API Reference
ThreatIntelAnalysis
Queries threat intelligence services for reputation data.
Inheritance
- Object
- ThreatIntelAnalysis
Usage
This type appears in these public API surfaces even when no hand-authored example is attached directly to the page.
Returned or exposed by
Accepted by parameters
- Method ThreatIntelNarrative.Build
- Method Converters.Convert
Constructors
public ThreatIntelAnalysis(HttpClient client = null) #Initializes a new instance of ThreatIntelAnalysis.
Parameters
- client System.Net.Http.HttpClient = null
- Optional HTTP client used for requests.
Methods
public async Task Analyze(String domainName, String googleApiKey, String phishTankApiKey, String virusTotalApiKey, InternalLogger logger, CancellationToken ct = null) #TaskQueries all enabled reputation services.
Parameters
- domainName System.String
- googleApiKey System.String
- phishTankApiKey System.String
- virusTotalApiKey System.String
- logger DomainDetective.InternalLogger
- ct System.Threading.CancellationToken = null
Inherited Methods
public override Boolean Equals(Object obj) #BooleanParameters
- obj Object
Properties
public String Subject { get; set; } #Gets or sets the subject value.
public Func<String, Task<String>> GoogleSafeBrowsingOverride { get; set; } #Override Safe Browsing query.
public Func<String, Task<String>> PhishTankOverride { get; set; } #Override PhishTank query.
public Func<String, Task<String>> VirusTotalOverride { get; set; } #Override VirusTotal query returning JSON.
public Func<String, Task<VirusTotalObject>> VirusTotalObjectOverride { get; set; } #Override VirusTotal query returning a model.
public List<ThreatIntelFinding> Listings { get; } #Results returned from the consulted sources.
public Nullable<Int32> RiskScore { get; set; } #Risk score returned by the reputation service.
public String FailureReason { get; set; } #If feed queries fail, explains why.
public Nullable<Int32> CompositeScore { get; set; } #Composite risk score (0-100) normalized across providers.
public String Severity { get; set; } #Severity derived from CompositeScore.
public Nullable<Double> Confidence { get; set; } #Confidence level (0.0-1.0) based on corroborating sources.
public Boolean EnableUrlHaus { get; set; } #Gets or sets the enable url haus value.
public Boolean EnableOpenPhish { get; set; } #Gets or sets the enable open phish value.
public TimeSpan CacheTtl { get; set; } #Gets or sets the cache ttl value.
public Int32 WeightGoogleSafeBrowsing { get; set; } #Gets or sets the weight google safe browsing value.
public Int32 WeightPhishTank { get; set; } #Gets or sets the weight phish tank value.
public Int32 WeightUrlHaus { get; set; } #Gets or sets the weight url haus value.
public Int32 WeightOpenPhish { get; set; } #Gets or sets the weight open phish value.
public Int32 WeightVirusTotalListed { get; set; } #Gets or sets the weight virus total listed value.
public Int32 WeightVirusTotalReputation { get; set; } #Gets or sets the weight virus total reputation value.
public TimeSpan FreshWindow { get; set; } #Gets or sets the fresh window value.
public TimeSpan RecentWindow { get; set; } #Gets or sets the recent window value.
public TimeSpan MediumWindow { get; set; } #Gets or sets the medium window value.
public TimeSpan StaleWindow { get; set; } #Gets or sets the stale window value.
public Double UnknownRecencyFactor { get; set; } #Gets or sets the unknown recency factor value.
public Func<String, Task<String>> OpenPhishOverride { get; set; } #Override for OpenPhish JSON/CSV checks (for tests). Returns provider JSON.
public virtual List<Assessment> Assessments { get; } #Gets the assessments value.
public IReadOnlyList<RecommendationAdvice> Recommendations { get; } #Represents the recommendations value.