (ASN) and its associated IPv6 address range. The inet:asnet6 type is derived from the base type: comp.

An example of inet:asnet6:

(54959, (ff::00, ff::02))

The type inet:asnet6 has the following options set:

fields: (('asn', 'inet:asn'), ('net6', 'inet:net6'))

inet:client

A network client address. The inet:client type is derived from the base type: inet:addr.

An example of inet:client:

tcp://1.2.3.4:80

The type inet:client has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:dns:a

The result of a DNS A record lookup. The inet:dns:a type is derived from the base type: comp.

An example of inet:dns:a:

(vertex.link,1.2.3.4)

The type inet:dns:a has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('ipv4', 'inet:ipv4'))

inet:dns:aaaa

The result of a DNS AAAA record lookup. The inet:dns:aaaa type is derived from the base type: comp.

An example of inet:dns:aaaa:

(vertex.link,2607:f8b0:4004:809::200e)

The type inet:dns:aaaa has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('ipv6', 'inet:ipv6'))

inet:dns:answer

A single answer from within a DNS reply. The inet:dns:answer type is derived from the base type: guid.

inet:dns:cname

The result of a DNS CNAME record lookup. The inet:dns:cname type is derived from the base type: comp.

An example of inet:dns:cname:

(foo.vertex.link,vertex.link)

The type inet:dns:cname has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('cname', 'inet:fqdn'))

inet:dns:dynreg

A dynamic DNS registration. The inet:dns:dynreg type is derived from the base type: guid.

inet:dns:mx

The result of a DNS MX record lookup. The inet:dns:mx type is derived from the base type: comp.

An example of inet:dns:mx:

(vertex.link,mail.vertex.link)

The type inet:dns:mx has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('mx', 'inet:fqdn'))

inet:dns:ns

The result of a DNS NS record lookup. The inet:dns:ns type is derived from the base type: comp.

An example of inet:dns:ns:

(vertex.link,ns.dnshost.com)

The type inet:dns:ns has the following options set:

fields: (('zone', 'inet:fqdn'), ('ns', 'inet:fqdn'))

inet:dns:query

A DNS query unique to a given client. The inet:dns:query type is derived from the base type: comp.

An example of inet:dns:query:

(1.2.3.4, woot.com, 1)

The type inet:dns:query has the following options set:

fields: (('client', 'inet:client'), ('name', 'inet:dns:name'), ('type', 'int'))

inet:dns:request

A single instance of a DNS resolver request and optional reply info. The inet:dns:request type is derived from the base type: guid.

inet:dns:rev

The transformed result of a DNS PTR record lookup. The inet:dns:rev type is derived from the base type: comp.

An example of inet:dns:rev:

(1.2.3.4,vertex.link)

The type inet:dns:rev has the following options set:

fields: (('ipv4', 'inet:ipv4'), ('fqdn', 'inet:fqdn'))

inet:dns:rev6

The transformed result of a DNS PTR record for an IPv6 address. The inet:dns:rev6 type is derived from the base type: comp.

An example of inet:dns:rev6:

(2607:f8b0:4004:809::200e,vertex.link)

The type inet:dns:rev6 has the following options set:

fields: (('ipv6', 'inet:ipv6'), ('fqdn', 'inet:fqdn'))

inet:dns:soa

The result of a DNS SOA record lookup. The inet:dns:soa type is derived from the base type: guid.

inet:dns:txt

The result of a DNS MX record lookup. The inet:dns:txt type is derived from the base type: comp.

An example of inet:dns:txt:

(hehe.vertex.link,"fancy TXT record")

The type inet:dns:txt has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('txt', 'str'))

inet:dns:type

A DNS query/answer type integer. The inet:dns:type type is derived from the base type: int.

The type inet:dns:type has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

inet:dns:wild:a

A DNS A wild card record and the IPv4 it resolves to. The inet:dns:wild:a type is derived from the base type: comp.

The type inet:dns:wild:a has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('ipv4', 'inet:ipv4'))

inet:dns:wild:aaaa

A DNS AAAA wild card record and the IPv6 it resolves to. The inet:dns:wild:aaaa type is derived from the base type: comp.

The type inet:dns:wild:aaaa has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('ipv6', 'inet:ipv6'))

inet:download

An instance of a file downloaded from a server. The inet:download type is derived from the base type: guid.

inet:egress

A host using a specific network egress client address. The inet:egress type is derived from the base type: guid.

inet:email:header

A unique email message header. The inet:email:header type is derived from the base type: comp.

The type inet:email:header has the following options set:

fields: (('name', 'inet:email:header:name'), ('value', 'str'))

inet:email:header:name

An email header name. The inet:email:header:name type is derived from the base type: str.

An example of inet:email:header:name:

subject

The type inet:email:header:name has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

inet:email:message

An individual email message delivered to an inbox. The inet:email:message type is derived from the base type: guid.

inet:email:message:attachment

A file which was attached to an email message. The inet:email:message:attachment type is derived from the base type: comp.

The type inet:email:message:attachment has the following options set:

fields: (('message', 'inet:email:message'), ('file', 'file:bytes'))

inet:email:message:link

A url/link embedded in an email message. The inet:email:message:link type is derived from the base type: comp.

The type inet:email:message:link has the following options set:

fields: (('message', 'inet:email:message'), ('url', 'inet:url'))

inet:flow

An individual network connection between a given source and destination. The inet:flow type is derived from the base type: guid.

inet:group

A group name string. The inet:group type is derived from the base type: str.

The type inet:group has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:http:header

An HTTP protocol header key/value. The inet:http:header type is derived from the base type: comp.

The type inet:http:header has the following options set:

fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:http:header:name

The base string type. The inet:http:header:name type is derived from the base type: str.

The type inet:http:header:name has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

inet:http:param

An HTTP request path query parameter. The inet:http:param type is derived from the base type: comp.

The type inet:http:param has the following options set:

fields: (('name', 'str'), ('value', 'str'))

inet:http:request

A single HTTP request. The inet:http:request type is derived from the base type: guid.

inet:http:request:header

An HTTP request header. The inet:http:request:header type is derived from the base type: inet:http:header.

The type inet:http:request:header has the following options set:

fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:http:response:header

An HTTP response header. The inet:http:response:header type is derived from the base type: inet:http:header.

The type inet:http:response:header has the following options set:

fields: (('name', 'inet:http:header:name'), ('value', 'str'))

inet:http:session

An HTTP session. The inet:http:session type is derived from the base type: guid.

inet:iface

A network interface with a set of associated protocol addresses. The inet:iface type is derived from the base type: guid.

inet:mac

A 48-bit Media Access Control (MAC) address. The inet:mac type is derived from the base type: str.

An example of inet:mac:

aa:bb:cc:dd:ee:ff

The type inet:mac has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^([0-9a-f]{2}[:]){5}([0-9a-f]{2})$

replace: ()

strip: False

inet:net4

An IPv4 address range. The inet:net4 type is derived from the base type: inet:ipv4range.

An example of inet:net4:

(1.2.3.4, 1.2.3.20)

The type inet:net4 has the following options set:

type: ('inet:ipv4', {})

inet:net6

An IPv6 address range. The inet:net6 type is derived from the base type: inet:ipv6range.

An example of inet:net6:

('ff::00', 'ff::30')

The type inet:net6 has the following options set:

type: ('inet:ipv6', {})

inet:passwd

A password string. The inet:passwd type is derived from the base type: str.

The type inet:passwd has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:port

A network port. The inet:port type is derived from the base type: int.

An example of inet:port:

80

The type inet:port has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: 65535

min: 0

signed: True

size: 8

inet:proto

A network protocol name. The inet:proto type is derived from the base type: str.

The type inet:proto has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z0-9+-]+$

replace: ()

strip: False

inet:search:query

An instance of a search query issued to a search engine. The inet:search:query type is derived from the base type: guid.

inet:search:result

A single result from a web search. The inet:search:result type is derived from the base type: guid.

inet:server

A network server address. The inet:server type is derived from the base type: inet:addr.

An example of inet:server:

tcp://1.2.3.4:80

The type inet:server has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:servfile

A file hosted on a server for access over a network protocol. The inet:servfile type is derived from the base type: comp.

The type inet:servfile has the following options set:

fields: (('server', 'inet:server'), ('file', 'file:bytes'))

inet:ssl:cert

Deprecated. Please use inet:tls:servercert or inet:tls:clientcert. The inet:ssl:cert type is derived from the base type: comp.

