GitHub
Home / Documentation / Reputation Category - Event Types

Complete reference for threat intelligence types including blocklists and IOCs

Reputation Category

Threat intelligence data including blocklist entries and indicators of compromise (IOCs). Used by security vendors, threat intelligence platforms, and defensive security tools.

Field Legend

  • 🟠 Mandatory - MUST be present in all valid reports
  • 🟢 Recommended - SHOULD be included when information is available
  • 🔵 Optional - MAY be included for additional context

blocklist

Use Case: Reports for adding sources to security blocklists. Used by threat intelligence feeds, firewall vendors, and security platforms to maintain lists of known malicious IPs, domains, or URLs for blocking.

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T10:00:00Z",
  🟠 "reporter": {
    "org": "Threat Intelligence Platform",
    "contact": "[email protected]",
    "domain": "threatintel.example"
  },
  🟠 "sender": {
    "org": "Threat Intelligence Platform",
    "contact": "[email protected]",
    "domain": "threatintel.example"
  },
  🟠 "source_identifier": "192.0.2.150",
  🟠 "category": "reputation",
  🟠 "type": "blocklist",

  🟢 "source_port": 443,
  🟢 "evidence_source": "threat_intelligence",
  🟢 "evidence": [
    {
      "content_type": "application/json",
      "description": "Blocklist intelligence data",
      "payload": "eyJyZWFzb24iOiJtYWx3YXJlX2MyfQ=="
    }
  ],
  🔵 "confidence": 0.96,

  🔵 "tags": ["blocklist:malware_c2", "priority:high"],
  🔵 "description": "Malware C2 server - add to blocklist immediately"
}

Schema

threat_intelligence

Use Case: Sharing of threat intelligence indicators of compromise (IOCs) including file hashes, C2 domains, malware signatures, and attack patterns. Used by security researchers, SOCs, and threat intelligence sharing communities (ISACs, FIRST, etc.).

{ } View Complete Sample 
{
  🟠 "xarf_version": "4.0.0",
  🟠 "report_id": "550e8400-e29b-41d4-a716-446655440000",
  🟠 "timestamp": "2024-01-15T14:00:00Z",
  🟠 "reporter": {
    "org": "Security Research Lab",
    "contact": "[email protected]",
    "domain": "seclab.example"
  },
  🟠 "sender": {
    "org": "Security Research Lab",
    "contact": "[email protected]",
    "domain": "seclab.example"
  },
  🟠 "source_identifier": "198.51.100.75",
  🟠 "category": "reputation",
  🟠 "type": "threat_intelligence",

  🟢 "source_port": 8080,
  🟢 "evidence_source": "researcher_analysis",
  🟢 "evidence": [
    {
      "content_type": "application/json",
      "description": "IOC data package",
      "payload": "eyJpb2NzIjp7ImZpbGVfaGFzaCI6InNoYTI1Ni4uLiJ9fQ=="
    }
  ],
  🔵 "confidence": 0.98,

  🔵 "tags": ["ioc:malware_hash", "campaign:apt29"],
  🔵 "description": "APT29 campaign IOCs - file hashes and C2 infrastructure"
}

Schema