Current ThreatQ Version Filter
 

Output Format Template Examples

ThreatQuotient provides output format template examples that you can use as a starting point for a new export.  You can copy and paste these examples to the Output Format Template field and make changes based on the data you want to export.

Export Template Examples by Object Type

Each of these examples includes the following placeholder text to clarify where you can add additional variables to customize your export:

  • Your variables go here

In addition, these examples include text labels to clarify the data included in the export.  For example, the output of the Indicators example, list of the name of each variable separated from the value by a colon as in Type:  IP Address.

Indicator Export Example

Adversaries Template

{foreach $data as $adversary}
ID: {$adversary.id}
Name: {$adversary.name}
Created At: {$adversary.created}
Updated At: {$adversary.updated_at}
Deleted At: {$adversary.deleted_at}
Deleted: {$adversary.deleted}

{foreach $adversary.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Assets Template

{foreach $data as $asset}
ID: {$asset.id}
Name: {$asset.value}
Status:  {$asset.status}
Point of Contact:  {$asset.point_of_contact}
Created At: {$asset.created_at}
Updated At: {$asset.updated_at}
Deleted At: {$asset.deleted_at}

{foreach $asset.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Attack Pattern Template

{foreach $data as $attack_pattern}
ID: {$attack_pattern.id}
Name: {$attack_pattern.value}
Status:  {$attack_pattern.status}
Point of Contact:  {$attack_pattern.point_of_contact}
Created At: {$attack_pattern.created_at}
Updated At: {$attack_pattern.updated_at}
Deleted At: {$attack_pattern.deleted_at}

{foreach $attack_pattern.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Campaign Template

{foreach $data as $campaign}
ID: {$campaign.id}
Name: {$campaign.value}
Status:  {$campaign.status}
Point of Contact:  {$campaign.point_of_contact}
Objective:  {$campaign.objective}
First Seen: {$campaign.started_at}
Last Seen:  {$campaign.ended_at}
Created At: {$campaign.created_at}
Updated At: {$campaign.updated_at}
Deleted At: {$campaign.deleted_at}

{foreach $campaign.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Course of Action Template

{foreach $data as $course_of_action}
ID: {$course_of_action.id}
Name: {$course_of_action.value}
Status:  {$course_of_action.status}
Point of Contact:  {$course_of_action.point_of_contact}
Created At: {$course_of_action.created_at}
Updated At: {$course_of_action.updated_at}
Deleted At: {$course_of_action.deleted_at}

{foreach $course_of_action.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Events Template

{foreach $data as $event}

{$event.title} ID: {$event.id}
Title: {$event.title}
Type: {$event.type}
Status:  {$event.status}
Point of Contact:  {$event.point_of_contact}
Happened: {$event.happened_at}
Created At: {$event.created}
Updated At: {$event.updated_at}
Deleted At: {$event.deleted_at}
Deleted: {$event.deleted}

{foreach $event.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Exploit Target Template

{foreach $data as $exploit_target}
ID: {$exploit_target.id}
Name: {$exploit_target.value}
Status:  {$exploit_target.status}
Point of Contact:  {$exploit_target.point_of_contact}
Created At: {$exploit_target.created_at}
Updated At: {$exploit_target.updated_at}
Deleted At: {$exploit_target.deleted_at}

{foreach $exploit_target.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Identity Template

{foreach $data as $identity}
ID: {$identity.id}
Name: {$identity.value}
Status:  {$identity.status}
Point of Contact:  {$identity.point_of_contact}
Contact Information:  {$identity.contact_information}
Created At: {$identity.created_at}
Updated At: {$identity.updated_at}
Deleted At: {$identity.deleted_at}

{foreach $identity.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Indicators Template

{foreach $data as $indicator}

{$indicator.value}
ID: {$indicator.id}
Value: {$indicator.value}
Type: {$indicator.type}
Status: {$indicator.status}
Class: {$indicator.class}
Score: {$indicator.score}
Hash: {$indicator.hash}
Source Count: {$indicator.sources_count}
Whitelisted: {$indicator.whitelisted}
Last Detected At: {$indicator.last_detected_at}
Created At: {$indicator.created_at}
Updated At: {$indicator.updated_at}
Since Deleted: {$indicator.sincedeleted}
Deleted At: {$indicator.deleted_at}
Deleted: {$indicator.deleted}

{foreach $indicator.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Intrusion Set Template