The type inet:ssl:cert has the following options set:

fields: (('server', 'inet:server'), ('file', 'file:bytes'))

inet:ssl:jarmhash

A TLS JARM fingerprint hash. The inet:ssl:jarmhash type is derived from the base type: str.

The type inet:ssl:jarmhash has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^(?<ciphers>[0-9a-f]{30})(?<extensions>[0-9a-f]{32})$

replace: ()

strip: True

inet:ssl:jarmsample

A JARM hash sample taken from a server. The inet:ssl:jarmsample type is derived from the base type: comp.

The type inet:ssl:jarmsample has the following options set:

fields: (('server', 'inet:server'), ('jarmhash', 'inet:ssl:jarmhash'))

inet:tls:clientcert

An x509 certificate sent by a client for TLS. The inet:tls:clientcert type is derived from the base type: comp.

An example of inet:tls:clientcert:

(1.2.3.4:443, 3fdf364e081c14997b291852d1f23868)

The type inet:tls:clientcert has the following options set:

fields: (('client', 'inet:client'), ('cert', 'crypto:x509:cert'))

inet:tls:handshake

An instance of a TLS handshake between a server and client. The inet:tls:handshake type is derived from the base type: guid.

inet:tls:ja3:sample

A JA3 sample taken from a client. The inet:tls:ja3:sample type is derived from the base type: comp.

The type inet:tls:ja3:sample has the following options set:

fields: (('client', 'inet:client'), ('ja3', 'hash:md5'))

inet:tls:ja3s:sample

A JA3 sample taken from a server. The inet:tls:ja3s:sample type is derived from the base type: comp.

The type inet:tls:ja3s:sample has the following options set:

fields: (('server', 'inet:server'), ('ja3s', 'hash:md5'))

inet:tls:servercert

An x509 certificate sent by a server for TLS. The inet:tls:servercert type is derived from the base type: comp.

An example of inet:tls:servercert:

(1.2.3.4:443, c7437790af01ae1bb2f8f3b684c70bf8)

The type inet:tls:servercert has the following options set:

fields: (('server', 'inet:server'), ('cert', 'crypto:x509:cert'))

inet:tunnel

A specific sequence of hosts forwarding connections such as a VPN or proxy. The inet:tunnel type is derived from the base type: guid.

inet:tunnel:type:taxonomy

A taxonomy of network tunnel types. The inet:tunnel:type:taxonomy type is derived from the base type: taxonomy.

The type inet:tunnel:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:url:mirror

A URL mirror site. The inet:url:mirror type is derived from the base type: comp.

The type inet:url:mirror has the following options set:

fields: (('of', 'inet:url'), ('at', 'inet:url'))

inet:urlfile

A file hosted at a specific Universal Resource Locator (URL). The inet:urlfile type is derived from the base type: comp.

The type inet:urlfile has the following options set:

fields: (('url', 'inet:url'), ('file', 'file:bytes'))

inet:urlredir

A URL that redirects to another URL, such as via a URL shortening service or an HTTP 302 response. The inet:urlredir type is derived from the base type: comp.

An example of inet:urlredir:

(http://foo.com/,http://bar.com/)

The type inet:urlredir has the following options set:

fields: (('src', 'inet:url'), ('dst', 'inet:url'))

inet:user

A username string. The inet:user type is derived from the base type: str.

The type inet:user has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

inet:web:acct

An account with a given Internet-based site or service. The inet:web:acct type is derived from the base type: comp.

An example of inet:web:acct:

twitter.com/invisig0th

The type inet:web:acct has the following options set:

fields: (('site', 'inet:fqdn'), ('user', 'inet:user'))

sepr: /

inet:web:action

An instance of an account performing an action at an Internet-based site or service. The inet:web:action type is derived from the base type: guid.

inet:web:attachment

An instance of a file being sent to a web service by an account. The inet:web:attachment type is derived from the base type: guid.

inet:web:channel

A channel within a web service or instance such as slack or discord. The inet:web:channel type is derived from the base type: guid.

inet:web:chprofile

A change to a web account. Used to capture historical properties associated with an account, as opposed to current data in the inet:web:acct node. The inet:web:chprofile type is derived from the base type: guid.

inet:web:file

A file posted by a web account. The inet:web:file type is derived from the base type: comp.

The type inet:web:file has the following options set:

fields: (('acct', 'inet:web:acct'), ('file', 'file:bytes'))

inet:web:follows

A web account follows or is connected to another web account. The inet:web:follows type is derived from the base type: comp.

The type inet:web:follows has the following options set:

fields: (('follower', 'inet:web:acct'), ('followee', 'inet:web:acct'))

inet:web:group

A group hosted within or registered with a given Internet-based site or service. The inet:web:group type is derived from the base type: comp.

An example of inet:web:group:

somesite.com/mycoolgroup

The type inet:web:group has the following options set:

fields: (('site', 'inet:fqdn'), ('id', 'inet:group'))

sepr: /

inet:web:hashtag

A hashtag used in a web post. The inet:web:hashtag type is derived from the base type: str.

The type inet:web:hashtag has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^#[\w]+$

replace: ()

strip: False

inet:web:instance

An instance of a web service such as slack or discord. The inet:web:instance type is derived from the base type: guid.

inet:web:logon

An instance of an account authenticating to an Internet-based site or service. The inet:web:logon type is derived from the base type: guid.

inet:web:memb

Deprecated. Please use inet:web:member. The inet:web:memb type is derived from the base type: comp.

The type inet:web:memb has the following options set:

fields: (('acct', 'inet:web:acct'), ('group', 'inet:web:group'))

inet:web:member

Represents a web account membership in a channel or group. The inet:web:member type is derived from the base type: guid.

inet:web:mesg

A message sent from one web account to another web account or channel. The inet:web:mesg type is derived from the base type: comp.

An example of inet:web:mesg:

((twitter.com, invisig0th), (twitter.com, gobbles), 20041012130220)

The type inet:web:mesg has the following options set:

fields: (('from', 'inet:web:acct'), ('to', 'inet:web:acct'), ('time', 'time'))

inet:web:post

A post made by a web account. The inet:web:post type is derived from the base type: guid.

inet:web:post:link

A link contained within post text. The inet:web:post:link type is derived from the base type: guid.

inet:whois:contact

An individual contact from a domain whois record. The inet:whois:contact type is derived from the base type: comp.

The type inet:whois:contact has the following options set:

fields: (('rec', 'inet:whois:rec'), ('type', ('str', {'lower': True})))

inet:whois:email

An email address associated with an FQDN via whois registration text. The inet:whois:email type is derived from the base type: comp.

The type inet:whois:email has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('email', 'inet:email'))

inet:whois:ipcontact

An individual contact from an IP block record. The inet:whois:ipcontact type is derived from the base type: guid.

inet:whois:ipquery

Query details used to retrieve an IP record. The inet:whois:ipquery type is derived from the base type: guid.

inet:whois:iprec

An IPv4/IPv6 block registration record. The inet:whois:iprec type is derived from the base type: guid.

inet:whois:rar

A domain registrar. The inet:whois:rar type is derived from the base type: str.

An example of inet:whois:rar:

godaddy, inc.

The type inet:whois:rar has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

inet:whois:rec

A domain whois record. The inet:whois:rec type is derived from the base type: comp.

The type inet:whois:rec has the following options set:

fields: (('fqdn', 'inet:fqdn'), ('asof', 'time'))

inet:whois:recns

A nameserver associated with a domain whois record. The inet:whois:recns type is derived from the base type: comp.

The type inet:whois:recns has the following options set:

fields: (('ns', 'inet:fqdn'), ('rec', 'inet:whois:rec'))

inet:whois:reg

A domain registrant. The inet:whois:reg type is derived from the base type: str.

An example of inet:whois:reg:

woot hostmaster

The type inet:whois:reg has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

inet:whois:regid

The registry unique identifier of the registration record. The inet:whois:regid type is derived from the base type: str.

An example of inet:whois:regid:

NET-10-0-0-0-1

The type inet:whois:regid has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

inet:wifi:ap

An SSID/MAC address combination for a wireless access point. The inet:wifi:ap type is derived from the base type: comp.

The type inet:wifi:ap has the following options set:

fields: (('ssid', 'inet:wifi:ssid'), ('bssid', 'inet:mac'))

inet:wifi:ssid

A WiFi service set identifier (SSID) name. The inet:wifi:ssid type is derived from the base type: str.

An example of inet:wifi:ssid:

The Vertex Project

The type inet:wifi:ssid has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

iso:3166:cc

An ISO 3166 2 digit country code. The iso:3166:cc type is derived from the base type: str.

