v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Security Monitoring

Get an indicator of compromise

Get detailed information about a specific indicator of compromise (IoC).

get/api/v2/security/siem/ioc-explorer/indicator

Query parameters

indicatorstring required

The indicator value to look up (for example, an IP address or domain).

ocsfboolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

include_triage_historyboolean

Include full triage history for the indicator.

triage_history_limitinteger

Maximum number of triage history events returned. Only applied when include_triage_history is true.

triage_history_offsetinteger

Pagination offset into the triage history. Only applied when include_triage_history is true.

Response

Example response

{
  "data": {
    "attributes": {
      "data": {
        "triage_history": [
          {
            "triage_state": "not_reviewed"
          }
        ],
        "triage_state": "not_reviewed"
      }
    }
  }
}