threat-intel threat-list¶

Threat Categories for malicious IPs

threat-list Specification¶

Parameter Value

Type Collection

Object Key(s) name

Collection Name threat-list-list

Collection URI /axapi/v3/threat-intel/threat-list

Element Name threat-list

Element URI /axapi/v3/threat-intel/threat-list/{name}

Element Attributes threat-list_attributes

Partition Visibility shared

Statistics Data URI /axapi/v3/threat-intel/threat-list/{name}/stats

Schema threat-list schema

Operations Allowed:

Operation	Method	URI	Payload
Create Object	POST	/axapi/v3/threat-intel/threat-list	threat-list attributes
POST /axapi/v3/threat-intel/threat-list/ Payload: { "threat-list": { "type": "webroot", "name": "a", "user-tag": "a" } }
Create List	POST	/axapi/v3/threat-intel/threat-list	threat-list attributes
Get Object	GET	/axapi/v3/threat-intel/threat-list/{name}	threat-list attributes
GET /axapi/v3/threat-intel/threat-list/a Reponse: { "threat-list": { "name": "a", "type": "webroot", "all-categories": 0, "uuid": "b0a33bfa-5116-11ee-b8e9-001fa0083030", "user-tag": "a", "a10-url": "/axapi/v3/threat-intel/threat-list/a" } }
Get List	GET	/axapi/v3/threat-intel/threat-list	threat-list-list
Modify Object	POST	/axapi/v3/threat-intel/threat-list/{name}	threat-list attributes
Replace Object	PUT	/axapi/v3/threat-intel/threat-list/{name}	threat-list attributes
PUT /axapi/v3/threat-intel/threat-list/a Payload: { "threat-list": { "type": "webroot", "name": "a", "user-tag": "abcd" } }
Replace List	PUT	/axapi/v3/threat-intel/threat-list	threat-list-list
Delete Object	DELETE	/axapi/v3/threat-intel/threat-list/{name}	threat-list attributes
DELETE /axapi/v3/threat-intel/threat-list/a Reponse: { "response": { "http-status": 200, "status": "OK", "msg": "Success" } }

threat-list-list¶

threat-list-list is JSON List of threat-list attributes

threat-list-list : [

{ threat-list attributes },

{ threat-list attributes },

…

]

threat-list attributes¶

all-categories

Description Enable all categories

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: all-categories,spam-sources, windows-exploits, web-attacks, botnets, scanners, dos-attacks, reputation, phishing, proxy, mobile-threats, and tor-proxy are mutually exclusive

botnets

Description Botnet C&C channels, and infected zombie machines controlled by Bot master

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: botnets and all-categories are mutually exclusive

dos-attacks

Description IP’s participating in DOS, DDOS, anomalous sync flood, and anomalous traffic detection

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: dos-attacks and all-categories are mutually exclusive

mobile-threats

Description IP’s associated with mobile threats

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: mobile-threats and all-categories are mutually exclusive

name

Description Threat category List name

Type: string

Maximum Length: 63 characters

Maximum Length: 1 characters

phishing

Description IP addresses hosting phishing sites, ad click fraud or gaming fraud

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: phishing and all-categories are mutually exclusive

proxy

Description IP addresses providing proxy services

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: proxy and all-categories are mutually exclusive

reputation

Description IP addresses currently known to be infected with malware

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: reputation and all-categories are mutually exclusive

sampling-enable

Type: List

scanners

Description IP’s associated with probes, host scan, domain scan, and password brute force attack

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: scanners and all-categories are mutually exclusive

spam-sources

Description IP’s tunneling spam messages through a proxy, anomalous SMTP activities, and forum spam activities

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: spam-sources and all-categories are mutually exclusive

tor-proxy

Description IP’s providing tor proxy services

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: tor-proxy and all-categories are mutually exclusive

type

Description ‘webroot’: Configure Webroot threat categories;

Type: string

Supported Values: webroot

user-tag

Description Customized tag

Type: string

Format: string-rlx

Maximum Length: 127 characters

Maximum Length: 1 characters

uuid

Description uuid of the object

Type: string

Maximum Length: 64 characters

Maximum Length: 1 characters

web-attacks

Description IP’s associated with cross site scripting, iFrame injection, SQL injection, cross domain injection, or domain password brute fo

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: web-attacks and all-categories are mutually exclusive

windows-exploits

Description IP’s associated with malware, shell code, rootkits, worms or viruses

Type: boolean

Supported Values: true, false, 1, 0

Default: 0

Mutual Exclusion: windows-exploits and all-categories are mutually exclusive

sampling-enable¶

Specification Value

Type list

Block object keys

counters1

Description ‘all’: all; ‘spam-sources’: Hits for spam sources; ‘windows-exploits’: Hits for windows exploits; ‘web-attacks’: Hits for web attacks; ‘botnets’: Hits for botnets; ‘scanners’: Hits for scanners; ‘dos-attacks’: Hits for dos attacks; ‘reputation’: Hits for reputation; ‘phishing’: Hits for phishing; ‘proxy’: Hits for proxy; ‘mobile-threats’: Hits for mobile threats; ‘tor-proxy’: Hits for tor-proxy; ‘total-hits’: Total hits for threat-list;

Type: string

Supported Values: all, spam-sources, windows-exploits, web-attacks, botnets, scanners, dos-attacks, reputation, phishing, proxy, mobile-threats, tor-proxy, total-hits