EntityIndicator

• JSON representation

Identifying information for an Entity at a given point in time. This encapsulates the indicator type (in the field name) and value, as well as the namespace when relevant (for internal Asset indicators).

JSON representation

{ "indicatorNamespace": string, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "hostname": string, "assetIpAddress": string, "mac": string, "productId": string, "username": string, "email": string, "employeeId": string, "windowsSid": string, "projectObjectId": string, "rawPid": string, "processId": string, "fullCommandLine": string, "parentProcessId": string, "hashMd5": string, "hashSha1": string, "hashSha256": string, "filePath": string, "destinationIpAddress": string, "domainname": string, "resourceProjectObjectId": string, "resource": string, "productObjectId": string // End of mutually exclusive fields. }

Fields
indicatorNamespace	string Namespace value of the indicator. Namespaces are supported for Asset indicators - hostname, mac, assetIpAddress, productId, and projectObjectId.
Indicator type and value, consistent with malachite.dao.KValueType. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
hostname	string The hostname to identify an asset.
assetIpAddress	string The IP address to identify an asset.
mac	string The MAC address to identify an asset.
productId	string Some ID that uniquely identifies an asset. This corresponds to the assetId field in the UDM Asset and Noun.
username	string The user name or user ID to identify a user. This corresponds to the userid field in the UDM User and the userName field when specified as a entityRiskScores.query entity_idicator filter.
email	string The email address to identify a user. This corresponds to the emailAddresses field in the UDM User.
employeeId	string The employee id to identify a user.
windowsSid	string The windows SID to identify a user.
projectObjectId (deprecated)	string This item is deprecated! Deprecated. Some vendor-specific ID to identify a user. This corresponds to the productObjectId field in the UDM User.
rawPid	string The raw pid.
processId	string The process id. This corresponds to the pid field in the UDM Process.
fullCommandLine	string The full command line. This corresponds to the commandLine field in the UDM Process.
parentProcessId	string The parent process id. This corresponds to the parentProcess.pid field in the UDM Process.
hashMd5	string The hash md5.
hashSha1	string The hash sha1.
hashSha256	string The hash sha256.
filePath	string The file path. This corresponds to the fullPath field in the UDM File.
destinationIpAddress	string The resolved ip address. This corresponds to the ip field in the UDM Artifact.
domainname	string The domain name. This corresponds to the name field in the UDM Domain and to the domainName field when specified as a entityRiskScores.query entity_idicator filter.
resourceProjectObjectId	string LDAP Object Id or generic product object identifier that creates a unique user entity identifier. This corresponds to the productObjectId field in the UDM Resource.
resource	string System unique resource name. This corresponds to the name field in the UDM Resource and to the resourceName field when specified as a entityRiskScores.query entity_idicator filter.
productObjectId	string The product object id which can be used to identify an asset, user, group, or resource. This corresponds to the productObjectId field in the UDM Resource, User, Asset, and Group.
End of mutually exclusive fields.