The type iso:3166:cc has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z]{2}$

replace: ()

strip: False

iso:oid

An ISO Object Identifier string. The iso:oid type is derived from the base type: str.

The type iso:oid has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^([0-2])((\.0)|(\.[1-9][0-9]*))*$

replace: ()

strip: False

it:account

A GUID that represents an account on a host or network. The it:account type is derived from the base type: guid.

it:adid

An advertising identification string. The it:adid type is derived from the base type: str.

The type it:adid has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

it:app:snort:hit

An instance of a snort rule hit. The it:app:snort:hit type is derived from the base type: guid.

it:app:snort:rule

A snort rule. The it:app:snort:rule type is derived from the base type: guid.

it:app:yara:match

A YARA rule match to a file. The it:app:yara:match type is derived from the base type: comp.

The type it:app:yara:match has the following options set:

fields: (('rule', 'it:app:yara:rule'), ('file', 'file:bytes'))

it:app:yara:procmatch

An instance of a YARA rule match to a process. The it:app:yara:procmatch type is derived from the base type: guid.

it:app:yara:rule

A YARA rule unique identifier. The it:app:yara:rule type is derived from the base type: guid.

it:auth:passwdhash

An instance of a password hash. The it:auth:passwdhash type is derived from the base type: guid.

it:av:filehit

Deprecated. Please use it:av:scan:result. The it:av:filehit type is derived from the base type: comp.

The type it:av:filehit has the following options set:

fields: (('file', 'file:bytes'), ('sig', 'it:av:sig'))

it:av:prochit

Deprecated. Please use it:av:scan:result. The it:av:prochit type is derived from the base type: guid.

it:av:scan:result

The result of running an antivirus scanner. The it:av:scan:result type is derived from the base type: guid.

it:av:sig

Deprecated. Please use it:av:scan:result. The it:av:sig type is derived from the base type: comp.

The type it:av:sig has the following options set:

fields: (('soft', 'it:prod:soft'), ('name', 'it:av:signame'))

it:av:signame

An antivirus signature name. The it:av:signame type is derived from the base type: str.

The type it:av:signame has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

it:cmd

A unique command-line string. The it:cmd type is derived from the base type: str.

An example of it:cmd:

foo.exe --dostuff bar

The type it:cmd has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

it:dev:int

A developer selected integer constant. The it:dev:int type is derived from the base type: int.

The type it:dev:int has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

it:dev:mutex

A string representing a mutex. The it:dev:mutex type is derived from the base type: str.

The type it:dev:mutex has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:dev:pipe

A string representing a named pipe. The it:dev:pipe type is derived from the base type: str.

The type it:dev:pipe has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:dev:regkey

A Windows registry key. The it:dev:regkey type is derived from the base type: str.

An example of it:dev:regkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

The type it:dev:regkey has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:dev:regval

A Windows registry key/value pair. The it:dev:regval type is derived from the base type: guid.

it:dev:repo

A version control system instance. The it:dev:repo type is derived from the base type: guid.

it:dev:repo:branch

A branch in a version control system instance. The it:dev:repo:branch type is derived from the base type: guid.

it:dev:repo:commit

A commit to a repository. The it:dev:repo:commit type is derived from the base type: guid.

it:dev:repo:diff

A diff of a file being applied in a single commit. The it:dev:repo:diff type is derived from the base type: guid.

it:dev:repo:diff:comment

A comment on a diff in a repository. The it:dev:repo:diff:comment type is derived from the base type: guid.

it:dev:repo:issue

An issue raised in a repository. The it:dev:repo:issue type is derived from the base type: guid.

it:dev:repo:issue:comment

A comment on an issue in a repository. The it:dev:repo:issue:comment type is derived from the base type: guid.

it:dev:repo:issue:label

A label applied to a repository issue. The it:dev:repo:issue:label type is derived from the base type: guid.

it:dev:repo:label

A developer selected label. The it:dev:repo:label type is derived from the base type: guid.

it:dev:repo:remote

A remote repo that is tracked for changes/branches/etc. The it:dev:repo:remote type is derived from the base type: guid.

it:dev:repo:type:taxonomy

A version control system type taxonomy. The it:dev:repo:type:taxonomy type is derived from the base type: taxonomy.

The type it:dev:repo:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:dev:str

A developer selected string. The it:dev:str type is derived from the base type: str.

The type it:dev:str has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:domain

A logical boundary of authentication and configuration such as a windows domain. The it:domain type is derived from the base type: guid.

it:exec:bind

An instance of a host binding a listening port. The it:exec:bind type is derived from the base type: guid.

it:exec:file:add

An instance of a host adding a file to a filesystem. The it:exec:file:add type is derived from the base type: guid.

it:exec:file:del

An instance of a host deleting a file from a filesystem. The it:exec:file:del type is derived from the base type: guid.

it:exec:file:read

An instance of a host reading a file from a filesystem. The it:exec:file:read type is derived from the base type: guid.

it:exec:file:write

An instance of a host writing a file to a filesystem. The it:exec:file:write type is derived from the base type: guid.

it:exec:loadlib

A library load event in a process. The it:exec:loadlib type is derived from the base type: guid.

it:exec:mmap

A memory mapped segment located in a process. The it:exec:mmap type is derived from the base type: guid.

it:exec:mutex

A mutex created by a process at runtime. The it:exec:mutex type is derived from the base type: guid.

it:exec:pipe

A named pipe created by a process at runtime. The it:exec:pipe type is derived from the base type: guid.

it:exec:proc

A process executing on a host. May be an actual (e.g., endpoint) or virtual (e.g., malware sandbox) host. The it:exec:proc type is derived from the base type: guid.

it:exec:query

An instance of an executed query. The it:exec:query type is derived from the base type: guid.

it:exec:reg:del

An instance of a host deleting a registry key. The it:exec:reg:del type is derived from the base type: guid.

it:exec:reg:get

An instance of a host getting a registry key. The it:exec:reg:get type is derived from the base type: guid.

it:exec:reg:set

An instance of a host creating or setting a registry key. The it:exec:reg:set type is derived from the base type: guid.

it:exec:thread

A thread executing in a process. The it:exec:thread type is derived from the base type: guid.

it:exec:url

An instance of a host requesting a URL. The it:exec:url type is derived from the base type: guid.

it:fs:file

A file on a host. The it:fs:file type is derived from the base type: guid.

it:group

A GUID that represents a group on a host or network. The it:group type is derived from the base type: guid.

it:host

A GUID that represents a host or system. The it:host type is derived from the base type: guid.

it:hostname

The name of a host or system. The it:hostname type is derived from the base type: str.

The type it:hostname has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

it:hostsoft

A version of a software product which is present on a given host. The it:hostsoft type is derived from the base type: comp.

The type it:hostsoft has the following options set:

fields: (('host', 'it:host'), ('softver', 'it:prod:softver'))

it:hosturl

A url hosted on or served by a host or system. The it:hosturl type is derived from the base type: comp.

The type it:hosturl has the following options set:

fields: (('host', 'it:host'), ('url', 'inet:url'))

it:log:event

A GUID representing an individual log event. The it:log:event type is derived from the base type: guid.

it:log:event:type:taxonomy

A taxonomy of log event types. The it:log:event:type:taxonomy type is derived from the base type: taxonomy.

The type it:log:event:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:logon

A GUID that represents an individual logon/logoff event. The it:logon type is derived from the base type: guid.

it:mitre:attack:campaign

A MITRE ATT&CK Campaign ID. The it:mitre:attack:campaign type is derived from the base type: str.

An example of it:mitre:attack:campaign:

C0028

The type it:mitre:attack:campaign has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^C[0-9]{4}$

replace: ()

strip: False

it:mitre:attack:flow

A MITRE ATT&CK Flow diagram. The it:mitre:attack:flow type is derived from the base type: guid.

it:mitre:attack:group

A MITRE ATT&CK Group ID. The it:mitre:attack:group type is derived from the base type: str.

An example of it:mitre:attack:group:

G0100

The type it:mitre:attack:group has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^G[0-9]{4}$

replace: ()

strip: False

it:mitre:attack:matrix

An enumeration of ATT&CK matrix values. The it:mitre:attack:matrix type is derived from the base type: str.

An example of it:mitre:attack:matrix:

enterprise

The type it:mitre:attack:matrix has the following options set:

enums:

valu

enterprise

mobile

ics

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:mitre:attack:mitigation

A MITRE ATT&CK Mitigation ID. The it:mitre:attack:mitigation type is derived from the base type: str.

