--- title: "Retrieve Indicators" method: GET path: "/v3/indicators" tags: ["Indicators"] --- # Retrieve Indicators `GET /v3/indicators` Returns a list of all Indicators ## Query parameters - `tql` string - `fields` string[] - `count` string - `sorting` string ## Response `200` The Indicators - Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityVictimAttributeData - `data` VictimAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - `id` integer - `name` string, required - `path` string, required - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - `id` integer - `type` string, required - `victimId` integer, required - `address` string - `addressType` string - `accountName` string - `socialNetwork` string - `networkType` string - `website` string - `phone` string - `webLink` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - … - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `groupId` integer, required - `group` Group — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `reviews` ListEntityIntelligenceReview - `data` IntelligenceReview[] - `id` integer - `rating` integer - `dateAdded` string, date-time - `lastModified` string, date-time - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `comments` string - `editable` boolean - `deletable` boolean - `reviewHelpful` boolean - `groupId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `handles` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `urls` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `customAiContent` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - `data` TaskAssignee[] - `id` integer - `type` string, required - `dateAdded` string, date-time - `user` User, required - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `legacyLink` string - `commonGroup` CommonGroup - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - … - `attributes` ListEntityAttributeData - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - … - `platforms` ListEntityString - … - `securityCoverage` AttackSecurityCoverage - … - `financialImpact` AttackFinancialImpact - … - `normalized` boolean - `synonymousTagNames` ListEntityString - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `subtype` string, required - `name` string, required - `summary` string - `description` string - `source` string - `sourceURLs` string[] - `external` boolean - `lastModified` string, date-time - `linkedGroups` ListEntityGroup — recursive - `references` ListEntityCommonGroupSource - `data` CommonGroupSource[] - `id` integer - `name` string, required - `summary` string, required - `lastModified` string, date-time - `dateAdded` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `cwes` ListEntityCommonGroupSource - `data` CommonGroupSource[] - `id` integer - `name` string, required - `summary` string, required - `lastModified` string, date-time - `dateAdded` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `customAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - `id` integer - `alias` string, required - `lastModified` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `mitreAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - `id` integer - `alias` string, required - `lastModified` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileActions` ListEntityFileAction - `data` FileAction[] - `relationship` string - `indicator` Indicator — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `indicatorId` integer, required - `indicator` Indicator — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `xid` string - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `workflowPhase` integer - `workflowStep` integer - `dueDate` string, date-time - `required` boolean - `dependentOnId` integer - `status` string - `completedBy` string - `completedDate` string, date-time - `duration` integer - `assignee` Assignee - `id` integer - `type` string, required - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `durationType` string - `owner` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `eventDate` string, date-time - `dateAdded` string, date-time - `summary` string, required - `deleted` boolean - `deletedReason` string - `systemGenerated` boolean - `link` string - `linkText` string - `user` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - `id` integer - `type` string, required - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `caseId` integer, required - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase — recursive - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `reviews` ListEntityIntelligenceReview - `data` IntelligenceReview[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `handles` ListEntityAdversaryAsset - `data` AdversaryAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `urls` ListEntityAdversaryAsset - `data` AdversaryAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - … - `customAiContent` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - … - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - `data` TaskAssignee[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - … truncated; see the full OpenAPI document linked below --- [API](https://skmtc.net/threatconnect/apis/threatconnect-api.md) · [All operations](https://skmtc.net/threatconnect/apis/threatconnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/threatconnect/threatconnect-api/revisions/730b8a350ae7/schema)