Skip to main content

Threat Intelligence Data Model

The Threat Intelligence data model provides information about cyber threats to help mitigate potential attacks. It extends the Entity Model data model.

The following table details the default attributes of the Threat Intelligence data model:

OrderAttribute NameAttribute TypeRelationship TypeRequired
1cveIdsText (Multivalued)N/ANo
2cveRecordsReference (CVE record)RELATES_TONo
3severitySingle ChoiceN/ANo
4uidTextN/AYes
5dataModelNameCalculated (Text)N/ANo
6sourceUidsText (Multivalued)N/ANo
7connectorCategoriesText (Multivalued)N/ANo
8connectorNamesText (Multivalued)N/ANo
9dataIntegrationTitlesText (Multivalued)N/ANo
10sourcesIconsSource data models iconsN/ANo
11nameTextN/ANo
12displayNameTextN/AYes
13summaryTextN/ANo
14descriptionTextN/ANo
15categoriesText (Multivalued)N/ANo
16flowStateTextN/ANo
17sourcesReference (Base model)SOURCED_FROMNo
18dateCreatedDate TimeN/ANo
19lastUpdatedDate TimeN/ANo
20createdByTextN/ANo
21updatedByTextN/ANo
FOOTNOTES
  • The Order column specifies the order of attributes being calculated in data computation.
  • The attribute names are used in Brinqa Query Language (BQL) queries and Brinqa Condition Language (BCL) predicates.
  • In the Type column, Calculated means that the value of the attribute is computed by executing a script. The text in the parentheses after Calculated denotes the type of the outcome.
  • In the Type column, Reference means that two data models are related. The name in the parentheses after Reference indicates the other data model.
  • The Relationship Type column only applies to the Reference type attributes. You can use the relationship type keyword in BQL queries.