.. _threat_intel_threat_list:

threat-intel threat-list
========================

Threat Categories for malicious IPs


threat-list Specification
-------------------------

	===================================== ========================================================================
	 **Parameter**                         **Value** 

	===================================== ========================================================================
	 **Type**                              *Collection*

	 **Object Key(s)**                     *name*

	 **Collection Name**                   :ref:`3499_threat-list_list`

	 **Collection URI**                    /axapi/v3/threat-intel/threat-list

	                                       

	 **Element Name**                      threat-list

	 **Element URI**                       /axapi/v3/threat-intel/threat-list/{name}

	 **Element Attributes**                threat-list_attributes

	 **Partition Visibility**              shared

	 **Statistics Data URI**               /axapi/v3/threat-intel/threat-list/{name}/stats

	 **Schema**                             :download:`threat-list schema <threat-intel-threat-list/threat-intel-threat-list.txt>`
	===================================== ========================================================================





	**Operations Allowed:**




.. raw:: html

   <script type="text/javascript">
 function showExample(a,b) { document.getElementById(a+'_div').style.display = 'block'; document.getElementById(a+'_cl').style.display = 'block'; document.getElementById(a+'_eg').style.display = 'none';}
   function closeExample(a,b) { document.getElementById(a+'_div').style.display = 'none'; document.getElementById(a+'_cl').style.display = 'none'; document.getElementById(a+'_eg').style.display = 'block';}
 </script>
   <table width='90%' style='margin-left:5%'>



.. raw:: html

   <tr style='border-bottom: thin solid; border-top: thin solid'><th width=15%>Operation</th><th width=10%>Method</th><th>URI</th><th width=15%>Payload</th><th width=10%></th></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Create Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td><button id='post_eg' onClick="showExample('post')">example</button> <button id='post_cl' onClick="closeExample('post')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='post_div' style='display:none'>


.. include:: ../artifacts/threat_intel_threat_list_POST.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Create List



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Get Object



.. raw:: html

   </td><td valign = 'top'>


GET



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td><button id='get_eg' onClick="showExample('get')">example</button> <button id='get_cl' onClick="closeExample('get')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='get_div' style='display:none'>


.. include:: ../artifacts/threat_intel_threat_list_GET.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Get List



.. raw:: html

   </td><td valign = 'top'>


GET



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_list`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Modify Object



.. raw:: html

   </td><td valign = 'top'>


POST



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Replace Object



.. raw:: html

   </td><td valign = 'top'>


PUT



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td><button id='put_eg' onClick="showExample('put')">example</button> <button id='put_cl' onClick="closeExample('put')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='put_div' style='display:none'>


.. include:: ../artifacts/threat_intel_threat_list_PUT.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Replace List



.. raw:: html

   </td><td valign = 'top'>


PUT



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_list`



.. raw:: html

   </td><td></td></tr>




.. raw:: html

   <tr  style='border-bottom: thin solid;'><td valign = 'top'>


Delete Object



.. raw:: html

   </td><td valign = 'top'>


DELETE



.. raw:: html

   </td><td valign = 'top'>


/axapi/v3/threat-intel/threat-list/{name}



.. raw:: html

   </td><td valign = 'top'>


:ref:`3499_threat-list_attributes`



.. raw:: html

   </td><td><button id='delete_eg' onClick="showExample('delete')">example</button> <button id='delete_cl' onClick="closeExample('delete')" style='display:none'>close</button></td></tr>




.. raw:: html

   <tr><td colspan=5 style='padding: 0         % 0    %;' valign = 'top'><div id='delete_div' style='display:none'>


.. include:: ../artifacts/threat_intel_threat_list_DELETE.txt
   :literal:




.. raw:: html

   </div></td></tr>


.. raw:: html

   </table>

.. _3499_threat-list_list:

threat-list-list
----------------


    threat-list-list is **JSON List** of :ref:`3499_threat-list_attributes` 

        threat-list-list : [

             { :ref:`3499_threat-list_attributes` },

             { :ref:`3499_threat-list_attributes` },

             ...

         ]

.. _3499_threat-list_attributes:

threat-list attributes
----------------------

    **all-categories**

        **Description** Enable all categories

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** all-categories,spam-sources, windows-exploits, web-attacks, botnets, scanners, dos-attacks, reputation, phishing, proxy,  mobile-threats, and tor-proxy are mutually exclusive

    **botnets**

        **Description** Botnet C&C channels, and infected zombie machines controlled by Bot master

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** botnets and all-categories are mutually exclusive

    **dos-attacks**

        **Description** IP's participating in DOS, DDOS, anomalous sync flood, and anomalous traffic detection

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** dos-attacks and all-categories are mutually exclusive

    **mobile-threats**

        **Description** IP's associated with mobile threats

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** mobile-threats and all-categories are mutually exclusive

    **name**

        **Description** Threat category List name

        **Type:** string

        **Maximum Length:** 63 characters

        **Maximum Length:** 1 characters

    **phishing**

        **Description** IP addresses hosting phishing sites, ad click fraud or gaming fraud

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** phishing and all-categories are mutually exclusive

    **proxy**

        **Description** IP addresses providing proxy services

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** proxy and all-categories are mutually exclusive

    **reputation**

        **Description** IP addresses currently known to be infected with malware

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** reputation and all-categories are mutually exclusive

    **sampling-enable**

        **Type:** List

    **scanners**

        **Description** IP's associated with probes, host scan, domain scan, and password brute force attack

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** scanners and all-categories are mutually exclusive

    **spam-sources**

        **Description** IP's tunneling spam messages through a proxy, anomalous SMTP activities, and forum spam activities

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** spam-sources and all-categories are mutually exclusive

    **tor-proxy**

        **Description** IP's providing tor proxy services

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** tor-proxy and all-categories are mutually exclusive

    **type**

        **Description** 'webroot': Configure Webroot threat categories; 

        **Type:** string

        **Supported Values:** webroot

    **user-tag**

        **Description** Customized tag

        **Type:** string

        **Format:** string-rlx

        **Maximum Length:** 127 characters

        **Maximum Length:** 1 characters

    **uuid**

        **Description** uuid of the object

        **Type:** string

        **Maximum Length:** 64 characters

        **Maximum Length:** 1 characters

    **web-attacks**

        **Description** IP's associated with cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute fo

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** web-attacks and all-categories are mutually exclusive

    **windows-exploits**

        **Description** IP's associated with malware, shell code, rootkits, worms or viruses

        **Type:** boolean

        **Supported Values:** true, false, 1, 0

        **Default:** 0

        **Mutual Exclusion:** windows-exploits and all-categories are mutually exclusive

.. _3499_sampling-enable:

sampling-enable
^^^^^^^^^^^^^^^
	=============================== ===================================================
	**Specification**                 **Value**
	=============================== ===================================================
	 **Type**                        *list*

	 **Block object keys**             

	=============================== ===================================================

    **counters1**

        **Description** 'all': all; 'spam-sources': Hits for spam sources; 'windows-exploits': Hits for windows exploits; 'web-attacks': Hits for web attacks; 'botnets': Hits for botnets; 'scanners': Hits for scanners; 'dos-attacks': Hits for dos attacks; 'reputation': Hits for reputation; 'phishing': Hits for phishing; 'proxy': Hits for proxy; 'mobile-threats': Hits for mobile threats; 'tor-proxy': Hits for tor-proxy; 'total-hits': Total hits for threat-list; 

        **Type:** string

        **Supported Values:** all, spam-sources, windows-exploits, web-attacks, botnets, scanners, dos-attacks, reputation, phishing, proxy, mobile-threats, tor-proxy, total-hits