List TTPs from TTP Agent

Step 1: Get the JSON of your query

Use the API button at the top of the page of a saved or adhoc TTP Agent search.

The query will be a JSON body with the following fields:

Objects	Type	Description
threatLayers	Array of Strings	(optional) a list of list of threat ids (malware / actors)
ttpLayer	Array of Strings	(optional) a list of TTP ids
period	Array of Strings	a JSON that contains the following:
type	String	from Last7Days / Last30Days / Last3Months / Last6Months / `Custom
start	Date	(only for Custom) the date of the start of the period YYYY-MM-DD
end	Date	(only for Custom) the date of the start of the period YYYY-MM-DD

Example

{
  "threatLayers": [
    [
      "nlp/f/entity/gz:ta:68391641-859f-4a9a-9a1e-3e5cf71ec376"
    ]
  ],
  "ttpLayer": [
    "nlp/f/entity/gz:mi:attack-pattern-3ccef7ae-cb5e-48f6-8302-897105fbf55c"
  ],
  "period": {
    "type": "Last3Months"
  }
}

Step 2: Access the TTP table

POST https://api.feedly.com/v3/trends/ttp-dashboard

body of the request: the JSON query you obtained in step 2

Result

{
  "navigatorUrls": {
    "articleCount": "",
    "csv": "",
    "yaml": ""
  },
  "rows": [
    {
      "ttp": {
        "id": "nlp/f/entity/gz:mi:attack-pattern-3ccef7ae-cb5e-48f6-8302-897105fbf55c",
        "label": "Deobfuscate/Decode Files or Information (Enterprise T1140)",
        "type": "mitreAttack"
      },
      "nArticles": 14
      "delta": 9,
      "actors": [
        {
          "id": "nlp/f/entity/gz:ta:68391641-859f-4a9a-9a1e-3e5cf71ec376",
          "label": "Lazarus Group",
          "type": "threatActor"
        },
        {
          "id": "nlp/f/entity/gz:ta:245c8dde-ed42-4c49-b48b-634e3e21bdd7",
          "label": "Silent Chollima",
          "type": "threatActor"
        }
      ],
      "articleExamples": [
        {
          "crawledAt": "2023-07-25T11:15:36.304000+00:00",
          "entryId": "Vy06FQ3uO1t9MDBrd3uXGsqrB7bvt4aX7iJHcnuBAH4=_1898cc2fcf0:7c047:80d24054",
          "sourceName": "CSO Online",
          "title": "Lazarus group exploits Windows IIS servers to distribute malware"
        },
        {
          "crawledAt": "2023-07-24T06:29:36.294000+00:00",
          "entryId": "Bc00IrXRCD6LOoKSwFYCkK2059nhERa710Zf7dhSTbA=_1898696c9a6:27f420:64ea98f4",
          "sourceName": "Malware Information Archives - ASEC BLOG",
          "title": "Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points"
        },
        {
          "crawledAt": "2023-05-23T06:01:15.641000+00:00",
          "entryId": "Bc00IrXRCD6LOoKSwFYCkK2059nhERa710Zf7dhSTbA=_18847328e79:387bd4:e220a189",
          "sourceName": "Malware Information Archives - ASEC BLOG",
          "title": "Lazarus Group Targeting Windows IIS Web Servers"
        }
      ],
      "industries": [],
      "malwares": [],
    },
		...
  ]
}

OpenAPI definition

{
  "openapi": "3.1.0",
  "info": {
    "title": "Trends API",
    "version": "1.0"
  },
  "servers": [
    {
      "url": "https://api.feedly.com/v3/trends/"
    }
  ],
  "components": {
    "securitySchemes": {
      "sec0": {
        "type": "apiKey",
        "in": "header",
        "name": "Authorization",
        "x-bearer-format": "bearer"
      }
    }
  },
  "security": [
    {
      "sec0": []
    }
  ],
  "paths": {
    "/ttp-dashboard": {
      "post": {
        "summary": "List TTPs from TTP Agent",
        "description": "",
        "operationId": "list-ttps",
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "RAW_BODY"
                ],
                "properties": {
                  "RAW_BODY": {
                    "type": "string",
                    "description": "Body of the request: the JSON query you obtained in step 2"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "200",
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {}
                }
              }
            }
          },
          "400": {
            "description": "400",
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {}
                }
              }
            }
          }
        },
        "deprecated": false
      }
    }
  },
  "x-readme": {
    "headers": [],
    "explorer-enabled": true,
    "proxy-enabled": true
  },
  "x-readme-fauxas": true,
  "_id": "65492729c04b66000c5d3d70:65492869e3791613cf231e0c"
}