Get Indicators Metadata

TruStar.get_indicators_metadata(indicators, enclave_ids=None)

Provide metadata associated with an list of indicators, including value, indicatorType, noteCount, sightings, lastSeen, enclaveIds, and tags. The metadata is determined based on the enclaves the user making the request has READ access to.

Parameters:
  • indicators – a list of Indicator objects to query. Values are required, types are optional. Types might be required to distinguish in a case where one indicator value has been associated with multiple types based on different contexts.
  • enclave_ids – a list of enclave IDs to restrict to. By default, uses all of the user’s enclaves.
Returns:

A list of Indicator objects. The following attributes of the objects will be returned: correlation_count, last_seen, sightings, notes, tags, enclave_ids. All other attributes of the Indicator objects will have Null values.