Search for intel
The intel field is an array of intel-objects, meaning there could be multiple records for a given event. When a query is applied to an event with multiple intel records, the values for each field are flattened into individual arrays before the query logic is applied to the values.
The following table lists the fields contain in intel-objects:
| Field | Type | Description | Example |
|---|---|---|---|
|
confidence |
String | The overall confidence rating of the intel source |
high |
|
feed |
String | The name of the intel source |
Sinkholes |
|
indicator |
String | The matched entity |
131.253.18.12 |
|
indicator_type |
String | The entity type |
ip_address |
|
is_malicious |
Boolean | Indicates whether the indicator is believed to be malicious |
false |
|
meta |
String | A JSON string of all metadata provided by the intel source |
{"description":"Observed C2 Activity","references":["Fortinet FortiGuard Labs"]} |
|
severity |
String | The overall severity rating of the intel source |
high |
|
timestamp |
Timestamp | The creation time of the intel record |
2019-01-01T00:00:00.000Z |