An example of it:mitre:attack:mitigation:

M1036

The type it:mitre:attack:mitigation has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^M[0-9]{4}$

replace: ()

strip: False

it:mitre:attack:software

A MITRE ATT&CK Software ID. The it:mitre:attack:software type is derived from the base type: str.

An example of it:mitre:attack:software:

S0154

The type it:mitre:attack:software has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^S[0-9]{4}$

replace: ()

strip: False

it:mitre:attack:status

A MITRE ATT&CK element status. The it:mitre:attack:status type is derived from the base type: str.

An example of it:mitre:attack:status:

current

The type it:mitre:attack:status has the following options set:

enums:

valu

current

deprecated

withdrawn

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:mitre:attack:tactic

A MITRE ATT&CK Tactic ID. The it:mitre:attack:tactic type is derived from the base type: str.

An example of it:mitre:attack:tactic:

TA0040

The type it:mitre:attack:tactic has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^TA[0-9]{4}$

replace: ()

strip: False

it:mitre:attack:technique

A MITRE ATT&CK Technique ID. The it:mitre:attack:technique type is derived from the base type: str.

An example of it:mitre:attack:technique:

T1548

The type it:mitre:attack:technique has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^T[0-9]{4}(.[0-9]{3})?$

replace: ()

strip: False

it:network

A GUID that represents a logical network. The it:network type is derived from the base type: guid.

it:os:android:aaid

An android advertising identification string. The it:os:android:aaid type is derived from the base type: it:adid.

The type it:os:android:aaid has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

it:os:android:ibroadcast

The given software broadcasts the given Android intent. The it:os:android:ibroadcast type is derived from the base type: comp.

The type it:os:android:ibroadcast has the following options set:

fields: (('app', 'it:prod:soft'), ('intent', 'it:os:android:intent'))

it:os:android:ilisten

The given software listens for an android intent. The it:os:android:ilisten type is derived from the base type: comp.

The type it:os:android:ilisten has the following options set:

fields: (('app', 'it:prod:soft'), ('intent', 'it:os:android:intent'))

it:os:android:intent

An android intent string. The it:os:android:intent type is derived from the base type: str.

The type it:os:android:intent has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:os:android:perm

An android permission string. The it:os:android:perm type is derived from the base type: str.

The type it:os:android:perm has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:os:android:reqperm

The given software requests the android permission. The it:os:android:reqperm type is derived from the base type: comp.

The type it:os:android:reqperm has the following options set:

fields: (('app', 'it:prod:soft'), ('perm', 'it:os:android:perm'))

it:os:ios:idfa

An iOS advertising identification string. The it:os:ios:idfa type is derived from the base type: it:adid.

The type it:os:ios:idfa has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

it:os:windows:sid

A Microsoft Windows Security Identifier. The it:os:windows:sid type is derived from the base type: str.

An example of it:os:windows:sid:

S-1-5-21-1220945662-1202665555-839525555-5555

The type it:os:windows:sid has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^S-1-(?:\d{1,10}|0x[0-9a-fA-F]{12})(?:-(?:\d+|0x[0-9a-fA-F]{2,}))*$

replace: ()

strip: False

it:prod:component

A specific instance of an it:prod:hardware most often as part of an it:host. The it:prod:component type is derived from the base type: guid.

it:prod:hardware

A specification for a piece of IT hardware. The it:prod:hardware type is derived from the base type: guid.

it:prod:hardwaretype

An IT hardware type taxonomy. The it:prod:hardwaretype type is derived from the base type: taxonomy.

The type it:prod:hardwaretype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:prod:soft

A software product. The it:prod:soft type is derived from the base type: guid.

it:prod:soft:taxonomy

A software type taxonomy. The it:prod:soft:taxonomy type is derived from the base type: taxonomy.

The type it:prod:soft:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

it:prod:softfile

A file is distributed by a specific software version. The it:prod:softfile type is derived from the base type: comp.

The type it:prod:softfile has the following options set:

fields: (('soft', 'it:prod:softver'), ('file', 'file:bytes'))

it:prod:softid

An identifier issued to a given host by a specific software application. The it:prod:softid type is derived from the base type: guid.

it:prod:softlib

A software version contains a library software version. The it:prod:softlib type is derived from the base type: comp.

The type it:prod:softlib has the following options set:

fields: (('soft', 'it:prod:softver'), ('lib', 'it:prod:softver'))

it:prod:softname

A software product name. The it:prod:softname type is derived from the base type: str.

The type it:prod:softname has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

it:prod:softos

The software version is known to be compatible with the given os software version. The it:prod:softos type is derived from the base type: comp.

The type it:prod:softos has the following options set:

fields: (('soft', 'it:prod:softver'), ('os', 'it:prod:softver'))

it:prod:softreg

A registry entry is created by a specific software version. The it:prod:softreg type is derived from the base type: comp.

The type it:prod:softreg has the following options set:

fields: (('softver', 'it:prod:softver'), ('regval', 'it:dev:regval'))

it:prod:softver

A specific version of a software product. The it:prod:softver type is derived from the base type: guid.

it:query

A unique query string. The it:query type is derived from the base type: str.

The type it:query has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

it:reveng:filefunc

An instance of a function in an executable. The it:reveng:filefunc type is derived from the base type: comp.

The type it:reveng:filefunc has the following options set:

fields: (('file', 'file:bytes'), ('function', 'it:reveng:function'))

it:reveng:funcstr

A reference to a string inside a function. The it:reveng:funcstr type is derived from the base type: comp.

The type it:reveng:funcstr has the following options set:

fields: (('function', 'it:reveng:function'), ('string', 'str'))

it:reveng:function

A function inside an executable. The it:reveng:function type is derived from the base type: guid.

it:reveng:impfunc

A function from an imported library. The it:reveng:impfunc type is derived from the base type: str.

The type it:reveng:impfunc has the following options set:

globsuffix: False

lower: 1

onespace: False

regex: None

replace: ()

strip: False

it:screenshot

A screenshot of a host. The it:screenshot type is derived from the base type: guid.

it:sec:c2:config

An extracted C2 config from an executable. The it:sec:c2:config type is derived from the base type: guid.

it:sec:cve

A vulnerability as designated by a Common Vulnerabilities and Exposures (CVE) number. The it:sec:cve type is derived from the base type: str.

An example of it:sec:cve:

cve-2012-0158

The type it:sec:cve has the following options set:

globsuffix: False

lower: True

onespace: False

regex: (?i)^CVE-[0-9]{4}-[0-9]{4,}$

replace: (('‑', '-'), ('‒', '-'), ('–', '-'), ('—', '-'))

strip: False

it:sec:cwe

NIST NVD Common Weaknesses Enumeration Specification. The it:sec:cwe type is derived from the base type: str.

An example of it:sec:cwe:

CWE-120

The type it:sec:cwe has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^CWE-[0-9]{1,8}$

replace: ()

strip: False

it:sec:metrics

A node used to track metrics of an organization’s infosec program. The it:sec:metrics type is derived from the base type: guid.

it:sec:stix:bundle

A STIX bundle. The it:sec:stix:bundle type is derived from the base type: guid.

it:sec:stix:indicator

A STIX indicator pattern. The it:sec:stix:indicator type is derived from the base type: guid.

it:sec:tlp

The US CISA Traffic-Light-Protocol used to designate information sharing boundaries. The it:sec:tlp type is derived from the base type: int.

An example of it:sec:tlp:

green

The type it:sec:tlp has the following options set:

enums:

int

valu

10

clear

20

green

30

amber

40

amber-strict

50

red

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

it:sec:vuln:scan

An instance of running a vulnerability scan. The it:sec:vuln:scan type is derived from the base type: guid.

it:sec:vuln:scan:result

A vulnerability scan result for an asset. The it:sec:vuln:scan:result type is derived from the base type: guid.

lang:code

An optionally 2 part language code. The lang:code type is derived from the base type: str.

An example of lang:code:

pt.br

The type lang:code has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z]{2}(.[a-z]{2})?$

replace: ()

strip: False

lang:idiom

Deprecated. Please use lang:translation. The lang:idiom type is derived from the base type: str.

The type lang:idiom has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

lang:language

A specific written or spoken language. The lang:language type is derived from the base type: guid.

lang:name

A name used to refer to a language. The lang:name type is derived from the base type: str.

The type lang:name has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

lang:trans

Deprecated. Please use lang:translation. The lang:trans type is derived from the base type: str.

The type lang:trans has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

lang:translation

A translation of text from one language to another. The lang:translation type is derived from the base type: guid.

mass

A mass which converts to grams as a base unit. The mass type is derived from the base type: hugenum.

