Artifact Types

Potential Artifact types include all ThreatConnect Indicator types, as well as a large variety of other data types, which are determined by ThreatConnect and your System Administrator.

Endpoint: /api/v3/artifactTypes

Available Fields

A list of fields for the v3/artifactTypes endpoint, which is a read-only endpoint, can be retrieved using the following query:

OPTIONS /v3/artifactTypes?show=readonly

Retrieve Artifact Types

Retrieve All Artifact Types

To retrieve all Artifact types, use the following query:

GET /v3/artifactTypes

JSON Response:

{
    "data": [
        {
            "id": 1,
            "name": "Email Address",
            "description": "A name that identifies an electronic post office box on a network where Electronic-Mail (e-mail) can be sent.",
            "dataType": "String",
            "intelType": "indicator-EmailAddress",
            "derivedLink": true
        },
        {
            "id": 2,
            "name": "Host",
            "description": "A hostname. A host is any hardware device that has the capability of permitting access to a network via a user interface, specialized software, network address, protocol stack, or any other means.",
            "dataType": "String",
            "intelType": "indicator-Host",
            "derivedLink": true
        },
        {...}
    ],
    "status": "Success"
}

Retrieve a Single Artifact Type

To retrieve a specific Artifact type, use a query in the following format:

GET /v3/artifactTypes/{artifactTypeId}

For example, the following query will return information about the Artifact type with ID 3:

GET /v3/artifactTypes/3

JSON Response:

{
    "data": {
        "id": 3,
        "name": "URL",
        "description": "A uniform resource locator, or URL, is a short string containing an address which refers to an object in the web. URLs are a subset of URIs.",
        "dataType": "String",
        "intelType": "indicator-URL",
        "derivedLink": true
    },
    "status": "Success"
}

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.