Security Labels

Security Labels provide a means to designate information stored within ThreatConnect as sensitive. When sharing data with partners, or when copying data to and from Communities, Security Labels provide control over what is shared and allow the sharer to redact information based on Security Labels that are applicable to Indicators, Attributes, Groups, Tasks, Tracks, and Victims.

Endpoint: /api/v3/securityLabels

Available Fields

A list of valid fields for the v3/securityLabels endpoint, which is a read-only endpoint, can be retrieved using the following query:

OPTIONS /v3/securityLabels?show=readonly

Retrieve Security Labels

Retrieve All Security Labels

To retrieve all Security Labels, use the following query:

GET /v3/securityLabels/

JSON Response:

{
    "data": [{
        "id": 1,
        "name": "TLP:WHITE",
        "description": "This security label is used for information that carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.",
        "color": "FFFFFF",
        "owner": "System",
        "dateAdded": "2016-08-31T00:00:00Z"
    }, {
        "id": 2,
        "name": "TLP:GREEN",
        "description": "This security label is used for information that is useful for the awareness of all participating organizations as well as with peers within the broader community or sector.",
        "color": "33FF00",
        "owner": "System",
        "dateAdded": "2016-08-31T00:00:00Z"
    }, {
        "id": 3,
        "name": "TLP:AMBER",
        "description": "This security label is used for information that requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.",
        "color": "FFC000",
        "owner": "System",
        "dateAdded": "2016-08-31T00:00:00Z"
    }, {
        "id": 4,
        "name": "TLP:RED",
        "description": "This security label is used for information that cannot be effectively acted upon by additional parties, and could lead to impacts on a party"s privacy, reputation, or operations if misused.",
        "color": "FF0033",
        "owner": "System",
        "dateAdded": "2016-08-31T00:00:00Z"
    }],
    "status": "Success"
}

Retrieve a Single Security Label

To retrieve a specific Security Label, use a query in the following format:

GET /v3/securityLabel/{securityLabelId}

For example, the following query will return information about the Security Label with ID 2:

GET /v3/securityLabels/2

JSON Response:

{
    "data": {
        "id": 2,
        "name": "TLP:GREEN",
        "description": "This security label is used for information that is useful for the awareness of all participating organizations as well as with peers within the broader community or sector.",
        "color": "33FF00",
        "owner": "System",
        "dateAdded": "2016-08-31T00:00:00Z"
    },
    "status": "Success"
}

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.