ThreatintelClient

class oci.threat_intelligence.ThreatintelClient(config, **kwargs)

Use the Threat Intelligence API to search for information about known threat indicators, including suspicious IP addresses, domain names, and other digital fingerprints. Threat Intelligence is a managed database of curated threat intelligence that comes from first party Oracle security insights, open source feeds, and vendor-procured data. For more information, see the [Threat Intelligence documentation](/iaas/Content/threat-intel/home.htm).

Methods

__init__(config, **kwargs) Creates a new service client
get_indicator(indicator_id, compartment_id, …) Get detailed information about a threat indicator with a given identifier.
list_indicator_counts(compartment_id, **kwargs) Get the current count of each threat indicator type.
list_indicators(compartment_id, **kwargs) Get a list of threat indicator summaries based on the search criteria.
list_threat_types(compartment_id, **kwargs) Gets a list of threat types that are available to use as parameters when querying indicators.
summarize_indicators(compartment_id, …) Get indicator summaries based on advanced search criteria.
__init__(config, **kwargs)

Creates a new service client

Parameters:
  • config (dict) – Configuration keys and values as per SDK and Tool Configuration. The from_file() method can be used to load configuration from a file. Alternatively, a dict can be passed. You can validate_config the dict using validate_config()
  • service_endpoint (str) – (optional) The endpoint of the service to call using this client. For example https://iaas.us-ashburn-1.oraclecloud.com. If this keyword argument is not provided then it will be derived using the region in the config parameter. You should only provide this keyword argument if you have an explicit need to specify a service endpoint.
  • timeout (float or tuple(float, float)) – (optional) The connection and read timeouts for the client. The default values are connection timeout 10 seconds and read timeout 60 seconds. This keyword argument can be provided as a single float, in which case the value provided is used for both the read and connection timeouts, or as a tuple of two floats. If a tuple is provided then the first value is used as the connection timeout and the second value as the read timeout.
  • signer (AbstractBaseSigner) –

    (optional) The signer to use when signing requests made by the service client. The default is to use a Signer based on the values provided in the config parameter.

    One use case for this parameter is for Instance Principals authentication by passing an instance of InstancePrincipalsSecurityTokenSigner as the value for this keyword argument

  • retry_strategy (obj) –

    (optional) A retry strategy to apply to all calls made by this service client (i.e. at the client level). There is no retry strategy applied by default. Retry strategies can also be applied at the operation level by passing a retry_strategy keyword argument as part of calling the operation. Any value provided at the operation level will override whatever is specified at the client level.

    This should be one of the strategies available in the retry module. A convenience DEFAULT_RETRY_STRATEGY is also available. The specifics of the default retry strategy are described here.

  • circuit_breaker_strategy (obj) – (optional) A circuit breaker strategy to apply to all calls made by this service client (i.e. at the client level). This client uses DEFAULT_CIRCUIT_BREAKER_STRATEGY as default if no circuit breaker strategy is provided. The specifics of circuit breaker strategy are described here.
  • circuit_breaker_callback (function) – (optional) Callback function to receive any exceptions triggerred by the circuit breaker.
  • client_level_realm_specific_endpoint_template_enabled (bool) – (optional) A boolean flag to indicate whether or not this client should be created with realm specific endpoint template enabled or disable. By default, this will be set as None.
  • allow_control_chars – (optional) allow_control_chars is a boolean to indicate whether or not this client should allow control characters in the response object. By default, the client will not allow control characters to be in the response object.
get_indicator(indicator_id, compartment_id, **kwargs)

Get detailed information about a threat indicator with a given identifier.

Parameters:
  • indicator_id (str) – (required) The unique identifier (OCID) of the threat indicator.
  • compartment_id (str) – (required) The OCID of the tenancy (root compartment) that is used to filter results.
  • opc_request_id (str) – (optional) The client request ID for tracing.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type Indicator
Return type:

Response
Example:

Click here to see an example of how to use get_indicator API.

list_indicator_counts(compartment_id, **kwargs)

Get the current count of each threat indicator type. Indicator counts can be sorted in ascending or descending order.

Parameters:
  • compartment_id (str) – (required) The OCID of the tenancy (root compartment) that is used to filter results.
  • opc_request_id (str) – (optional) The client request ID for tracing.
  • sort_order (str) –

    (optional) The sort order to use, either ‘ASC’ or ‘DESC’.

