Skip to main content

Threat Intelligence Data Model

The Threat Intelligence data model provides information about cyber threats to help mitigate potential attacks. It extends the Entity model data model.

The following table details the default attributes of the Threat Intelligence data model:

Attribute NameAttribute TypeRelationship TypeRequired
categoriesText (Multivalued)N/ANo
connectorCategoriesText (Multivalued)N/ANo
connectorNamesText (Multivalued)N/ANo
createdByTextN/ANo
cveIdsText (Multivalued)N/ANo
cveRecordsReference (CVE record)ENRICHESNo
cweIdsText (Multivalued)N/ANo
dataIntegrationTitlesText (Multivalued)N/ANo
dataModelNameCalculated (Text)N/ANo
dateCreatedDate TimeN/ANo
descriptionTextN/ANo
displayNameTextN/AYes
flowStateTextN/ANo
lastUpdatedDate TimeN/ANo
nameTextN/ANo
severitySingle ChoiceN/ANo
sourcesReference (Base model)SOURCED_FROMNo
sourcesIconsSource data models iconsN/ANo
sourceUidsText (Multivalued)N/ANo
summaryTextN/ANo
uidTextN/ANo
updatedByTextN/ANo
weaknessesReference (Weakness)ENRICHESNo
FOOTNOTES
  • The attribute names are used in Brinqa Query Language (BQL) queries and Brinqa Condition Language (BCL) predicates.
  • In the Type column, Calculated means that the value of the attribute is computed by executing a script. The text in the parentheses after Calculated denotes the type of the outcome.
  • In the Type column, Reference means that two data models are related. The name in the parentheses after Reference indicates the other data model.
  • The Relationship Type column only applies to the Reference type attributes. You can use the relationship type keyword in BQL queries.