Victim Assets¶

Victim Assets are endpoints used to leverage a Victim and infiltrate a network.

Endpoint: /api/v3/victimAssets

Available Fields¶

You can retrieve a list of available fields for the /v3/victimAssets endpoint, including the field’s name, description, and accepted data type, by using the following query:

OPTIONS /v3/victimAssets

Hint

To view all fields, including read-only fields, include the ?show=readonly query parameter.

Alternatively, refer to the following tables for a list of available fields that can be included in the body of a POST or PUT request for the victimAssets object.

Field	Description	Type	Required for Creation?	Updatable?	Example Value(s)
accountName	The account name associated with a Network Account or Social Network Victim Asset	String	TRUE*	TRUE	“@johnsmith”
address	The email address associated with a Email Address Victim Asset	String	TRUE*	TRUE	“jsmith@companyabc.com”
addressType	The type of Email Address Victim Asset	String	FALSE	TRUE	“Corporate email”
associatedGroups	A list of Groups associated to the Victim Asset	Group Object	FALSE	TRUE	{“data”: [{“id”: 12345}]} {“data”: [{“name”: “Bad Adversary”, “type”: “Adversary”}]}
networkType	The type of Network Account Victim Asset	String	FALSE	TRUE	“Company network”
phone	The phone number associated with a Phone Victim Asset	String	TRUE*	TRUE	“0123456789”
socialNetwork	The type of Social Account Victim Asset	String	FALSE	TRUE	“Twitter”
type	The type of Victim Asset being created	String	TRUE	FALSE	“Demo Community”
securityLabels	A list of Security Labels applied to the Victim	String	FALSE	TRUE	“EmailAddress”, “NetworkAccount”, “Phone”, “SocialNetwork”, or “WebSite”
victimId	The ID of the Victim to which the Victim Asset should be added	Integer	TRUE	FALSE	1, 2, 3
website	The website address associated with a Website Victim Asset	String	TRUE*	TRUE	“`http://examplesite.com`”

Available values for the type field include:

EmailAddress
NetworkAccount
Phone
SocialNetwork
WebSite

Note

*This field is required if creating a Victim Asset that matches the type listed in the Description column.

Hint

To associate an existing Group to a Victim Asset, use the Group’s ID when setting the associatedGroups field (e.g., {"data": [{"id": 12345}]}).

Create Victim Assets¶

The basic format for creating a Victim Asset is:

POST /v3/victimAssets
{
    "type": "Victim Asset type goes here",
    "victimId": 12345
    //additional fields for the selected Victim Asset type
}

For example, the following query will create a Phone Victim Asset and add it to the Victim with ID 2:

POST /v3/victimAssets
{
    "phone": "0123456789",
    "type": "Phone",
    "victimId": 2
}

JSON Response

{
    "data": {
        "id": 4,
        "type": "Phone",
        "victimId": 2,
        "phone": "0123456789"
    },
    "message": "Created",
    "status": "Success"
}

Refer to the Available Fields section for a list of available fields that can be included in the body of a POST request for the victimAssets object.

Retrieve Victim Assets¶

Retrieve All Victim Assets¶

To retrieve all Victim Assets, use the following query:

GET /v3/victimAssets

JSON Response

{
    "data": [
        {
            "id": 4,
            "type": "Phone",
            "victimId": 2,
            "phone": "0123456789"
        },
        {
            "id": 3,
            "type": "WebSite",
            "victimId": 2,
            "website": "somewebsite.com"
        },
        {
            "id": 2,
            "type": "EmailAddress",
            "victimId": 2,
            "address": "[email protected]",
            "addressType": "Corporate email"
        },
        {
            "id": 1,
            "type": "EmailAddress",
            "victimId": 1,
            "address": "[email protected]"
        }
    ],
    "status": "Success"
}

Retrieve a Single Victim Asset¶

To retrieve a specific Victim, use a query in the following format:

GET /v3/victimAssets/{victimAssetId}

For example, the following query will return information about the Victim Asset with ID 3:

GET /v3/victimAssets/3

JSON Response

{
    "data": {
        "id": 3,
        "type": "WebSite",
        "victimId": 2,
        "website": "somewebsite.com"
    },
    "status": "Success"
}

Request Additional Fields¶

To request additional fields not automatically included with each returned object, refer to Include Additional Fields for Returned Objects.

Filter Results¶

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.

Update Victim Assets¶

The basic format for updating a Victim Asset is:

PUT /v3/victimAssets/{victimAssetId}
{
    {updatedField}: {updatedValue}
}

For example, the following query will complete the following actions for a Victim Asset with ID 3:

Create an Incident Group with a summary of Bad Incident and associate it to the Victim Asset;
Update the website associated with the Victim Asset.

PUT /v3/victimAssets/3
{
    "associatedGroups": {"data": [{"name": "Bad Incident", "type": "Incident"}]},
    "website": "hackerwebsite.com"
}

JSON Response

{
    "data": {
        "id": 3,
        "type": "WebSite",
        "victimId": 2,
        "website": "hackerwebsite.com"
    },
    "message": "Updated",
    "status": "Success"
}

Refer to the Available Fields section for a list of available fields that can be included in the body of a PUT request for the victimAssets object.

Hint

When updating a Victim Asset, you can use the mode field to add or remove the following metadata:

associatedGroups

See Update an Object’s Metadata for instructions on using the mode field.

Delete Victim Assets¶

The basic format for deleting a Victim Asset is:

DELETE /v3/victimAssets/{victimAssetId}

For example, the following query will delete the Victim Asset with ID 1:

DELETE /v3/victimAssets/1

JSON Response

{
    "message": "Deleted",
    "status": "Success"
}