incidentClassification

Structured threat classification extracted from the incident sources. Every field is optional: an absent field was not established by any source.

Examples

type IncidentClassification {
  attackType: IncidentAttackType
  campaignName: String
  primaryImpact: IncidentImpact
  secondaryImpacts: [IncidentImpact!]
  impactTargets: [IncidentImpactTarget!]
  capabilities: [IncidentCapability!]
  executionTriggers: [IncidentExecutionTrigger!]
  evidence: IncidentClassificationEvidence
  metadataContractVersion: String
}

Fields

Field	Description	Supported fields
attackType IncidentAttackType	How the affected package identities originated.
campaignName String	The recognized campaign or malware operation name explicitly established by a source.
primaryImpact IncidentImpact	The dominant established victim impact.
secondaryImpacts [IncidentImpact!]	Additional established victim impacts beyond the primary impact.
impactTargets [IncidentImpactTarget!]	The specific assets and data the established impacts target.
capabilities [IncidentCapability!]	The malware or attack behaviors established by the sources.
executionTriggers [IncidentExecutionTrigger!]	When the malicious payload executes.
evidence IncidentClassificationEvidence	Source excerpts that ground the stored classification fields.	attackType String campaignName String primaryImpact String secondaryImpacts String impactTargets String capabilities String executionTriggers String
metadataContractVersion String	The extraction contract version that produced the classification.

References

Fields with this object:

• {} Incident.classification

• {} ExtractedIncidentDraft.classification