Graph API Version

ThreatExchange API Reference

The comprehensive list of the ThreatExchange APIs and the related end points.

Objects

Parameter	Description
Malware	A sample of the malware.
MalwareFamily	A group, cluster or similar type grouping of Malware.
ThreatDescriptor	The subjective context provided by a ThreatExchangeMember for a ThreatIndicator
ThreatExchangeMember	A participant within ThreatExchange.
ThreatIndicator	An indicator of compromise.
ThreatTags	A label to group threat objects together.

Types

Parameter	Description
IndicatorType	The kind of indicator being described by a ThreatIndicator object.
MalwareAnalysisType	A description of the type of malware, see MalwareAnalysisType.
MalwareFamilyType	A description of the type of logic or automation used to create a MalwareFamily object.
PrecisionType	Defines how accurately the threat intelligence detects its intended target, victim or actor.
PrivacyType	Defines who can access the threat intelligence.
ReviewStatusType	A description of how the threat intelligence was vetted.
SeverityType	A description of the dangerousness of the threat associated with a ThreatIndicator object. The order of the values below are ordered from least severe to most severe.
SignatureType	The kind or format of signature described by a ThreatIndicator object.
ShareLevelType (aka Traffic Light Protocol or TLP)	A designation of how any object in ThreatExchange may be re-shared both within and outside of ThreatExchange, based on the US-CERT's Traffic Light Protocol.
StatusType	A description of the maliciousness of any object within ThreatExchange.

Search Endpoints

Parameter	Description
/malware_analyses	Search for malware samples by hash and other metadata
/malware_families	Search for malware families by name and other metadata
/threat_descriptors	Enables searching for indicators of compromise descriptors
/threat_indicators	Enables searching for indicators of compromise
/threat_tags	Enables searching for threat tags

Miscellaneous Endpoints

Parameter	Description
/threat_exchange_members	Returns a list of current members of the ThreatExchange