Artifact Types

Artifact types include all ThreatConnect Indicator types and several other data types determined by ThreatConnect and your System Administrator.

Endpoint: /api/v3/artifactTypes

Endpoint Options

Available Fields

Send the following request to retrieve a complete list of fields that may be included in responses returned from the /v3/artifactTypes endpoint, which is a read-only endpoint:

OPTIONS /v3/artifactTypes?show=readonly

Filter Results

When retrieving data, you can use the tql query parameter to filter results with ThreatConnect Query Language (TQL).

Send the following request to retrieve a list of valid TQL parameters you can use when including the tql query parameter in a request to the /v3/artifactTypes endpoint:

OPTIONS /v3/artifactTypes/tql

Retrieve Artifact Types

Retrieve All Artifact Types

Send the following request to retrieve data for all Artifact types:

GET /v3/artifactTypes

JSON Response:

{
    "data": [
        {
            "id": 1,
            "name": "Email Address",
            "description": "A name that identifies an electronic post office box on a network where Electronic-Mail (e-mail) can be sent.",
            "dataType": "String",
            "intelType": "indicator-EmailAddress",
            "derivedLink": true
        },
        {
            "id": 2,
            "name": "Host",
            "description": "A hostname. A host is any hardware device that has the capability of permitting access to a network via a user interface, specialized software, network address, protocol stack, or any other means.",
            "dataType": "String",
            "intelType": "indicator-Host",
            "derivedLink": true
        },
        {...}
    ],
    "status": "Success"
}

Retrieve a Specific Artifact Type

Send a request in the following format to retrieve data for a specific Artifact type:

GET /v3/artifactTypes/{artifactTypeId}

For example, the following request will retrieve data for the Artifact type whose ID is 3:

GET /v3/artifactTypes/3

JSON Response:

{
    "data": {
        "id": 3,
        "name": "URL",
        "description": "A uniform resource locator, or URL, is a short string containing an address which refers to an object in the web. URLs are a subset of URIs.",
        "dataType": "String",
        "intelType": "indicator-URL",
        "derivedLink": true
    },
    "status": "Success"
}