Enrichment: Field Attributes

The /v2/{entity_type}/fields endpoint returns the list of valid field names that can be passed via the fields query parameter on Search and Lookup requests. This controls which data blocks are included in each entity result.

Supported entity types: ip, domain, hash, url, vulnerability, company, malware

---

Common Fields

The following fields are available on all entity types (IP, Domain, Hash, URL, Vulnerability, Company, Malware):

Widely Available Fields

These fields are available on most — but not all — entity types:

• risk — Risk score, level, evidence details, and triggered risk rules
• riskMapping — MITRE ATT&CK technique codes mapped from risk rules
• enterpriseLists — Customer-managed list memberships. Not available for Company.
• links — Evidence-based indicator linkages. Requires specific access permissions. Not available for Company.
• threatLists — Current threat list and allow list memberships. Not available for URL.

Entity-Specific Fields

IP Address

Hash

Vulnerability

Company

Malware