Searching for Threat Indicators

• Console
• CLI
• API

• 1. Open the navigation menu and select Identity & Security. Under Threat Intelligence, select Threat Indicator Database.
  2. From the Search for list, select the type of threat indicator that you want to search for, and then enter the specific value.
     • Domain name: Enter the source domain name of the threat indicator.
     • File name: Enter the file name of the malicious program.
     • IP address: Enter the source IP address of the threat indicator.
     • Malware: Enter the name of the malware program associated with the threat indicator.
     • MD5 hash: Enter the MD5 hash generated from the request header of the threat indicator.
     • SHA1 hash: Enter the SHA1 hash generated from the request header of the threat indicator.
     • SHA256 hash: Enter the SHA256 hash generated from the request header of the threat indicator.
     • Threat actor: Enter the name of the entity associated with the threat indicator.
     • Threat type: Select the type of threat. See Threat Indicator Database Threat Types.
     • URL: Enter the source URL of the threat indicator.
  3. (Optional) Select a value for Date last reported.

     By default, the results include threats detected only in the last 30 days.

  4. (Optional) For Confidence score, select the minimum score of the threat indicator to search for.

     The confidence score is a value from 0 to 100 that represents how confident Threat Intelligence is that the indicator might be associated with malicious activity.

     By default, the results include only threat indicators with a score greater than 50.

  5. Select Search.
  6. (Optional) To limit the results to a specific indicator type, select a value in Type.
  7. To view more details about a threat indicator, select the indicator in the table of search results.

     The Indicator history area of the indicator details page shows the dates that this threat indicator was detected and who detected it (Oracle or another threat intelligence source).

  Tip
  
  To reset the search criteria, select Reset.

• Use the following commands to search for threat indicators:

  • oci threat-intelligence indicator-summaries list-indicators - Get a list of threat indicator summaries that matches the search parameters
  • oci threat-intelligence indicator get - Get details about a specific indicator
  • oci threat-intelligence threat-types-collection list-threat-types - Get a list of threat types that you can use as parameters when listing indicators

  Note
  
  All Threat Intelligence resources are scoped to the entire tenancy. Specify the ID of the tenancy (root compartment) for all CLI commands.

  For a complete list of flags and variable options for CLI commands, see the CLI Command Reference.

  List all indicators with a specific IP address

  List all indicators with a specific threat type and minimum confidence score

• Use the following operations to search for threat indicators:

  • ListIndicators - Get a list of all indicators that match the search parameters
  • GetIndicator - Get details about a specific indicator
  • ListThreatTypes - Get a list of threat types that you can use as parameters when listing indicators

  Note
  
  All Threat Intelligence resources are scoped to the entire tenancy. Specify the ID of the tenancy (root compartment) for all API operations.

  List all indicators with a specific IP address

  List all indicators with a specific threat type and minimum confidence score

  List all IP indicators with a specific threat type and minimum confidence score

  Get details about a specific indicator