The type mass has the following options set:

modulo: None

units: {'µg': '0.000001', 'microgram': '0.000001', 'micrograms': '0.000001', 'mg': '0.001', 'milligram': '0.001', 'milligrams': '0.001', 'g': '1', 'grams': '1', 'kg': '1000', 'kilogram': '1000', 'kilograms': '1000', 'lb': '453.592', 'lbs': '453.592', 'pound': '453.592', 'pounds': '453.592', 'stone': '6350.29'}

mat:item

A GUID assigned to a material object. The mat:item type is derived from the base type: guid.

mat:itemimage

The base type for compound node fields. The mat:itemimage type is derived from the base type: comp.

The type mat:itemimage has the following options set:

fields: (('item', 'mat:item'), ('file', 'file:bytes'))

mat:spec

A GUID assigned to a material specification. The mat:spec type is derived from the base type: guid.

mat:specimage

The base type for compound node fields. The mat:specimage type is derived from the base type: comp.

The type mat:specimage has the following options set:

fields: (('spec', 'mat:spec'), ('file', 'file:bytes'))

mat:type

A taxonomy of material item/specification types. The mat:type type is derived from the base type: taxonomy.

The type mat:type has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

media:news

A GUID for a news article or report. The media:news type is derived from the base type: guid.

media:news:taxonomy

A taxonomy of types or sources of news. The media:news:taxonomy type is derived from the base type: taxonomy.

The type media:news:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

media:topic

A topic string. The media:topic type is derived from the base type: str.

The type media:topic has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

meta:event

An analytically relevant event in a curated timeline. The meta:event type is derived from the base type: guid.

meta:event:taxonomy

A taxonomy of event types for meta:event nodes. The meta:event:taxonomy type is derived from the base type: taxonomy.

The type meta:event:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

meta:note

An analyst note about nodes linked with -(about)> edges. The meta:note type is derived from the base type: guid.

meta:note:type:taxonomy

An analyst note type taxonomy. The meta:note:type:taxonomy type is derived from the base type: taxonomy.

The type meta:note:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

meta:priority

A generic priority enumeration. The meta:priority type is derived from the base type: int.

The type meta:priority has the following options set:

enums:

int

valu

0

none

10

lowest

20

low

30

medium

40

high

50

highest

enums:strict: False

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

meta:rule

A generic rule linked to matches with -(matches)> edges. The meta:rule type is derived from the base type: guid.

meta:ruleset

A set of rules linked with -(has)> edges. The meta:ruleset type is derived from the base type: guid.

meta:seen

Annotates that the data in a node was obtained from or observed by a given source. The meta:seen type is derived from the base type: comp.

The type meta:seen has the following options set:

fields: (('source', 'meta:source'), ('node', 'ndef'))

meta:severity

A generic severity enumeration. The meta:severity type is derived from the base type: int.

The type meta:severity has the following options set:

enums:

int

valu

0

none

10

lowest

20

low

30

medium

40

high

50

highest

enums:strict: False

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

meta:sophistication

A sophistication score with named values: very low, low, medium, high, and very high. The meta:sophistication type is derived from the base type: int.

The type meta:sophistication has the following options set:

enums:

int

valu

10

very low

20

low

30

medium

40

high

50

very high

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

meta:source

A data source unique identifier. The meta:source type is derived from the base type: guid.

meta:timeline

A curated timeline of analytically relevant events. The meta:timeline type is derived from the base type: guid.

meta:timeline:taxonomy

A taxonomy of timeline types for meta:timeline nodes. The meta:timeline:taxonomy type is derived from the base type: taxonomy.

The type meta:timeline:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:alias

An alias for the org GUID. The ou:alias type is derived from the base type: str.

An example of ou:alias:

vertexproject

The type ou:alias has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[0-9a-z_]+$

replace: ()

strip: False

ou:attendee

A node representing a person attending a meeting, conference, or event. The ou:attendee type is derived from the base type: guid.

ou:award

An award issued by an organization. The ou:award type is derived from the base type: guid.

ou:campaign

Represents an org’s activity in pursuit of a goal. The ou:campaign type is derived from the base type: guid.

ou:campname

A campaign name. The ou:campname type is derived from the base type: str.

The type ou:campname has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

ou:camptype

An campaign type taxonomy. The ou:camptype type is derived from the base type: taxonomy.

The type ou:camptype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:conference

A conference with a name and sponsoring org. The ou:conference type is derived from the base type: guid.

ou:conference:attendee

Deprecated. Please use ou:attendee. The ou:conference:attendee type is derived from the base type: comp.

The type ou:conference:attendee has the following options set:

fields: (('conference', 'ou:conference'), ('person', 'ps:person'))

ou:conference:event

A conference event with a name and associated conference. The ou:conference:event type is derived from the base type: guid.

ou:conference:event:attendee

Deprecated. Please use ou:attendee. The ou:conference:event:attendee type is derived from the base type: comp.

The type ou:conference:event:attendee has the following options set:

fields: (('conference', 'ou:conference:event'), ('person', 'ps:person'))

ou:conflict

Represents a conflict where two or more campaigns have mutually exclusive goals. The ou:conflict type is derived from the base type: guid.

ou:contest

A competitive event resulting in a ranked set of participants. The ou:contest type is derived from the base type: guid.

ou:contest:result

The results from a single contest participant. The ou:contest:result type is derived from the base type: comp.

The type ou:contest:result has the following options set:

fields: (('contest', 'ou:contest'), ('participant', 'ps:contact'))

ou:contract

An contract between multiple entities. The ou:contract type is derived from the base type: guid.

ou:contract:type

A pre-defined set of contract types. The ou:contract:type type is derived from the base type: str.

The type ou:contract:type has the following options set:

enum: ('nda', 'other', 'grant', 'treaty', 'purchase', 'indemnity', 'partnership')

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:contribution

Represents a specific instance of contributing material support to a campaign. The ou:contribution type is derived from the base type: guid.

ou:conttype

A contract type taxonomy. The ou:conttype type is derived from the base type: taxonomy.

The type ou:conttype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:employment

An employment type taxonomy. The ou:employment type is derived from the base type: taxonomy.

An example of ou:employment:

fulltime.salary

The type ou:employment has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:goal

An assessed or stated goal which may be abstract or org specific. The ou:goal type is derived from the base type: guid.

ou:goal:type:taxonomy

A taxonomy of goal types. The ou:goal:type:taxonomy type is derived from the base type: taxonomy.

The type ou:goal:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:goalname

A goal name. The ou:goalname type is derived from the base type: str.

The type ou:goalname has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

ou:hasalias

The knowledge that an organization has an alias. The ou:hasalias type is derived from the base type: comp.

The type ou:hasalias has the following options set:

fields: (('org', 'ou:org'), ('alias', 'ou:alias'))

ou:hasgoal

Deprecated. Please use ou:org:goals. The ou:hasgoal type is derived from the base type: comp.

The type ou:hasgoal has the following options set:

fields: (('org', 'ou:org'), ('goal', 'ou:goal'))

ou:id:number

A unique id number issued by a specific organization. The ou:id:number type is derived from the base type: comp.

The type ou:id:number has the following options set:

fields: (('type', 'ou:id:type'), ('value', 'ou:id:value'))

ou:id:type

A type of id number issued by an org. The ou:id:type type is derived from the base type: guid.

ou:id:update

A status update to an org:id:number. The ou:id:update type is derived from the base type: guid.

ou:id:value

The value of an org:id:number. The ou:id:value type is derived from the base type: str.

The type ou:id:value has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

ou:industry

An industry classification type. The ou:industry type is derived from the base type: guid.

ou:industry:type:taxonomy

An industry type taxonomy. The ou:industry:type:taxonomy type is derived from the base type: taxonomy.

The type ou:industry:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:industryname

The name of an industry. The ou:industryname type is derived from the base type: str.

The type ou:industryname has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

ou:isic

An International Standard Industrial Classification of All Economic Activities (ISIC) code. The ou:isic type is derived from the base type: str.

An example of ou:isic:

C1393

The type ou:isic has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[A-Z]([0-9]{2}[0-9]{0,2})?$

replace: ()

strip: False

ou:jobtitle

A title for a position within an org. The ou:jobtitle type is derived from the base type: str.

The type ou:jobtitle has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

ou:jobtype

A taxonomy of job types. The ou:jobtype type is derived from the base type: taxonomy.