    Allowed values are: “ASC”, “DESC”

  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type IndicatorCountCollection
Return type:

Response
Example:

Click here to see an example of how to use list_indicator_counts API.

list_indicators(compartment_id, **kwargs)

Get a list of threat indicator summaries based on the search criteria.

Parameters:
  • compartment_id (str) – (required) The OCID of the tenancy (root compartment) that is used to filter results.
  • threat_type_name (list[str]) – (optional) The threat type of entites to be returned. To filter for multiple threat types, repeat this parameter.
  • type (str) –

    (optional) The indicator type of entities to be returned.

    Allowed values are: “DOMAIN_NAME”, “FILE_NAME”, “MD5_HASH”, “SHA1_HASH”, “SHA256_HASH”, “IP_ADDRESS”, “URL”

  • value (str) – (optional) The indicator value of entities to be returned.
  • confidence_greater_than_or_equal_to (int) – (optional) The minimum confidence score of entities to be returned.
  • time_updated_greater_than_or_equal_to (datetime) – (optional) The oldest update time of entities to be returned.
  • time_updated_less_than (datetime) – (optional) Return indicators updated before the provided time.
  • time_last_seen_greater_than_or_equal_to (datetime) – (optional) The oldest last seen time of entities to be returned.
  • time_last_seen_less_than (datetime) – (optional) Return indicators last seen before the provided time.
  • time_created_greater_than_or_equal_to (datetime) – (optional) The oldest created/first seen time of entities to be returned.
  • time_created_less_than (datetime) – (optional) Return indicators created/first seen before the provided time.
  • limit (int) – (optional) The maximum number of items to return.
  • page (str) – (optional) A token representing the position at which to start retrieving results. This must come from the opc-next-page header field of a previous response.
  • sort_order (str) –

    (optional) The sort order to use, either ‘ASC’ or ‘DESC’.

    Allowed values are: “ASC”, “DESC”

  • sort_by (str) –

    (optional) The field to sort by. Only one field to sort by may be provided.

    Allowed values are: “confidence”, “timeCreated”, “timeUpdated”, “timeLastSeen”

  • opc_request_id (str) – (optional) The client request ID for tracing.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type IndicatorSummaryCollection
Return type:

Response
Example:

Click here to see an example of how to use list_indicators API.

list_threat_types(compartment_id, **kwargs)

Gets a list of threat types that are available to use as parameters when querying indicators. The list is sorted by threat type name according to the sort order query param.

Parameters:
  • compartment_id (str) – (required) The OCID of the tenancy (root compartment) that is used to filter results.
  • limit (int) – (optional) The maximum number of items to return.
  • page (str) – (optional) A token representing the position at which to start retrieving results. This must come from the opc-next-page header field of a previous response.
  • sort_order (str) –

    (optional) The sort order to use, either ‘ASC’ or ‘DESC’.

    Allowed values are: “ASC”, “DESC”

  • opc_request_id (str) – (optional) The client request ID for tracing.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type ThreatTypesCollection
Return type:

Response
Example:

Click here to see an example of how to use list_threat_types API.

summarize_indicators(compartment_id, summarize_indicators_details, **kwargs)

Get indicator summaries based on advanced search criteria.

Parameters:
  • compartment_id (str) – (required) The OCID of the tenancy (root compartment) that is used to filter results.
  • summarize_indicators_details (oci.threat_intelligence.models.SummarizeIndicatorsDetails) – (required) Query Parameters to search for indicators.
  • opc_request_id (str) – (optional) The client request ID for tracing.
  • limit (int) – (optional) The maximum number of items to return.
  • page (str) – (optional) A token representing the position at which to start retrieving results. This must come from the opc-next-page header field of a previous response.
  • retry_strategy (obj) –

    (optional) A retry strategy to apply to this specific operation/call. This will override any retry strategy set at the client-level.

    This should be one of the strategies available in the retry module. This operation uses DEFAULT_RETRY_STRATEGY as default if no retry strategy is provided. The specifics of the default retry strategy are described here.

    To have this operation explicitly not perform any retries, pass an instance of NoneRetryStrategy.

  • allow_control_chars (bool) – (optional) allow_control_chars is a boolean to indicate whether or not this request should allow control characters in the response object. By default, the response will not allow control characters in strings
Returns:

A Response object with data of type IndicatorSummaryCollection
Return type:

Response
Example:

Click here to see an example of how to use summarize_indicators API.