AdvancedThreatConfig Schema
Data structure for Advanced Threat Config objects.
Fields
| Field | Type | Required | Description | Notes |
|---|---|---|---|---|
active_XBlocked | boolean | Yes | - | API field: active_XBlocked |
active_XCapture | boolean | Yes | - | API field: active_XCapture |
ad_spyware_sites_blocked | boolean | Yes | - | API field: ad_spyware_sites_blocked |
ad_spyware_sites_capture | boolean | Yes | - | API field: ad_spyware_sites_capture |
alert_for_unknown_or_suspicious_c2_traffic | boolean | Yes | - | API field: alert_for_unknown_or_suspicious_c2_traffic |
anonymizer_blocked | boolean | Yes | - | API field: anonymizer_blocked |
anonymizer_capture | boolean | Yes | - | API field: anonymizer_capture |
bit_torrent_blocked | boolean | Yes | - | API field: bit_torrent_blocked |
bit_torrent_capture | boolean | Yes | - | API field: bit_torrent_capture |
block_countries_capture | boolean | Yes | - | API field: block_countries_capture |
blocked_countries | DestCountriesEnumCollection | Yes | - | API field: blocked_countries |
browser_exploits_blocked | boolean | Yes | - | API field: browser_exploits_blocked |
browser_exploits_capture | boolean | Yes | - | API field: browser_exploits_capture |
cmd_ctl_server_blocked | boolean | Yes | - | API field: cmd_ctl_server_blocked |
cmd_ctl_server_capture | boolean | Yes | - | API field: cmd_ctl_server_capture |
cmd_ctl_traffic_blocked | boolean | Yes | - | API field: cmd_ctl_traffic_blocked |
cmd_ctl_traffic_capture | boolean | Yes | - | API field: cmd_ctl_traffic_capture |
cookie_stealing_blocked | boolean | Yes | - | API field: cookie_stealing_blocked |
cookie_stealing_PCAP_enabled | boolean | Yes | - | API field: cookie_stealing_PCAP_enabled |
crypto_mining_blocked | boolean | Yes | - | API field: crypto_mining_blocked |
crypto_mining_capture | boolean | Yes | - | API field: crypto_mining_capture |
dga_domains_blocked | boolean | Yes | - | API field: dga_domains_blocked |
dga_domains_capture | boolean | Yes | - | API field: dga_domains_capture |
file_format_vunerabilites_blocked | boolean | Yes | - | API field: file_format_vunerabilites_blocked |
file_format_vunerabilites_capture | boolean | Yes | - | API field: file_format_vunerabilites_capture |
google_talk_blocked | boolean | Yes | - | API field: google_talk_blocked |
google_talk_capture | boolean | Yes | - | API field: google_talk_capture |
irc_tunnelling_blocked | boolean | Yes | - | API field: irc_tunnelling_blocked |
irc_tunnelling_capture | boolean | Yes | - | API field: irc_tunnelling_capture |
known_phishing_sites_blocked | boolean | Yes | - | API field: known_phishing_sites_blocked |
known_phishing_sites_capture | boolean | Yes | - | API field: known_phishing_sites_capture |
malicious_urls_capture | boolean | Yes | - | API field: malicious_urls_capture |
malware_sites_blocked | boolean | Yes | - | API field: malware_sites_blocked |
malware_sites_capture | boolean | Yes | - | API field: malware_sites_capture |
potential_malicious_requests_blocked | boolean | Yes | - | API field: potential_malicious_requests_blocked |
potential_malicious_requests_capture | boolean | Yes | - | API field: potential_malicious_requests_capture |
risk_tolerance | integer | Yes | - | API field: risk_tolerance |
risk_tolerance_capture | boolean | Yes | - | API field: risk_tolerance_capture |
ssh_tunnelling_blocked | boolean | Yes | - | API field: ssh_tunnelling_blocked |
ssh_tunnelling_capture | boolean | Yes | - | API field: ssh_tunnelling_capture |
suspect_adware_spyware_sites_blocked | boolean | Yes | - | API field: suspect_adware_spyware_sites_blocked |
suspect_adware_spyware_sites_capture | boolean | Yes | - | API field: suspect_adware_spyware_sites_capture |
suspected_phishing_sites_blocked | boolean | Yes | - | API field: suspected_phishing_sites_blocked |
suspected_phishing_sites_capture | boolean | Yes | - | API field: suspected_phishing_sites_capture |
tor_blocked | boolean | Yes | - | API field: tor_blocked |
tor_capture | boolean | Yes | - | API field: tor_capture |
webspam_blocked | boolean | Yes | - | API field: webspam_blocked |
webspam_capture | boolean | Yes | - | API field: webspam_capture |
Example
{
"active_XBlocked": true,
"active_XCapture": true,
"ad_spyware_sites_blocked": true,
"ad_spyware_sites_capture": true,
"alert_for_unknown_or_suspicious_c2_traffic": true,
"anonymizer_blocked": true,
"anonymizer_capture": true,
"bit_torrent_blocked": true
}
// ... more fields