TTP Agent JSON Structure

The purpose of this guide is to help you become familiar with the JSON structure Feedly creates to represent the TTP Agent in the Feedly REST API.

Response Structure

NavigatorUrls

Field	Type	Description
articleCount	String	URL to export article count data in JSON format
csv	String	URL to export agent data in CSV format
yaml	String	URL to export agent data in YAML format

Rows

Array of objects with the following structure:

Field	Type	Description
actors	Array	List of threat actor objects associated with this TTP
delta	Number	Change in number of articles compared to previous period
malwares	Array	List of malware objects associated with this TTP
nArticles	Number	Number of articles where a threat matching the filters is mentioned using this TTP
ttp	Object	Information about the MITRE ATT&CK technique

Actors object

Field	Type	Description
id	String	Unique identifier for the threat actor
label	String	Name of the threat actor
type	String	Always "threatActor"
description	String	Optional description of the threat actor

Malwares object

Field	Type	Description
id	String	Unique identifier for the malware family
label	String	Name of the malware family
type	String	Always "malwareFamily"
description	String	Optional description of the malware

TTP object

Field	Type	Description
id	String	Unique identifier for the technique
label	String	Full label including technique name and MITRE ID
mitreId	String	MITRE ATT&CK technique ID (e.g., "T1027")
name	String	Name of the technique

Example

{
  "navigatorUrls": {
    "articleCount": "",
    "csv": "",
    "yaml": ""
  },
  "rows": [
    {
      "actors": [
        {
          "id": "nlp/f/entity/gz:ta:b2056ff0-00b9-482e-b11c-c771daa5f28a",
          "label": "APT29",
          "type": "threatActor"
        }
      ],
      "delta": 37,
      "malwares": [
        {
          "id": "nlp/f/entity/gz:mal:41f590a8-6902-47c6-940b-c4457d2f7ea2",
          "label": "DAMASCENED PEACOCK",
          "type": "malwareFamily"
        }
      ],
      "nArticles": 37,
      "ttp": {
        "id": "nlp/f/entity/gz:mi:attack-pattern-b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
        "label": "Obfuscated Files or Information (Enterprise T1027)",
        "mitreId": "T1027",
        "name": "Obfuscated Files or Information"
      }
    }
  ]
}