---
title: "Uploads indicators in a STIX 2.x json format."
method: POST
path: "/v1/threatIntel/datastore/indicators/stix"
tags: ["threatIntelIngestProducer"]
---

# Uploads indicators in a STIX 2.x json format.

`POST /v1/threatIntel/datastore/indicators/stix`

Uploads a list indicators in in a STIX 2.x json format.

## Request body

- UploadStixIndicatorsRequest
  - `source` string, required — User-provided text to identify the source of the indicator
  - `indicators` StixIndicator[], required — The list of stix threat intel indicators to upload.
    - `type` string, required — The type property identifies the type of STIX Object.
    - `spec_version` string, required — The STIX version
    - `id` string, required — The ID of the indicator
    - `created` string, date-time, required — The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.
    - `modified` string, date-time, required — The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.
    - `created_by_ref` string — Identifier of type identity
    - `revoked` boolean — The revoked property is only used by STIX Objects that support versioning and indicates whether the object has been revoked.
    - `labels` string[] — The labels property specifies a set of terms used to describe this object. The terms are user-defined or trust-group defined and their meaning is outside the scope of this specification and MAY be ignored.
    - `confidence` integer — Confidence that the creator has in the correctness of their data, where 100 is highest
    - `lang` string — The lang property identifies the language of the text content in this object. When present, it MUST be a language code conformant to [RFC5646]. If the property is not present, then the language of the content is en (English)
    - `external_references` ExternalReference[] — A list of external references which refer to non-STIX information. This property MAY be used to provide one or more Vulnerability identifiers, such as a CVE ID
      - `source_name` string, required — The name of the source that the external-reference is defined within
      - `description` string — A human readable description
      - `url` string — A URL reference to an external resource
      - `hashes` object — Specifies a dictionary of hashes for the contents of the url
      - `external_id` string — An identifier for the external reference content
    - `object_marking_refs` string[] — The object_marking_refs property specifies a list of id properties of marking-definition objects that apply to this object.
    - `granular_markings` GranularMarkingType[] — The granular_markings property specifies a list of granular markings applied to this object
      - `lang` string — The lang property identifies the language of the text identified by this marking
      - `marking_ref` string — The marking_ref property specifies the ID of the marking-definition object that describes the marking
      - `selectors` string[], required — The selectors property specifies a list of selectors for content contained within the STIX Object in which this property appears
    - `extensions` object — Specifies any extensions of the object, as a dictionary
    - `name` string — The name of the object
    - `description` string — A human readable description
    - `indicator_types` string[] — A set of categorizations for this indicator.
    - `pattern` string, required — The detection pattern for this Indicator expressed as a STIX patter.
    - `pattern_type` string, required — The type of pattern
    - `pattern_version` string — The version of the pattern language that is used for the data in the pattern property which MUST match the type of pattern data included in the pattern property.
    - `valid_from` string, date-time, required — The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.
    - `valid_until` string, date-time — The time at which this Indicator should no longer be considered a valid indicator of the behaviors it is related to or represents. If not set, a default TTL is applied based on indicator type and confidence. File hash indicators (type prefix `file:hashes`): 30/365/730 days for low/medium/high confidence. All other indicator types: 30/90/180 days for low/medium/high confidence. Confidence bands: low 0-49, medium 50-74, high 75-100.
    - `kill_chain_phases` KillChainPhase[] — The list of Kill Chain Phases for which this Attack Pattern is used
      - `kill_chain_name` string, required — The name of the kill chain. The value of this property SHOULD be all lowercase and SHOULD use hyphens instead of spaces or underscores as word separators
      - `phase_name` string — The name of the phase in the kill chain. The value of this property SHOULD be all lowercase and SHOULD use hyphens instead of spaces or underscores as word separators

## Response `200`

Stix indicators successfully uploaded.

- UploadStixIndicatorsResponse
  - `invalidIndicators` string[], required — A list of invalid indicator IDs that were not ingested

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.net/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.net/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/revisions/e4e4c7554890/schema)