quaxar-threat-actors
List threat actor profiles from S2W Quaxar service.
Syntax
quaxar-threat-actors [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [countries=COUNTRIES] [sectors=SECTORS] [origins=ORIGINS] [types=TYPES] [pretty=PRETTY]
Options
- profile=PROFILE
- Optional. QUAXAR connect profile code
- duration=NUM{mon|w|d|h|m|s}
- Optional. Scan only recent data. Use s(second), m(minute), h(hour), d(day), mon(month) time unit.
- from=yyyyMMddHHmmss
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- countries=COUNTRIES
- Optional. Comma-separated target country filter.
- sectors=SECTORS
- Optional. Comma-separated target sector filter.
- origins=ORIGINS
- Optional. Comma-separated origin country filter.
- types=TYPES
- Optional. Comma-separated threat actor type filter.
- pretty=PRETTY
- Optional. Set t to enable pretty print with line breaks (default: f).
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Profile name of QUAXAR |
| id | String | ID | Threat actor group ID |
| name | String | Name | Threat actor group name |
| types | String | Types | Newline-separated group types |
| origins | String | Origins | Newline-separated origin countries |
| countries | String | Countries | Newline-separated target countries |
| sectors | String | Sectors | Newline-separated target sectors |
| aliases | String | Aliases | Newline-separated alias names |
| last_updated | Date | Last updated | Last updated time |