ThreatIntelIndicator

The category of a threat intelligence indicator.

Type: String

Valid Values: BACKDOOR | CARD_STEALER | COMMAND_AND_CONTROL | DROP_SITE | EXPLOIT_SITE | KEYLOGGER

Required: No

Indicates when the most recent instance of a threat intelligence indicator was observed.

This field accepts only the specified formats. Timestamps can end with Z or ("+" / "-") time-hour [":" time-minute]. The time-secfrac after seconds is limited to a maximum of 9 digits. The offset is bounded by +/-18:00. Here are valid timestamp formats that you can send to Security Hub:

If a finding provider sends a finding to Security Hub that contains a timestamp in nanoseconds, we round it to milliseconds. For example, we round 2024-10-31T23:00:00.123456789Z to 2024-10-31T23:00:00.123Z.

Type: String

Pattern: .*\S.*

Required: No

The source of the threat intelligence indicator.

Length Constraints: Minimum of 1 length. Maximum of 64 length.

Type: String

Pattern: .*\S.*

Required: No

The URL to the page or site where you can get more information about the threat intelligence indicator.

Type: String

Pattern: .*\S.*

Required: No

The type of threat intelligence indicator.

Type: String

Valid Values: DOMAIN | EMAIL_ADDRESS | HASH_MD5 | HASH_SHA1 | HASH_SHA256 | HASH_SHA512 | IPV4_ADDRESS | IPV6_ADDRESS | MUTEX | PROCESS | URL

Required: No

The value of a threat intelligence indicator.

Length Constraints: Minimum of 1 length. Maximum of 512 length.

Type: String

Pattern: .*\S.*

Required: No