Callback Overview Statistics
callback-overviewRead-only
Aggregate statistics for callback/C2 IPs filtered by attack stage, file analysis, RIOT trust, scanners, and threats within a 1-7 day window.
Instructions
Aggregate statistics for callback/C2 IPs matching the filters: counts by attack stage, file analysis status, RIOT trust levels, scanner associations, and top threat names. Bounded to a recent window (days: 1-7, default 1) — wider ranges overload the aggregation.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | No | Filter to this specific set of callback IPs | |
| days | No | Lookback window in days (1-7, default 1) | |
| file_hash | No | File SHA256 hash | |
| file_name | No | File name substring match | |
| file_type | No | File MIME type (e.g. "application/x-executable") | |
| has_files | No | true = only IPs with malware files; false = only IPs without files | |
| is_stage_1 | No | true = file was downloaded from this IP (stage 1) | |
| is_stage_2 | No | true = suspected C2 based on VT/sandbox analysis (stage 2) | |
| scanner_ips | No | Filter to IPs associated with these scanner IPs |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| total_ips | No | ||
| stage_1_ips | No | ||
| stage_2_ips | No | ||
| total_files | No | ||
| not_riot_ips | No | ||
| files_with_vt | No | ||
| ips_with_files | No | ||
| unconfirmed_ips | No | ||
| files_without_vt | No | ||
| riot_level_1_ips | No | ||
| riot_level_2_ips | No | ||
| riot_level_3_ips | No | ||
| top_threat_names | No | ||
| total_cross_refs | No | ||
| distinct_scanners | No | ||
| ips_with_scanners | No | ||
| ips_without_files | No | ||
| total_scanner_links | No | ||
| ips_without_scanners | No |