IOCs
APIs for managing IOCs
Upload IOCs in CSV format that you retrieved from external threat intelligence sources.
Note: Cortex XDR does not scan historic data, but rather only new incoming data.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM
{api_key}
{api_key_id}
The body of this request contains a JSON object with a single field: request_data. This field is required. Its value is as string containing two or more comma-separated lines. The first line must contain the CSV header. All subsequent lines must represent IOC data. Each line must include at a minimum the required CSV fields, which are identified below. To help you validate the upload, you can send a separate validate field to view an array of errors with an unsuccessful call.
For the complete list of supported fields, see Insert CSV Fields.
Indicates whether to return an array of errors in the case of an unsuccessful update indicator API request.
SUCCESS
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/indicators/insert_csv HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 430
{
"request_data": "indicator,type,severity,expiration_date, comment,reputation,reliability,class,vendor.name,vendor.reputation, vendor.reliability\n B2c74bf609159f27dd89a829501ec34d6596d8b39a2cce7add73a8207088817a, HASH,HIGH,1587054895000,This is an example IOC,BAD,D,Malware,IBM, GOOD,B\n A2c74bf609159f27dd89a829501ec34d6596d8b39a2cce7add73a8207088817a, HASH,LOW,1587054895000,This is an example IOC,GOOD,D,Malware,PANW, BAD,A\n"
}{
"reply": {
"success": false,
"validation_errors": [
{
"indicator": "testtest.com",
"error": "Got type: HASH, Indicator: testtest.com mismatch"
}
]
}
}Upload IOCs as JSON objects that you retrieved from external threat intelligence sources.
Note: Cortex XSIAM does not scan historic data, rather only new incoming data.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM
{api_key}
{api_key_id}
Whether to return an array of errors in the case of an unsuccessful update indicator API request.
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/indicators/insert_jsons HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 306
{
"request_data": [
{
"indicator": "<hash_value>",
"type": "HASH",
"severity": "MEDIUM",
"comment": "test",
"reputation": "GOOD",
"reliability": "D",
"vendors": [
{
"vendor_name": "V1",
"reliability": "A",
"reputation": "GOOD"
},
{
"vendor_name": "V2",
"reliability": "A",
"reputation": "SUSPICIOUS"
}
],
"class": "Malware"
}
],
"validate": true
}{
"reply": {
"success": true,
"validation_errors": [
{
"indicator": "testtest.com",
"error": "Got type: HASH, Indicator: testtest.com mismatch"
}
]
}
}Get a list of IOCs. You can return all IOCs or filter results. You can also return extended results with all details included.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is >100.
Offset is the zero-based number of incidents from the start of the result set.
UI navigation: CORTEX > Threat Management > Detection Rules > IOC.
You must have Rules Edit permissions to run this endpoint.
{api_key}
{api_key_id}
OK
Bad Request. Got invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/indicators/get HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 103
{
"request_data": {
"extended_view": false,
"filters": [
{
"field": "indicator",
"operator": "IN",
"value": [
57
]
}
]
}
}{
"objects_count": 1,
"objects": [
{
"rule_id": 57,
"indicator": "virus1.exe",
"type": "FILENAME",
"severity": "SEV_040_HIGH",
"expiration_date": -1,
"comment": "test"
}
],
"objects_type": "indicator"
}Insert new IOCs or update existing IOCs.
Note: The IOC rule_id is tenant specific and can't be used across tenants. Inserting IOCs with the same rule_id as an existing IOC on that tenant will overwrite the existing IOC.
Requires the granular RBAC permission for this feature.
{api_key}
{api_key_id}
OK
List of errors, if any.
Bad Request. Got invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/indicators/insert HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 386
{
"request_data": [
{
"indicator": "virus1.exe",
"type": "FILENAME",
"severity": "SEV_040_HIGH",
"expiration_date": 1234567891234,
"default_expiration_enabled": false,
"comment": "test",
"reputation": "GOOD",
"reliability": "A"
},
{
"indicator": "test.exe",
"type": "FILENAME",
"severity": "SEV_030_MEDIUM",
"expiration_date": 1234567891234,
"default_expiration_enabled": true,
"reputation": "GOOD",
"reliability": "B"
}
]
}{
"added_objects": [
{
"id": 69,
"status": "Created a new IOC rule with the ID: 69 successfully"
}
],
"updated_objects": [
{
"id": 57,
"status": "Updated the IOC rule with the indicator: 'virus1.exe' successfully"
}
],
"errors": []
}Delete IOCs selected by filter.
Requires the granular RBAC permission for this feature.
{api_key}
{api_key_id}
OK
Bad Request. Got invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/indicators/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 101
{
"request_data": {
"extended_view": false,
"filters": [
{
"field": "indicator",
"operator": "EQ",
"value": 57
}
]
}
}{
"objects_count": 1,
"objects": [
57
]
}Last updated
Was this helpful?