An example of ou:jobtype:

it.dev.python

The type ou:jobtype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:meet

An informal meeting of people which has no title or sponsor. See also: ou:conference. The ou:meet type is derived from the base type: guid.

ou:meet:attendee

Deprecated. Please use ou:attendee. The ou:meet:attendee type is derived from the base type: comp.

The type ou:meet:attendee has the following options set:

fields: (('meet', 'ou:meet'), ('person', 'ps:person'))

ou:member

Deprecated. Please use ou:position. The ou:member type is derived from the base type: comp.

The type ou:member has the following options set:

fields: (('org', 'ou:org'), ('person', 'ps:person'))

ou:naics

North American Industry Classification System codes and prefixes. The ou:naics type is derived from the base type: str.

An example of ou:naics:

541715

The type ou:naics has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[1-9][0-9]{1,5}?$

replace: ()

strip: True

ou:name

The name of an organization. This may be a formal name or informal name of the organization. The ou:name type is derived from the base type: str.

An example of ou:name:

acme corporation

The type ou:name has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

ou:opening

A job/work opening within an org. The ou:opening type is derived from the base type: guid.

ou:org

A GUID for a human organization such as a company or military unit. The ou:org type is derived from the base type: guid.

ou:org:has

An org owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ou:org:has type is derived from the base type: comp.

The type ou:org:has has the following options set:

fields: (('org', 'ou:org'), ('node', 'ndef'))

ou:orgnet4

An organization’s IPv4 netblock. The ou:orgnet4 type is derived from the base type: comp.

The type ou:orgnet4 has the following options set:

fields: (('org', 'ou:org'), ('net', 'inet:net4'))

ou:orgnet6

An organization’s IPv6 netblock. The ou:orgnet6 type is derived from the base type: comp.

The type ou:orgnet6 has the following options set:

fields: (('org', 'ou:org'), ('net', 'inet:net6'))

ou:orgtype

An org type taxonomy. The ou:orgtype type is derived from the base type: taxonomy.

The type ou:orgtype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:position

A position within an org. May be organized into an org chart. The ou:position type is derived from the base type: guid.

ou:preso

A webinar, conference talk, or other type of presentation. The ou:preso type is derived from the base type: guid.

ou:requirement

A specific requirement. The ou:requirement type is derived from the base type: guid.

ou:role

A named role when participating in an event. The ou:role type is derived from the base type: str.

An example of ou:role:

staff

The type ou:role has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^\w+$

replace: ()

strip: False

ou:sic

The four digit Standard Industrial Classification Code. The ou:sic type is derived from the base type: str.

An example of ou:sic:

0111

The type ou:sic has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[0-9]{4}$

replace: ()

strip: False

ou:suborg

Any parent/child relationship between two orgs. May represent ownership, organizational structure, etc. The ou:suborg type is derived from the base type: comp.

The type ou:suborg has the following options set:

fields: (('org', 'ou:org'), ('sub', 'ou:org'))

ou:team

A GUID for a team within an organization. The ou:team type is derived from the base type: guid.

ou:technique

A specific technique used to achieve a goal. The ou:technique type is derived from the base type: guid.

ou:technique:taxonomy

An analyst defined taxonomy to classify techniques in different disciplines. The ou:technique:taxonomy type is derived from the base type: taxonomy.

The type ou:technique:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ou:user

A user name within an organization. The ou:user type is derived from the base type: comp.

The type ou:user has the following options set:

fields: (('org', 'ou:org'), ('user', 'inet:user'))

ou:vitals

Vital statistics about an org for a given time period. The ou:vitals type is derived from the base type: guid.

pe:langid

The PE language id. The pe:langid type is derived from the base type: int.

The type pe:langid has the following options set:

enums:

int

valu

0

neutral

4

zh-Hans

26

hr

127

invariant

1024

default

1025

ar-SA

1026

bg-BG

1027

ca-ES

1029

cs-CZ

1030

da-DK

1031

de-DE

1032

el-GR

1033

en-US

1034

es-ES-traditional

1035

fi-FI

1036

fr-FR

1037

he-IL

1038

hu-HU

1039

is-IS

1040

it-IT

1041

ja-JP

1042

ko-KR

1043

nl-NL

1044

nb-NO

1045

pl-PL

1046

pt-BR

1047

rm-CH

1048

ro-RO

1049

ru-RU

1050

hr-HR

1051

sk-SK

1052

sq-AL

1053

sv-SE

1054

th-TH

1055

tr-TR

1056

ur-PK

1057

id-ID

1058

uk-UA

1059

be-BY

1060

sl-SI

1061

et-EE

1062

lv-LV

1063

lt-LT

1064

tg-TJ

1065

fa-IR

1066

vi-VN

1067

hy-AM

1068

az-AZ-Latin

1069

Basque-Basque

1070

hsb-DE

1071

mk-MK

1074

tn-ZA

1076

xh-ZA

1077

zu-ZA

1078

af-ZA

1079

ka-GE

1080

fo-FO

1081

hi-IN

1082

mt-MT

1083

se-NO

1086

ms-MY

1087

kk-KZ

1088

ky-KG

1089

sw-KE

1090

tk-TM

1091

uz-UZ-Latin

1092

tt-RU

1093

bn-Bangledesh

1094

pa-IN

1095

gu-IN

1096

or-IN

1097

ta-IN

1098

te-IN

1099

kn-IN

1100

ml-IN

1101

as-IN

1102

mr-IN

1103

sa-IN

1104

mn-MN-Cyrllic

1105

bo-CN

1106

cy-GB

1107

kh-KH

1108

lo-LA

1110

gl-ES

1111

kok-IN

1114

syr-SY

1115

si-LK

1116

chr-Cher

1117

iu-CA

1118

am-ET

1121

ne-NP

1122

fy-NL

1123

ps-AF

1124

fil-PH

1125

dv-MV

1128

ha-NG

1130

yo-NG

1131

quz-BO

1132

nso-ZA

1133

ba-RU

1134

lb-LU

1135

kl-GL

1136

ig-NG

1139

ti-ET

1141

haw-US

1144

ii-CN

1146

arn-CL

1148

moh-CA

1150

br-FR

1152

ug-CN

1153

mi-NZ

1154

oc-FR

1155

co-FR

1156

gsw-FR

1157

sah-RU

1158

qut-GT

1159

rw-RW

1160

wo-SN

1164

prs-AF

1170

ku-IQ

2048

sys default

2049

ar-IQ

2051

ca-ES-Valencia

2055

de-CH

2057

en-GB

2058

es-MX

2060

fr-BE

2064

it-CH

2067

nl-BE

2068

no-NO

2070

pt-PT

2074

sr-CS-Latin

2077

sv-FI

2080

ur-IN

2092

az-AZ-Cyrillic

2094

dsb-DE

2098

tn-BW

2107

se-SE

2108

ga-IE

2110

ms-BN

2115

uz-UZ-Cyrillic

2117

bn-IN

2118

pa-PK

2121

ta-LK

2128

mn-MN-Prc

2137

sd-PK

2141

iu-CA-Latin

2143

tzm-DZ

2151

ff-SN

2155

quz-EC

2163

ti-ER

3072

custom default

3073

ar-EG

3076

zh-HK

3079

de-AT

3081

en-AU

3082

es-ES-modern

3084

fr-CA

3098

sr-CS-Cyrillic

3131

se-FI

3179

quz-PE

4096

custom unspecified

4097

ar-LY

4100

zh-SG

4103

de-LU

4105

en-CA

4106

es-GT

4108

fr-CH

4122

hr-BA

4155

smj-NO

5120

ui_custom_default

5121

ar-DZ

5124

zh-MO

5127

de-LI

5129

en-NZ

5130

es-CR

5132

fr-LU

5146

bs-BA-Latin

5179

smj-SE

6145

ar-MA

6153

en-IE

6154

es-PA

6156

fr-MC

6170

sr-code-Latin

6203

sma-NO

7169

ar-TN

7177

en-ZA

7178

es-DO

7194

sr-BA

7227

sma-SE

8193

ar-OM

8201

en-JM

8202

es-VE

8218

bs-BA-Cyrillic

8251

sms-FI

9217

ar-YE

9225

en-029

9226

es-CO

9275

smn-FIl

10241

ar-SY

10249

en-BZ

10250

es-PE

11265

ar-JO

11273

en-TT

11274

es-AR

12289

ar-LB

12297

en-ZW

12298

es-EC

13313

ar-KW

13321

en-PH

13322

es-CL

14337

ar-AE

14346

es-UY

15361

ar-BH

15370

es-PY

16385

ar-QA

16393

en-IN

16394

es-BO

17417

en-MY

17418

es-SV

18441

en-SG

18442

es-HN

19466

es-NI

20490

es-PR

21514

es-US

30746

bs-neutral

31748

zh-Hant

31770

sr-Neutral

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

pe:resource:type

The typecode for the resource. The pe:resource:type type is derived from the base type: int.

