Intelligence Requirement Subtypes

When creating an Intelligence Requirement (IR) in ThreatConnect, you must select a subtype for the IR. This allows you to better track the various types of IRs you have in your Organization.

Endpoint: /api/v3/intelRequirements/subtypes

Endpoint Options

Available Fields

Send the following request to retrieve a complete list of fields that may be included in responses returned from the /v3/intelRequirements/subtypes endpoint, which is a read-only endpoint:

OPTIONS /v3/intelRequirements/subtypes?show=readonly

Filter Results

When retrieving data, you can use the tql query parameter to filter results with ThreatConnect Query Language (TQL).

Send the following request to retrieve a list of valid TQL parameters you can use when including the tql query parameter in a request to the /v3/intelRequirements/subtypes endpoint:

OPTIONS /v3/intelRequirements/subtypes/tql

Schemas

Response Body

The default response returned from successful GET requests to the /v3/intelRequirements/subtypes endpoint includes one or more objects with the following fields:

• id: <Integer> The IR subtype’s ID number.

• name: <String> The IR subtype’s name.

• description: <String> The IR subtype’s description.

Example

{
    "id": <int>,
    "name": "<string>",
    "description": "<string>"
}

Retrieve Intelligence Requirement Subtypes

Retrieve All Intelligence Requirement Subtypes

Send the following request to retrieve data for all IR subtypes.

Request

GET /v3/intelRequirements/subtypes

Response

{
    "data": [
        {
            "id": 1,
            "name": "Intelligence Requirement (IR)",
            "description": "Threats of overall concern to an organization (e.g., cyber threats, fraud, geopolitical/physical threats)"
        },
        {
            "id": 2,
            "name": "Priority Intelligence Requirement (PIR)",
            "description": "Threat actor motives; tactics, techniques, and procedures (TTPs); targets; impacts; or attributions in association with IRs"
        },
        {
            "id": 3,
            "name": "Specific Intelligence Requirement (SIR)",
            "description": "Facts associated with threat activity, such as indicators of compromise (IOCs)"
        },
        {
            "id": 4,
            "name": "Request for Information (RFI)",
            "description": "One-off requests for information related to topics of interest to particular stakeholders"
        },
        {
            "id": 5,
            "name": "Research Requirement (RR)",
            "description": "A topic or area of investigation that is of interest to an individual or group and does not merit a full intelligence requirement, but does require tracking of relevant information"
        }
    ],
    "count": 5,
    "status": "Success"
}

Retrieve a Specific Intelligence Requirement Subtype

Send a request in the following format to retrieve data for a specific IR subtype.

Example Request

GET /v3/intelRequirements/subtypes/{subtypeId}

For example, the following request will retrieve data for the IR subtype whose ID is 2.

Request

GET /v3/intelRequirements/subtypes/2

Response

{
    "data": {
        "id": 2,
        "name": "Priority Intelligence Requirement (PIR)",
        "description": "Threat actor motives; tactics, techniques, and procedures (TTPs); targets; impacts; or attributions in association with IRs"
    },
    "status": "Success"
}