{foreach $data as $intrusion_set}
ID: {$intrusion_set.id}
Name: {$intrusion_set.value}
Status:  {$intrusion_set.status}
Point of Contact:  {$intrusion_set.point_of_contact}
First Seen: {$intrusion_set.started_at}
Last Seen:  {$intrusion_set.ended_at}
Created At: {$intrusion_set.created_at}
Updated At: {$intrusion_set.updated_at}
Deleted At: {$intrusion_set.deleted_at}

{foreach $intrusion_set.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Malware Template

{foreach $data as $malware}
ID: {$malware.id}
Name: {$malware.value}
Status:  {$malware.status}
Point of Contact:  {$malware.point_of_contact}
Created At: {$malware.created_at}
Updated At: {$malware.updated_at}
Deleted At: {$malware.deleted_at}

{foreach $malware.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Report Template

{foreach $data as $report}
ID: {$report.id}
Name: {$report.value}
Status:  {$report.status}
Point of Contact:  {$report.point_of_contact}
Created At: {$report.created_at}
Updated At: {$report.updated_at}
Deleted At: {$report.deleted_at}

{foreach $report.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Signatures Template

{foreach $data as $signature}

{$signature.name}
ID: {$signature.id}
Name: {$signature.name}
Value: {$signature.value}
Type: {$signature.type}
Status: {$signature.status}
Hash: {$signature.hash}
Detected At: {$signature.last_detected_at}
Created At: {$signature.created}
Updated At: {$signature.updated_at}
Deleted At: {$signature.deleted_at}
Deleted: {$signature.deleted}

{foreach $signature.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Tool Template

{foreach $data as $tool}
ID: {$tool.id}
Name: {$tool.value}
Status:  {$tool.status}
Point of Contact:  {$tool.point_of_contact}
Created At: {$tool.created_at}
Updated At: {$tool.updated_at}
Deleted At: {$tool.deleted_at}

{foreach $tool.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

TTP Template

{foreach $data as $ttp}
ID: {$ttp.id}
Name: {$ttp.value}
Status:  {$ttp.status}
Point of Contact:  {$ttp.point_of_contact}
Created At: {$ttp.created_at}
Updated At: {$ttp.updated_at}
Deleted At: {$ttp.deleted_at}

{foreach $ttp.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Vulnerability Template

{foreach $data as $vulnerability}
ID: {$vulnerability.id}
Name: {$vulnerability.value}
Status:  {$vulnerability.status}
Point of Contact:  {$vulnerability.point_of_contact}
Created At: {$vulnerability.created_at}
Updated At: {$vulnerability.updated_at}
Deleted At: {$vulnerability.deleted_at}

{foreach $vulnerability.Descriptions item=description name=Descriptions}
Source: {$description.source}
Description: {$description.value}
{/foreach}

Your variables go here

{/foreach}

Template Variables

The following is a list of commonly used Adversary and Indicator variables that you can add to the above template examples to expand the data included in an export.

Adversary Examples

Adversary VariableAdversary Variable

{foreach $adversary.Adversaries item=adversary name=Adversaries}
Name: {$adversary.name}
Value: {$adversary.value}
{/foreach}

Attachment VariableAttachment Variable

{foreach $adversary.Attachments item=attachment name=Attachments}
Name: {$attachment.name}
Value: {$attachment.value}
{/foreach}

Attribute VariableAttribute Variable

{foreach $adversary.Attributes item=attribute name=Attributes}
Name: {$attribute.name}
Value: {$attribute.value}
{/foreach}

Attribute Variable with Attribute Source and Update At TimestampAttribute Variable with Attribute Source and Update At Timestamp

{* $adversary.Attributes $attribute.Sources $attribute.updated_at *}
[
{foreach $adversary.Attributes item=attribute}
  Name: {$attribute.name}
  Updated_at: {$attribute.updated_at}
{foreach $attribute.sources item=source}
  Attr Source: {$source.name}
{/foreach}

{/foreach}
]

Any TLP filters specified for the export apply to the attribute source’s TLP label as well as the system object source’s TLP label.

Event VariableEvent Variable

{foreach $adversary.Events item=event name=Events}
Name: {$event.name}
Value: {$event.value}
{/foreach}

Indicator VariableIndicator Variable

{foreach $adversary.Indicators item=indicator name=Indicators}
Name: {$indicator.name}
Value: {$indicator.value}
{/foreach}

Investigation VariableInvestigation Variable

{foreach $adversary.Investigations item=investigation name=Investigations}
Name: {$investigation.name}
Value: {$investigation.value}
{/foreach}

Signature VariableSignature Variable

{foreach $adversary.Signatures item=signature name=Signatures}
Name: {$signature.name}
Value: {$signature.value}
{/foreach}

Source VariableSource Variable

{foreach $adversary.Sources item=source name=Sources}{$source.value} {if !empty($source.tlp)}({$source.tlp}){/if}
{/foreach}

