Schemas

Pagination cursor

Geolocation resolved for a network indicator.

Autonomous system information for a network indicator.

Reverse DNS name, when resolvable.

Related malware family names, if attributed.

MITRE ATT&CK technique IDs, e.g. "T1071.001".

AI-generated analyst summary of the threat context.

Model-assessed risk score in [0.0, 1.0].

Internal IP reputation snapshot (JSON), exported as STIX x-reyhford-reputation.

A threat indicator (IOC) — the core entity of the platform.

Severity of the threat the indicator represents.

Minimum confidence score in [0, 100].

Half-open time interval [start, end).

Restrict to indicators observed over these protocols; empty means all.

Restrict to indicators observed by these sensor kinds; empty means all.

Pagination metadata returned with list responses.

Cursor to fetch the next page; empty when there are no more results.

Total number of items matching the query, if cheaply computable.

Maximum number of items to return. Server may cap this value.

Opaque cursor from a previous response; empty for the first page.

Free-text query matched against value, tags and enrichment summary.

Declarative filter; all set fields are ANDed together.

Cursor-based pagination request parameters.

Pagination metadata returned with list responses.

Source that observed the indicator.

Number of occurrences aggregated into this sighting.

UUID assigned by the platform.

Kind of observable the indicator describes.

Normalized observable value, e.g. "203.0.113.7" or a lowercase SHA-256.

Severity of the threat the indicator represents.

Confidence in [0, 100]; computed by domain rules, adjusted by enrichment.

Traffic Light Protocol 2.0 sharing marking.

Pipeline lifecycle state of an indicator: Raw → Scored → Enriched → Verified.

• INDICATOR_STATE_RAW: Sensor event received, nothing computed yet.
• INDICATOR_STATE_SCORED: pipeline-worker computed the confidence score.
• INDICATOR_STATE_ENRICHED: ai-enricher attached MITRE ATT&CK context.
• INDICATOR_STATE_VERIFIED: Confirmed by a human analyst.

After this instant the indicator is considered stale.

Enrichment data attached to an indicator by the enrichment pipeline.

Network protocol the observed activity used.

Kind of sensor that produced an event.

• SENSOR_TYPE_ICS: Industrial control system honeypot (Conpot etc.).
• SENSOR_TYPE_NETWORK: Generic network honeypot.
• SENSOR_TYPE_ENDPOINT: Endpoint / host-based sensor.

Stable source identifier, e.g. "edge-honeypot-eu-1" or "abusech-urlhaus".

Human-readable source name.

Reliability score of the source in [0.0, 1.0].

When this source first reported the indicator.