The type pe:resource:type has the following options set:

enums:

int

valu

1

RT_CURSOR

2

RT_BITMAP

3

RT_ICON

4

RT_MENU

5

RT_DIALOG

6

RT_STRING

7

RT_FONTDIR

8

RT_FONT

9

RT_ACCELERATOR

10

RT_RCDATA

11

RT_MESSAGETABLE

12

RT_GROUP_CURSOR

14

RT_GROUP_ICON

16

RT_VERSION

17

RT_DLGINCLUDE

19

RT_PLUGPLAY

20

RT_VXD

21

RT_ANICURSOR

22

RT_ANIICON

23

RT_HTML

24

RT_MANIFEST

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

pol:candidate

A candidate for office in a specific race. The pol:candidate type is derived from the base type: guid.

pol:country

A GUID for a country. The pol:country type is derived from the base type: guid.

pol:election

An election involving one or more races for office. The pol:election type is derived from the base type: guid.

pol:immigration:status

A node which tracks the immigration status of a contact. The pol:immigration:status type is derived from the base type: guid.

pol:immigration:status:type:taxonomy

A taxonomy of immigration types. The pol:immigration:status:type:taxonomy type is derived from the base type: taxonomy.

The type pol:immigration:status:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

pol:iso2

The 2 digit ISO 3166 country code. The pol:iso2 type is derived from the base type: str.

An example of pol:iso2:

us

The type pol:iso2 has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z0-9]{2}$

replace: ()

strip: False

pol:iso3

The 3 digit ISO 3166 country code. The pol:iso3 type is derived from the base type: str.

An example of pol:iso3:

usa

The type pol:iso3 has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z0-9]{3}$

replace: ()

strip: False

pol:isonum

The ISO integer country code. The pol:isonum type is derived from the base type: int.

An example of pol:isonum:

840

The type pol:isonum has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

pol:office

An elected or appointed office. The pol:office type is derived from the base type: guid.

pol:pollingplace

An official place where ballots may be cast for a specific election. The pol:pollingplace type is derived from the base type: guid.

pol:race

An individual race for office. The pol:race type is derived from the base type: guid.

pol:term

A term in office held by a specific individual. The pol:term type is derived from the base type: guid.

pol:vitals

A set of vital statistics about a country. The pol:vitals type is derived from the base type: guid.

proj:attachment

A file attachment added to a ticket or comment. The proj:attachment type is derived from the base type: guid.

proj:comment

A user comment on a ticket. The proj:comment type is derived from the base type: guid.

proj:epic

A collection of tickets related to a topic. The proj:epic type is derived from the base type: guid.

proj:project

A project in a ticketing system. The proj:project type is derived from the base type: guid.

proj:project:type:taxonomy

A type taxonomy for projects. The proj:project:type:taxonomy type is derived from the base type: taxonomy.

The type proj:project:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

proj:sprint

A timeboxed period to complete a set amount of work. The proj:sprint type is derived from the base type: guid.

proj:ticket

A ticket in a ticketing system. The proj:ticket type is derived from the base type: guid.

ps:achievement

An instance of an individual receiving an award. The ps:achievement type is derived from the base type: guid.

ps:contact

A GUID for a contact info record. The ps:contact type is derived from the base type: guid.

ps:contact:type:taxonomy

A taxonomy of contact types. The ps:contact:type:taxonomy type is derived from the base type: taxonomy.

The type ps:contact:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ps:contactlist

A GUID for a list of associated contacts. The ps:contactlist type is derived from the base type: guid.

ps:education

A period of education for an individual. The ps:education type is derived from the base type: guid.

ps:name

An arbitrary, lower spaced string with normalized whitespace. The ps:name type is derived from the base type: str.

An example of ps:name:

robert grey

The type ps:name has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

ps:person

A GUID for a person. The ps:person type is derived from the base type: guid.

ps:person:has

A person owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ps:person:has type is derived from the base type: comp.

The type ps:person:has has the following options set:

fields: (('person', 'ps:person'), ('node', 'ndef'))

ps:persona

A GUID for a suspected person. The ps:persona type is derived from the base type: guid.

ps:persona:has

A persona owns, controls, or has exclusive use of an object or resource, potentially during a specific period of time. The ps:persona:has type is derived from the base type: comp.

The type ps:persona:has has the following options set:

fields: (('persona', 'ps:persona'), ('node', 'ndef'))

ps:proficiency

The assessment that a given contact possesses a specific skill. The ps:proficiency type is derived from the base type: guid.

ps:skill

A specific skill which a person or organization may have. The ps:skill type is derived from the base type: guid.

ps:skill:type:taxonomy

A taxonomy of skill types. The ps:skill:type:taxonomy type is derived from the base type: taxonomy.

The type ps:skill:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

ps:tokn

A single name element (potentially given or sur). The ps:tokn type is derived from the base type: str.

An example of ps:tokn:

robert

The type ps:tokn has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: True

ps:vitals

Statistics and demographic data about a person or contact. The ps:vitals type is derived from the base type: guid.

ps:workhist

A GUID representing entry in a contact’s work history. The ps:workhist type is derived from the base type: guid.

risk:alert

An instance of an alert which indicates the presence of a risk. The risk:alert type is derived from the base type: guid.

risk:alert:taxonomy

A taxonomy of alert types. The risk:alert:taxonomy type is derived from the base type: taxonomy.

The type risk:alert:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:alert:verdict:taxonomy

A taxonomy of verdicts for the origin and validity of the alert. The risk:alert:verdict:taxonomy type is derived from the base type: taxonomy.

The type risk:alert:verdict:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:attack

An instance of an actor attacking a target. The risk:attack type is derived from the base type: guid.

risk:attacktype

A taxonomy of attack types. The risk:attacktype type is derived from the base type: taxonomy.

The type risk:attacktype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:availability

A taxonomy of availability status values. The risk:availability type is derived from the base type: taxonomy.

The type risk:availability has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:compromise

An instance of a compromise and its aggregate impact. The risk:compromise type is derived from the base type: guid.

risk:compromisetype

A taxonomy of compromise types. The risk:compromisetype type is derived from the base type: taxonomy.

An example of risk:compromisetype:

cno.breach

The type risk:compromisetype has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:extortion

An event where an attacker attempted to extort a victim. The risk:extortion type is derived from the base type: guid.

risk:extortion:type:taxonomy

A taxonomy of extortion event types. The risk:extortion:type:taxonomy type is derived from the base type: taxonomy.

The type risk:extortion:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:hasvuln

Deprecated. Please use risk:vulnerable. The risk:hasvuln type is derived from the base type: guid.

risk:leak

An event where information was disclosed without permission. The risk:leak type is derived from the base type: guid.

risk:leak:type:taxonomy

A taxonomy of leak event types. The risk:leak:type:taxonomy type is derived from the base type: taxonomy.

The type risk:leak:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:mitigation

A mitigation for a specific risk:vuln. The risk:mitigation type is derived from the base type: guid.

risk:technique:masquerade

Represents the assessment that a node is designed to resemble another in order to mislead. The risk:technique:masquerade type is derived from the base type: guid.

risk:threat

A threat cluster or subgraph of threat activity, as reported by a specific organization. The risk:threat type is derived from the base type: guid.

risk:threat:type:taxonomy

A taxonomy of threat types. The risk:threat:type:taxonomy type is derived from the base type: taxonomy.

The type risk:threat:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:tool:software

A software tool used in threat activity, as reported by a specific organization. The risk:tool:software type is derived from the base type: guid.

risk:tool:software:taxonomy

A taxonomy of software / tool types. The risk:tool:software:taxonomy type is derived from the base type: taxonomy.

The type risk:tool:software:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:vuln

A unique vulnerability. The risk:vuln type is derived from the base type: guid.

risk:vuln:soft:range

A contiguous range of software versions which contain a vulnerability. The risk:vuln:soft:range type is derived from the base type: guid.

risk:vuln:type:taxonomy

A taxonomy of vulnerability types. The risk:vuln:type:taxonomy type is derived from the base type: taxonomy.

The type risk:vuln:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

risk:vulnerable

Indicates that a node is susceptible to a vulnerability. The risk:vulnerable type is derived from the base type: guid.

risk:vulnname

A vulnerability name such as log4j or rowhammer. The risk:vulnname type is derived from the base type: str.

