DS-1190

Cyber Threat Indicators

Dataset

DHS Cybersecurity and Infrastructure Security Agency

DHS Cybersecurity and Infrastructure Security Agency

01/01/2016

12/31/2018

56 (lowest rank is 56)

Other

cyber attack

Unrestricted

true

Data Use Terms

Short Description
Cyber threat Indicators

Long Description
In 2016 DHS began the Automated Indicator Sharing (AIS) initiative. Through AIS, DHS enables the exchange of cyber threat indicators in a machine-readable (XML) format between the Federal Government and the private sector. Threat indicators are pieces of information like malicious IP addresses or the sender address of a phishing email (although they can also be much more complicated).

Organizations sharing indicators use the Traffic Light Protocol (TLP) (https://www.us-cert.gov/tlp ) to mark the indicators for sensitivity and control how widely they can be shared. While AIS exchanges TLP White, Green, and Amber indicators, the indicators available on this site are just the ones marked TLP White from CY16 through CY18. If you are interested in receiving all the AIS indicators and in near-real-time as they are exchanged, more information on how to directly participate in AIS is available at https://www.us-cert.gov/ais .

The AIS indicators available on this site are in the Structured Threat Information Expression (STIX) version 1.1 XML format. Additional information about STIX 1.x can be found at https://stixproject.github.io/, while specific AIS field information is documented at https://www.us-cert.gov/sites/default/files/ais_files/AIS_Submission_Guidance_Appendix_A.pdf .

48.1MB

false

dhs, security, agency, cybersecurity, infrastructure, indicators, threat, cyber, cyber threat indicators, 1190, 2016, dhs cybersecurity and infrastructure security agency, ais, tlp, https, cert, gov, stix, sharing, site, files, xml, white, format, green, control, federal, structured, email, expression, initiative, participate, amber, submission, organizations, complicated, machine, guidance, time, pdf, stixproject, automated, mark, specific, enables, government, version, real, exchanges, indicator, io, appendix, github, phishing, marked, readable, traffic, sector, documented, protocol, cy18, field, default, receiving, malicious, pieces, cy16, additional, other, private, shared, sensitivity, exchange, exchanged, light, sender, sites

Summary Record for the Group
This is the summary for the group

Sub-Datasets in this Group

Cyber Threat Indicators CY16 ( 2016-01-01 to 2016-12-31 )
Cyber Threat Indicators CY17 ( 2017-01-01 to 2017-12-31 )
Cyber Threat Indicators CY18 ( 2018-01-01 to 2018-12-31 )