Skip to main content
This page provides a comprehensive reference of fields and attributes associated with Threat Intelligence Reports (CTI Reports). Use these values when filtering and querying reports via CTI APIs or searching within ThreatBook console.

​
Report Category (category / category_list)

The category and category_list fields represent the primary classification of the threat intelligence report.

​
Threat Type (threat_type / threat_type_list)

The threat_type and threat_type_list indicate the nature of the cyber threat or attacker behavior documented in the report.
  • APT (Advanced Persistent Threat)
  • Ransomware
  • Supply Chain Attack
  • Phishing
  • Data Leakage
  • Data Breach
  • Crypto Mining
  • DDoS
  • Financial Theft
  • Others — Any cyber threat type not covered by the categories above.

​
Industry Classifications (target_industry / target_industry_list, industry_of_target_org, and org_industry)

Industry properties categorize target entities impacted by the threat. The supported parameters and response fields utilizing these industry values include:
  • Target Industry (target_industry / target_industry_list): The target sectors mentioned in the threat report.
  • Industry of Target Org (industry_of_target_org): Filter by the industry sectors of the targeted organization.
  • Target Org Industry (target_orgs[].org_industry): Response field showing the industries of the affected organization.
The reports mainly aligns with the STIX 2.1 industry standards, supporting a structured Level-1 and Level-2 classification:

​
Country & Region (hq_region_of_target_org / target_region_list / target_region_code / hq_region)

Country and region codes must comply with the ISO 3166-1 alpha-2 standard (two-letter country codes). The supported parameters and response fields utilizing these ISO country codes include:
  • Target Region Code (target_region_code / target_region_list): Filter by the country codes of the targeted entities.
  • HQ Region of Target Org (hq_region_of_target_org): Filter by the country codes of the targeted organization’s headquarters.
  • Target Org HQ Region (target_orgs[].hq_region): Response field showing the headquarters country codes of the targeted organization.
  • Standard: ISO 3166-1 alpha-2 (e.g., US, CN, JP, GB, DE).
  • Usage: Used to identify both the origin of threats/actors and the geographical locations of target entities.