The type risk:vulnname has the following options set:

globsuffix: False

lower: True

onespace: True

regex: None

replace: ()

strip: False

rsa:key

An RSA keypair modulus and public exponent. The rsa:key type is derived from the base type: comp.

The type rsa:key has the following options set:

fields: (('mod', 'hex'), ('pub:exp', 'int'))

sci:evidence

An assessment of how an observation supports or refutes a hypothesis. The sci:evidence type is derived from the base type: guid.

sci:experiment

An instance of running an experiment. The sci:experiment type is derived from the base type: guid.

sci:experiment:type:taxonomy

A taxonomy of experiment types. The sci:experiment:type:taxonomy type is derived from the base type: taxonomy.

The type sci:experiment:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

sci:hypothesis

A hypothesis or theory. The sci:hypothesis type is derived from the base type: guid.

sci:hypothesis:type:taxonomy

A taxonomy of hypothesis types. The sci:hypothesis:type:taxonomy type is derived from the base type: taxonomy.

The type sci:hypothesis:type:taxonomy has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: False

sci:observation

An observation which may have resulted from an experiment. The sci:observation type is derived from the base type: guid.

syn:cmd

A Synapse storm command. The syn:cmd type is derived from the base type: str.

The type syn:cmd has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

syn:cron

A Cortex cron job. The syn:cron type is derived from the base type: guid.

syn:form

A Synapse form used for representing nodes in the graph. The syn:form type is derived from the base type: str.

The type syn:form has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

syn:nodedata

A nodedata key and the form it may be present on. The syn:nodedata type is derived from the base type: comp.

The type syn:nodedata has the following options set:

fields: (('key', 'str'), ('form', 'syn:form'))

syn:prop

A Synapse property. The syn:prop type is derived from the base type: str.

The type syn:prop has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

syn:role

A Synapse role GUID. The syn:role type is derived from the base type: guid.

The type syn:role has the following options set:

strip: True

syn:tagprop

A user defined tag property. The syn:tagprop type is derived from the base type: str.

The type syn:tagprop has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

syn:trigger

A Cortex trigger. The syn:trigger type is derived from the base type: guid.

syn:type

A Synapse type used for normalizing nodes and properties. The syn:type type is derived from the base type: str.

The type syn:type has the following options set:

globsuffix: False

lower: False

onespace: False

regex: None

replace: ()

strip: True

syn:user

A Synapse user GUID. The syn:user type is derived from the base type: guid.

The type syn:user has the following options set:

strip: True

tel:call

A guid for a telephone call record. The tel:call type is derived from the base type: guid.

tel:mob:carrier

The fusion of a MCC/MNC. The tel:mob:carrier type is derived from the base type: comp.

The type tel:mob:carrier has the following options set:

fields: (('mcc', 'tel:mob:mcc'), ('mnc', 'tel:mob:mnc'))

tel:mob:cell

A mobile cell site which a phone may connect to. The tel:mob:cell type is derived from the base type: comp.

The type tel:mob:cell has the following options set:

fields: (('carrier', 'tel:mob:carrier'), ('lac', ('int', {})), ('cid', ('int', {})))

tel:mob:imid

Fused knowledge of an IMEI/IMSI used together. The tel:mob:imid type is derived from the base type: comp.

An example of tel:mob:imid:

(490154203237518, 310150123456789)

The type tel:mob:imid has the following options set:

fields: (('imei', 'tel:mob:imei'), ('imsi', 'tel:mob:imsi'))

tel:mob:imsiphone

Fused knowledge of an IMSI assigned phone number. The tel:mob:imsiphone type is derived from the base type: comp.

An example of tel:mob:imsiphone:

(310150123456789, "+7(495) 124-59-83")

The type tel:mob:imsiphone has the following options set:

fields: (('imsi', 'tel:mob:imsi'), ('phone', 'tel:phone'))

tel:mob:mcc

ITU Mobile Country Code. The tel:mob:mcc type is derived from the base type: str.

The type tel:mob:mcc has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[0-9]{3}$

replace: ()

strip: 1

tel:mob:mnc

ITU Mobile Network Code. The tel:mob:mnc type is derived from the base type: str.

The type tel:mob:mnc has the following options set:

globsuffix: False

lower: False

onespace: False

regex: ^[0-9]{2,3}$

replace: ()

strip: 1

tel:mob:tac

A mobile Type Allocation Code. The tel:mob:tac type is derived from the base type: int.

An example of tel:mob:tac:

49015420

The type tel:mob:tac has the following options set:

enums:strict: True

fmt: %d

ismax: False

ismin: False

max: None

min: None

signed: True

size: 8

tel:mob:telem

A single mobile telemetry measurement. The tel:mob:telem type is derived from the base type: guid.

tel:txtmesg

A guid for an individual text message. The tel:txtmesg type is derived from the base type: guid.

transport:air:craft

An individual aircraft. The transport:air:craft type is derived from the base type: guid.

transport:air:flight

An individual instance of a flight. The transport:air:flight type is derived from the base type: guid.

transport:air:flightnum

A commercial flight designator including airline and serial. The transport:air:flightnum type is derived from the base type: str.

An example of transport:air:flightnum:

ua2437

The type transport:air:flightnum has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z]{2}[0-9]{1,4}$

replace: ((' ', ''),)

strip: True

transport:air:occupant

An occupant of a specific flight. The transport:air:occupant type is derived from the base type: guid.

transport:air:port

An IATA assigned airport code. The transport:air:port type is derived from the base type: str.

The type transport:air:port has the following options set:

globsuffix: False

lower: True

onespace: False

regex: None

replace: ()

strip: False

transport:air:tailnum

An aircraft registration number or military aircraft serial number. The transport:air:tailnum type is derived from the base type: str.

An example of transport:air:tailnum:

ff023

The type transport:air:tailnum has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^[a-z0-9-]{2,}$

replace: ()

strip: True

transport:air:telem

A telemetry sample from an aircraft in transit. The transport:air:telem type is derived from the base type: guid.

transport:direction

A direction measured in degrees with 0.0 being true North. The transport:direction type is derived from the base type: hugenum.

The type transport:direction has the following options set:

modulo: 360

units: None

transport:land:license

A license to operate a land vehicle issued to a contact. The transport:land:license type is derived from the base type: guid.

transport:land:registration

Registration issued to a contact for a land vehicle. The transport:land:registration type is derived from the base type: guid.

transport:land:vehicle

An individual vehicle. The transport:land:vehicle type is derived from the base type: guid.

transport:sea:imo

An International Maritime Organization registration number. The transport:sea:imo type is derived from the base type: str.

The type transport:sea:imo has the following options set:

globsuffix: False

lower: True

onespace: False

regex: ^imo[0-9]{7}$

replace: ((' ', ''),)

strip: True

transport:sea:mmsi

A Maritime Mobile Service Identifier. The transport:sea:mmsi type is derived from the base type: str.

The type transport:sea:mmsi has the following options set:

globsuffix: False

lower: False

onespace: False

regex: [0-9]{9}

replace: ()

strip: False

transport:sea:telem

A telemetry sample from a vessel in transit. The transport:sea:telem type is derived from the base type: guid.

transport:sea:vessel

An individual sea vessel. The transport:sea:vessel type is derived from the base type: guid.

Synapse Data Model - Types

Base Types

array

bool

comp

cvss:v2

cvss:v3

data

duration

edge

file:base

file:bytes

file:path

float

geo:area

geo:dist

geo:latlong

guid

hex

hugenum

inet:addr

inet:cidr4

inet:cidr6

inet:dns:name

inet:email

inet:fqdn

inet:http:cookie

inet:ipv4

inet:ipv4range

inet:ipv6

inet:ipv6range

inet:rfc2822:addr

inet:url

int

it:sec:cpe

it:sec:cpe:v2_2

it:semver

ival

loc

ndef

nodeprop

range

str

syn:tag

syn:tag:part

taxon

taxonomy

tel:mob:imei

tel:mob:imsi

tel:phone

time

timeedge

velocity

Types

auth:access

auth:creds

belief:subscriber

belief:system

belief:system:type:taxonomy

belief:tenet

biz:bundle

biz:deal

biz:dealstatus

biz:dealtype

biz:listing

biz:prodtype

biz:product

biz:rfp

biz:service

biz:service:type:taxonomy

biz:stake

crypto:algorithm

crypto:currency:address

crypto:currency:block

crypto:currency:client

crypto:currency:coin

crypto:currency:transaction

crypto:key

crypto:payment:input

crypto:payment:output