id

Actor's ID. For example, 1.

name

Actor's name. For example, "PLATINUM".

actor_group

Group the actor belongs to. Available values:

apt—Actor is related to an APT attack.

crime—Actor is mentioned in a Crimeware Threat Intelligence report.

aliases

Aliases for the actor (array of unique strings). Aliases are used as alternative actor identifiers. For example, ["PT", "PLAT"].

description

Actor's description, which contains several sections. The heading of each section begins with a sequence of characters "####".

publications

APT reports related to the actor that are available according to your license. For each APT report, the following data is available:

tip_id—APT report's ID in Kaspersky Threat Intelligence Portal. For example, "1501-apt".

name—APT report's name. For example, "Sofacy targeting embassies with Gamefish".

geo

Array that contains a list of countries in which an actor's activity was detected. For each country, the following data is available:

country—Two-letter country code. For example, "ru".

reports—Number of APT reports about the actor's attacks in this country. For example, 3.

last_updated

Date and time when the actor profile was last updated (in the Coordinated Universal Time (UTC) format). For example, "2018-11-28 15:20". If the actor profile has not been updated, this field is not included in the return data.

descriptive_ttps

Array of the actor’s tactics, techniques, and procedures (TTPs), including kaspersky_ttps. For each TTPs, the following data is available:

type—Type of the TTPs. Available values:

Infrastructure—TTPs related to the infrastructure that the actor uses.

Implants—TTPs related to the malware and/or tools used by the actor.

Intrusion Vector—TTPs related to the intrusion vector used by the actor (the way the actor delivers the implants). For example: "Spear-phishing".

Victimology—TTPs related to the victims identified during the investigation (sectors, individuals, countries).

name—Name of the TTPs. For example, "Use of Dropbox in hosting infrastructure.".

mitre_mapping—TTPs mapping with the Cyber Kill Chain stage.

id—The Cyber Kill Chain stage's ID. For example, "PRE-T1084".

stage—The Cyber Kill Chain stage. For example, "Recon".

mitre_source—MITRE stage that the Cyber Kill Chain stage belongs to. Available values:

• mitre-attack—TTPs belongs to the MITRE ATT&CK matrix.
• mitre-pre-attack—TTPs belongs to the MITRE PRE-ATT&CK matrix.

  name—The Cyber Kill Chain stage's name. For example, "Acquire and/or use 3rd party infrastructure services (undefined)".

  url—Web address of the detailed description of the Cyber Kill Chain stage.

mitre_ttps

Array that contains TTPs descriptions, including mitre_ttps. For each TTPs, the following data is available:

id—The Cyber Kill Chain stage's ID. For example, "PRE-T1084".

stage—The Cyber Kill Chain stage. For example, "Recon".

mitre_source—MITRE stage that the Cyber Kill Chain stage belongs to. Available values:

mitre-attack—TTPs belongs to the MITRE ATT&CK matrix.

mitre-pre-attack—TTPs belongs to the MITRE PRE-ATT&CK matrix.

name—The Cyber Kill Chain stage's name. For example, "Acquire and/or use 3rd party infrastructure services (undefined)".

url—Web address of the detailed description of the Cyber Kill Chain stage.