v1

latestOpenAPI 3.0.02026-08-064311,0881.3 MB

threatIntelIngestProducer

Uploads indicators in a STIX 2.x json format.

Uploads a list indicators in in a STIX 2.x json format.

post/v1/threatIntel/datastore/indicators/stix

Request body

sourcestring required

User-provided text to identify the source of the indicator

Example request

{
  "source": "FreeTAXII",
  "indicators": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "acme:indicator-bf8bc5d5-c7e6-46b0-8d22-7500fea77196",
      "created": "2023-03-21T12:00:00Z",
      "modified": "2023-03-21T12:00:00Z",
      "created_by_ref": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff",
      "labels": [
        "heartbleed",
        "has-logo"
      ],
      "lang": "en",
      "external_references": [
        {
          "source_name": "system",
          "url": "https://github.com/vz-risk/0001AA7F-C601-424A-B2B8-BE6C9F5164E7.json",
          "hashes": {
            "SHA-256": "6db12788c37247f2316052e142f42f4b259d6561751e5f401a1ae2a6df9c674b"
          },
          "external_id": "0001AA7F-C601-424A-B2B8-BE6C9F5164E7"
        }
      ],
      "object_marking_refs": [
        "marking-definition--089a6ecb-cc15-43cc-9494-767639779123"
      ],
      "granular_markings": [
        {
          "lang": "en",
          "marking_ref": "marking-definition--089a6ecb-cc15-43cc-9494-767639779123",
          "selectors": [
            "description",
            "labels"
          ]
        }
      ],
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '1.2.3.4']",
      "pattern_type": "stix",
      "valid_from": "2023-03-21T12:00:00Z",
      "valid_until": "2023-03-21T12:00:00Z",
      "kill_chain_phases": [
        {
          "kill_chain_name": "lockheed-martin-cyber-kill-chain",
          "phase_name": "reconnaissance"
        }
      ]
    }
  ]
}

Response

Stix indicators successfully uploaded.

invalidIndicatorsstring[] required

A list of invalid indicator IDs that were not ingested

Example response

{
  "invalidIndicators": [
    "indicator--foo",
    "indicator--bar"
  ]
}