v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Security Monitoring

List indicators of compromise

Get a list of indicators of compromise (IoCs) matching the specified filters.

get/api/v2/security/siem/ioc-explorer

limitinteger

Number of results per page.

offsetinteger

Pagination offset.

querystring

Search/filter query (supports field:value syntax).

sort[column]string

Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type.

sort[order]string

Sort order: asc or desc.

ocsfboolean

When true, return only OCSF field-based matches. When false, return regex/message-based matches.

worked_bystring

Filter indicators whose triage state was updated by a specific user identified by their handle.

triage_state'not_reviewed' | 'reviewed'

Current triage state of the indicator.

Example:not_reviewed

Filter by triage state.

{
  "data": {
    "attributes": {
      "data": [
        {
          "triage_state": "not_reviewed"
        }
      ]
    }
  }
}