Threat Intelligence Data Model

The Threat Intelligence data model provides information about cyber threats to help mitigate potential attacks. It extends the Entity Model data model.

The following table details the default attributes of the Threat Intelligence data model:

Order	Attribute Name	Attribute Type	Relationship Type	Required
1	cveIds	Text (Multivalued)	N/A	No
2	cveRecords	Reference (CVE record)	RELATES_TO	No
3	severity	Single Choice	N/A	No
4	uid	Text	N/A	Yes
5	dataModelName	Calculated (Text)	N/A	No
6	sourceUids	Text (Multivalued)	N/A	No
7	connectorCategories	Text (Multivalued)	N/A	No
8	connectorNames	Text (Multivalued)	N/A	No
9	dataIntegrationTitles	Text (Multivalued)	N/A	No
10	sourcesIcons	Source data models icons	N/A	No
11	name	Text	N/A	No
12	displayName	Text	N/A	Yes
13	summary	Text	N/A	No
14	description	Text	N/A	No
15	categories	Text (Multivalued)	N/A	No
16	flowState	Text	N/A	No
17	sources	Reference (Base model)	SOURCED_FROM	No
18	dateCreated	Date Time	N/A	No
19	lastUpdated	Date Time	N/A	No
20	createdBy	Text	N/A	No
21	updatedBy	Text	N/A	No

FOOTNOTES

• The Order column specifies the order of attributes being calculated in data computation.
• The attribute names are used in Brinqa Query Language (BQL) queries and Brinqa Condition Language (BCL) predicates.
• In the Type column, Calculated means that the value of the attribute is computed by executing a script. The text in the parentheses after Calculated denotes the type of the outcome.
• In the Type column, Reference means that two data models are related. The name in the parentheses after Reference indicates the other data model.
• The Relationship Type column only applies to the Reference type attributes. You can use the relationship type keyword in BQL queries.