v1

latestOpenAPI 3.1.12026-07-242899061.7 MB

Detections

Submit detected IOCs to the Collective Insights

Ingest IoC detections from your security tools into Collective Insights to enrich your enterprise's threat intelligence with detection context from firewalls, SIEMs, and other sources.

post/detections

Request body

organization_idsstring[]

A list of organizations to associate the submission with. The user making the request must be a member of every organization provided

Example request

{
  "data": [
    {
      "detection": {
        "type": "detection_rule"
      },
      "incident": {
        "id": "28548e09-63e8-4f8b-abd4-be86207b1583",
        "name": "Triggered Detection Rule",
        "type": "splunk-detection-rule"
      },
      "ioc": {
        "field": "dstip",
        "source_type": "netscreen:firewall",
        "type": "ip",
        "value": "1.2.3.4"
      },
      "malwares": [
        "Stuxnet"
      ],
      "mitre_codes": [
        "T1055"
      ],
      "timestamp": "2023-01-01T10:00:00Z"
    }
  ],
  "options": {
    "summary": true
  },
  "organization_ids": [
    "uhash:T2j9Lac3k1"
  ]
}

Response

Example response

{
  "result": {
    "object_ids": [
      "16046941d44a85e4748a9e9a",
      "16046941d44a85e4748a9e9b",
      "16046941d44a85e4748a9e9c"
    ],
    "status": "OK",
    "summary": {
      "dropped": [
        {
          "index": 3,
          "ioc_value": "aaaaa",
          "message": "Invalid hash: aaaaa",
          "reason": "INVALID_IOC",
          "transient_id": "79104EXAMPLEA723"
        }
      ],
      "processed": {
        "ip": 1
      }
    }
  }
}