IOCSchema

The Indicator of Compromise Schema

This schema is used within an engine response to represent an indicator of compromise (IOC) found within an analyzed item. It contains the following properties:

• id: (type: str) - Specific identifier for this IOC.
• match_type: (type: str) - Must be one of the following values: ** "query": Match was based on an unspecified query. ** "equality": Match was based on a sest for equality with a specified value. ** "regex": Match was based on a regular-expression match with a specified pattern.
• values: (type: list) - A list of string values found that show that this item matches a specified indication.
• field: (type: str, optional) - Indicates which field that matched to cause the generation of this IOC.
• link: (type: str, optional) - A link to information describing more about this IOC.
• severity: (type: int) A value between 1 and 10, inclusive, that indicates the severity of this IOC. Higher values indicate more-severe IOCs.