Tag VariableTag Variable

{foreach $adversary.Tags as $tag item=Tags name=Tags}
Value: {$tag}
{/foreach}}

Task VariableTask Variable

{foreach $adversary.Tasks item=task name=Tasks}
Name: {$task.name}
Value: {$task.value}
{/foreach}

Indicator Examples

Adversary VariableAdversary Variable

{foreach $indicator.Adversaries item=adversary name=Adversaries}
Name: {$adversary.name}
Value: {$adversary.value}
{/foreach}

Attachment VariableAttachment Variable

{foreach $indicator.Attachments item=attachment name=Attachments}
Name: {$attachment.name}
Value: {$attachment.value}
{/foreach}

Attack Pattern VariableAttack Pattern Variable

{foreach $indicator.Attack_pattern item=attack_pattern name=Attack_pattern}
Name: {$attack_pattern.name}
Value: {$attack_pattern.value}
{/foreach}

Attribute VariableAttribute Variable

{foreach $indicator.Attributes item=attribute name=Attributes}
Name: {$attribute.name}
Value: {$attribute.value}
{/foreach}

Attribute Variable with Attribute Source and Update At TimestampAttribute Variable with Attribute Source and Update At Timestamp

{* $indicator.Attributes $attribute.Sources $attribute.updated_at *}
[
{foreach $indicator.Attributes item=attribute}
  Name: {$attribute.name}
  Updated_at: {$attribute.updated_at}
{foreach $attribute.sources item=source}
  Attr Source: {$source.name}
{/foreach}

{/foreach}
]

Any TLP filters specified for the export apply to the attribute source’s TLP label as well as the system object source’s TLP label.

Campaign VariableCampaign Variable

{foreach $indicator.Campaign item=campaign name=Campaign}
Name: {$campaign.name}
Value: {$campaign.value}
{/foreach}

Course of Action VariableCourse of Action Variable

{foreach $indicator.Course_of_action item=course_of_action name=Course_of_action}
Name: {$course_of_action.name}
Value: {$course_of_action.value}
{/foreach}

Event VariableEvent Variable

{foreach $indicator.Events item=event name=Events}
Name: {$event.name}
Value: {$event.value}
{/foreach}

Exploit Target VariableExploit Target Variable

{foreach $indicator.Exploit_Targets item=exploit_target name=Exploit_Target}
Name: {$exploit_target.name}
Value: {$exploit_target.value}
{/foreach}

Identity VariableIdentity Variable

{foreach $indicator.Identity item=identity name=Identity}
Name: {$identity.name}
Value: {$identity.value}
{/foreach}

Incident VariableIncident Variable

{foreach $indicator.Incident item=incident name=Incident}
Name: {$incident.name}
Value: {$incident.value}
{/foreach}

Indicator VariableIndicator Variable

{foreach $indicator.Indicators item=indicator name=Indicators}
Name: {$indicator.name}
Value: {$indicator.value}
{/foreach}

Intrusion Set VariableIntrusion Set Variable

{foreach $indicator.Intrusion_set item=intrusion_set name=Intrusion_set}
Name: {$intrusion_set.name}
Value: {$intrusion_set.value}
{/foreach}

Investigation VariableInvestigation Variable

{foreach $indicator.Investigations item=investigation name=Investigations}
Name: {$investigation.name}
Value: {$investigation.value}
{/foreach}

Malware VariableMalware Variable

{foreach $indicator.Malware item=malware name=Malware}
Name: {$malware.name}
Value: {$malware.value}
{/foreach}

Report VariableReport Variable

{foreach $indicator.Report item=report name=Report}
Name: {$report.name}
Value: {$report.value}
{/foreach}

Signature VariableSignature Variable

{foreach $indicator.Signatures item=signature name=Signatures}
Name: {$signature.name}
Value: {$signature.value}
{/foreach}

Task VariableTask Variable

{foreach $indicator.Tasks item=task name=Tasks}
Name: {$task.name}
Value: {$task.value}
{/foreach}

Tool VariableTool Variable

{foreach $indicator.Tool item=tool name=Tool}
Name: {$tool.name}
Value: {$tool.value}
{/foreach}

TTP VariableTTP Variable

{foreach $indicator.Ttp item=ttp name=Ttp}
Name: {$ttp.name}
Value: {$ttp.value}
{/foreach}

Vulnerability VariableVulnerability Variable

{foreach $indicator.Vulnerability item=vulnerability name=Vulnerability}
Name: {$vulnerability.name}
Value: {$vulnerability.value}
{/foreach}