Attribute Types

Attributes are key/value data sets that can be added to Groups, Indicators, Victims, and Workflow Cases. When adding an Attribute to an object, users must select the type of Attribute they want to create.

Endpoint: /api/v3/attributeTypes

Endpoint Options

Available Fields

Send the following request to retrieve a complete list of fields that may be included in responses returned from the /v3/attributeTypes endpoint, which is a read-only endpoint:

OPTIONS /v3/attributeTypes?show=readonly

Include Additional Fields in Responses

When creating, retrieving, or updating data, you can use the fields query parameter to include additional fields in the API response that are not included by default.

Send the following request to retrieve a list of fields you can include in responses returned from the /v3/attributeTypes endpoint:

OPTIONS /v3/attributeTypes/fields

Filter Results

When retrieving data, you can use the tql query parameter to filter results with ThreatConnect Query Language (TQL).

Send the following request to retrieve a list of valid TQL parameters you can use when including the tql query parameter in a request to the /v3/attributeTypes endpoint:

OPTIONS /v3/attributeTypes/tql

Retrieve Attribute Types

Retrieve All Attribute Types

Send the following request to retrieve data for all Attribute Types:

GET /v3/attributeTypes

JSON Response:

{
    "next": "https://app.threatconnect.com/api/v3/attributeTypes?resultStart=100&resultLimit=100",
    "data": [
        {
            "id": 1,
            "name": "Course of Action Taken",
            "description": "Describe the Course of Action Taken.",
            "maxSize": 500,
            "allowMarkdown": true,
            "errorMessage": "Please enter a valid Course of Action."
        },
        {
            "id": 2,
            "name": "Infrastructure Ownership",
            "description": "Select ownership details of the Infrastructure (IP Address, Domain Name, URL, etc) used in an Adversary operation.",
            "maxSize": 19,
            "allowMarkdown": false,
            "errorMessage": "Please enter valid infrastructure ownership details: Adversary Owned, Adversary Leased, Adversary Subverted",
            "validationRule": {
                "id": 12,
                "name": "Adversary Ownership",
                "text": "Adversary Owned;Adversary Leased;Adversary Subverted;Unknown;",
                "type": "SelectOne",
                "description": "Infrastructure Ownership Types",
                "version": "1"
            }
        },
        {...}
    ],
    "count": 214,
    "status": "Success"
}

Retrieve a Specific Attribute Type

Send a request in the following format to retrieve data for a specific Attribute Type:

GET /v3/attributeTypes/{attributeTypeId}

For example, the following request will retrieve data for the Attribute Type whose ID is 3:

GET /v3/attributeTypes/3

JSON Response:

{
    "data": {
        "id": 3,
        "name": "TTP Description: Malware/Tool Information",
        "description": "Malware and hackertools usage characteristics: backdoor, self-propagating, rootkit, pass-the-hash, keylogger, Other.",
        "maxSize": 500,
        "allowMarkdown": true,
        "errorMessage": "Please enter a valid TTP Description: Malware/Tool Information."
    },
    "status": "Success"
}