EntityProfile

import type { EntityProfile } from "https://googleapis.deno.dev/v1/threatintelligence:v1beta.ts";

EntityProfile represents the structured profile of a customer entity, containing key identifiers and descriptive attributes optimized for contextual matching against threat intelligence, particularly Initial Access Broker (IAB) offerings.

interface EntityProfile {

countries?: string[];

domains?: string[];

industries?: string[];

name?: string;

operationalAreas?: string[];

profileSummary?: string;

regions?: string[];

subIndustries?: string[];

}

§Properties

countries?: string[]

[src]

Optional. List of specific countries of operation. Purpose: Essential for matching geographically targeted threats (e.g., actor specifies victims in 'DE'). Use ISO 3166-1 alpha-2 codes (e.g., "US", "GB", "JP", "DE").

domains?: string[]

[src]

Required. List of primary internet domain names associated with the entity. Purpose: Crucial for explicit matching against domains mentioned in threat intel and can inform semantic matching. Must contain at least one domain. Example: ["acme.com", "acme.co.uk"]

industries?: string[]

[src]

Optional. List of primary industry sectors the entity operates within. Purpose: Crucial for matching industry-specific threats and understanding attacker motivation. Use standardized GTI Industry Classification values. Example: ["Technology", "Financial Services", "Healthcare"]

name?: string

[src]

Required. Canonical name of the entity (e.g., the legal company name). Purpose: Primary identifier for the customer.

operationalAreas?: string[]

[src]

Optional. Specific geographic areas of significant operational concentration or strategic importance below the country level, if clearly identifiable and relevant. Purpose: Useful for highly localized threats, less commonly populated than countries. Example: ["Silicon Valley", "Frankfurt am Main Metropolitan Region"]

profileSummary?: string

[src]

Required. A concise, machine-generated (e.g., LLM) or human-curated summary of the entity. Purpose: Captures the semantic essence for embedding generation and similarity matching. Should synthesize key aspects like core business, scale, and market. Example: "Acme Corporation is a large, US-based multinational conglomerate operating..."

regions?: string[]

[src]

Optional. List of primary geopolitical regions where the entity has significant operations. Purpose: Filters geographically relevant threats. Use standardized names or codes where possible (e.g., "North America", "EMEA", "APAC", UN M49 codes).

subIndustries?: string[]

[src]

Optional. List of more granular sub-industries, if applicable and known. Purpose: Provides finer-grained context for more specific threat matching. Should align with GTI classifications if possible. Example: ["Semiconductors", "Cloud Computing Services", "Investment Banking"]