IoC-Stream Notifications

An IoC Stream Notification object represents a notification generated by one of your IoC-Stream sources.

The object contains the following attributes:

• date: <integer> notification date as UTC timestamp.
• entity_type: <string> the type of object the notification has matched.
• entity_id: <string> the ID of the object the notification has matches.
• origin: <string> the origin of the notification.
• hunting_info: <dictionary> only present in notifications with origin=hunting. Includes additional information about the match, this dictionary can contain the following fields:
  • match_in_subfile: <boolean> whether the match was in a subfile or not.
  • rule_name: <string> matched rule name.
  • rule_tags: <list of strings> matched rule tags.
  • snippet: <string> matched contents inside the file as hexdump. Contains begin_highlight and end_highlight substrings to indicate the part of the file that produced the match and give additional context about surrounding bytes in the match.
  • source_country: <string> country where the matched file was uploaded from.
  • source_key: <string> unique identifier for the source in ciphered form.
• sources: <list of dictionaries> the different sources associated to the notification. For example, in notifications from Livehunt the only source is always the hunting ruleset that triggered the notification.
• tags: <list of strings> notification tags.

{
  "data": {
    "attributes": {
      "date": <int>,
      "entity_type": <string>,
      "entity_id": <string>,
      "origin": <string>,
      "hunting_info": {
        "match_in_subfile": <bool>,
        "rule_name": <string>,
        "rule_tags": [<string>, ...],
        "snippet": <string>,
        "source_country": <string>,
        "source_key": <string>,
      "sources": [{"type": <string>, "id": <string>}, ...],
      "tags": [<string>, ...]
    },
    "id": <string>,
    "links": {
      "self": "https://www.virustotal.com/api/v3/ioc_stream_notifications/<id>"
    },
    "type": "ioc_stream_notification"
  }
}

{
	"data": {
		"attributes": {
			"origin": "hunting",
			"entity_id": "7ed0586b68a24bbe7cb29852beb48f2c6a625af46d2fbc3c652d552aa1b1bb5b",
			"hunting_info": {
				"rule_name": "vulnerability_weaponization",
				"source_country": "TR",
				"source_key": "3ed40be4"
			},
			"tags": [
				"ransomware",
				"vulnerability_weaponization",
				"wcoyote"
			],
			"entity_type": "file",
			"sources": [
				{
					"type": "hunting_ruleset",
					"id": "123456789"
				}
			],
			"date": 1684830325
		},
		"type": "ioc_stream_notification",
		"id": "10494503008",
		"links": {
			"self": "https://www.virustotal.com/api/v3/ioc_stream_notifications/10494503008"
		}
	}
}