AtiPrioritization

Next ID: 16 AtiPrioritization contains various fields used to calculate a priority score for an entity identified as a threat.

JSON representation 
{
  "gtiVerdict": integer,
  "gtiSeverity": integer,
  "gtiThreatScore": integer,
  "mandiantAnalystConfidence": integer,
  "gtiUpdateTime": string,
  "activeIr": boolean,
  "activeIrFirstTaggedTime": string,
  "globalCustomerCount": string,
  "globalHitCount": string,
  "exclusive": boolean,
  "osint": boolean,
  "scanner": boolean,
  "reviewed": boolean,
  "attributedMalware": [
    {
      object (Association)
    }
  ],
  "attributedThreatActors": [
    {
      object (Association)
    }
  ]
}
Fields
gtiVerdict

integer

The confidence score from "GTI verdict" source.
gtiSeverity

integer

The confidence score from "GTI severity" source.
gtiThreatScore

integer

The confidence score from "GTI threat score" source.
mandiantAnalystConfidence

integer

The confidence score from "Mandiant Analyst Intel" source.
gtiUpdateTime

string (Timestamp format)

Timestamp of the latest update for GTI verdict, severity, or threat score.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
activeIr

boolean

Whether one or more Mandiant incident response customers had this indicator in their environment.
activeIrFirstTaggedTime

string (Timestamp format)

The timestamp of the first time an active IR was applied to this entity.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
globalCustomerCount

string (int64 format)

Global customer count over the last 30 days
globalHitCount

string (int64 format)

Global hit count over the last 30 days
exclusive

boolean

Whether the indicator is being used by a maximum of one threat actor.
osint

boolean

Whether the indicator details are available in open source.
scanner

boolean

Whether the indicator is a scanner.
reviewed

boolean

Whether the indicator verdict has passed review.
attributedMalware[]

object (Association)

Malware families associated with this indicator.
attributedThreatActors[]

object (Association)

Threat actors associated with this indicator.