Indicators
APIs for managing indicators
Create an indicator entity To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip
Authorizations
AuthorizationstringRequired
Body
entryIdstringOptional
investigationIdstringOptional
manuallybooleanOptional
seenNowbooleanOptional
Responses
200
IocObject
application/json
IocObject - represents an Ioc (or simply an indicator) object
accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional
Do not set the fields bellow this line
commentstringOptional
createdstring · date-timeOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indexNamestringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
post/indicator/create
POST /indicator/create HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 3617
{
"entryId": "text",
"indicator": {
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
},
"investigationId": "text",
"manually": true,
"seenNow": true
}200
IocObject
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
}Edit an indicator entity To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip
Authorizations
AuthorizationstringRequired
Body
IocObject - represents an Ioc (or simply an indicator) object
accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional
Do not set the fields bellow this line
commentstringOptional
createdstring · date-timeOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indexNamestringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
Responses
200
IocObject
application/json
IocObject - represents an Ioc (or simply an indicator) object
accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional
Do not set the fields bellow this line
commentstringOptional
createdstring · date-timeOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indexNamestringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
post/indicator/edit
POST /indicator/edit HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 3530
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
}200
IocObject
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
}Whitelists or deletes an indicator entity In order to delete an indicator and not whitelist, set doNotWhitelist boolean field to true
Authorizations
AuthorizationstringRequired
Body
InvestigationIdstringOptional
doNotWhitelistbooleanOptional
entryIdstringOptional
manualScorebooleanOptional
reasonstringOptional
reputationinteger · int64Optional
reputationsstring[]Optional
valuestringOptional
Responses
200
UpdateResponse
application/json
notUpdatedinteger · int64Optional
updatedIdsstring[]Optional
uppdatedinteger · int64Optional
post/indicator/whitelist
POST /indicator/whitelist HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 153
{
"InvestigationId": "text",
"doNotWhitelist": true,
"entryId": "text",
"manualScore": true,
"reason": "text",
"reputation": 1,
"reputations": [
"text"
],
"value": "text"
}200
UpdateResponse
{
"notUpdated": 1,
"updatedIds": [
"text"
],
"uppdated": 1
}Exports an indicators batch to STIX file (returns file ID)
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
columnsstring[]Optional
doNotWhitelistbooleanOptional
idsstring[]Optional
reasonstringOptional
reputationsstring[]Optional
Responses
200
STIX file name
application/json
stringOptional
post/indicators/batch/export/stix
POST /indicators/batch/export/stix HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1434
{
"all": true,
"columns": [
"text"
],
"doNotWhitelist": true,
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"earlyTimeInPage": "2026-01-01T00:00:00.000Z",
"fields": [
"text"
],
"filterobjectquery": "text",
"firstSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"lastSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"laterTimeInPage": "2026-01-01T00:00:00.000Z",
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"prevPage": true,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
},
"ids": [
"text"
],
"reason": "text",
"reputations": [
"text"
]
}200
STIX file name
textExports an indicators batch to CSV file (returns file ID)
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
columnsstring[]Optional
doNotWhitelistbooleanOptional
idsstring[]Optional
reasonstringOptional
reputationsstring[]Optional
Responses
200
csv file name
application/json
stringOptional
post/indicators/batch/exportToCsv
POST /indicators/batch/exportToCsv HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1434
{
"all": true,
"columns": [
"text"
],
"doNotWhitelist": true,
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"earlyTimeInPage": "2026-01-01T00:00:00.000Z",
"fields": [
"text"
],
"filterobjectquery": "text",
"firstSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"lastSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"laterTimeInPage": "2026-01-01T00:00:00.000Z",
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"prevPage": true,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
},
"ids": [
"text"
],
"reason": "text",
"reputations": [
"text"
]
}200
csv file name
textBatch whitelist or delete indicators entities In order to delete indicators and not whitelist, set doNotWhitelist boolean field to true
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
columnsstring[]Optional
doNotWhitelistbooleanOptional
idsstring[]Optional
reasonstringOptional
reputationsstring[]Optional
Responses
200
UpdateResponse
application/json
notUpdatedinteger · int64Optional
updatedIdsstring[]Optional
uppdatedinteger · int64Optional
post/indicators/batchDelete
POST /indicators/batchDelete HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1434
{
"all": true,
"columns": [
"text"
],
"doNotWhitelist": true,
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"earlyTimeInPage": "2026-01-01T00:00:00.000Z",
"fields": [
"text"
],
"filterobjectquery": "text",
"firstSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"lastSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"laterTimeInPage": "2026-01-01T00:00:00.000Z",
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"prevPage": true,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
},
"ids": [
"text"
],
"reason": "text",
"reputations": [
"text"
]
}200
UpdateResponse
{
"notUpdated": 1,
"updatedIds": [
"text"
],
"uppdated": 1
}Get an indicators CSV file that was exported, by ID
Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired
CSV file to fetch (returned from batch export to csv call)
Responses
200
Return Csv file
No content
get/indicators/csv/{id}
GET /indicators/csv/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200
Return Csv file
No content
Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier, or uses the default one if not specified. Indicator properties (all optional except for value): value (string, required) | type (string) | score (number, 0-3, default 0, where 0 means None, 1 Good, 2 Suspicious, and 3 Bad) | sourceBrand (string, default "External") | sourceInstance (string, default "External") | reliability (string, one of "A - Completely reliable", "B - Usually reliable", "C - Fairly reliable", "D - Not usually reliable", "E - Unreliable", "F - Reliability cannot be judged") | expirationPolicy (string, one of "never", "interval", "indicatorType") | expirationInterval (number, in minutes)
Authorizations
AuthorizationstringRequired
Body
FeedIndicatorsRequest is the input for JSON feed indicator ingestion
bypassExclusionListbooleanOptional
classifierIdstringOptional
mapperIdstringOptional
Responses
201
Indicators created
No content
post/indicators/feed/json
POST /indicators/feed/json HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 114
{
"bypassExclusionList": true,
"classifierId": "text",
"indicators": [
{
"ANY_ADDITIONAL_PROPERTY": {}
}
],
"mapperId": "text"
}201
Indicators created
No content
Search indicators by filter
Authorizations
AuthorizationstringRequired
Body
IndicatorFilter is a general filter that fetches entities using a query string query using the Query value
earlyTimeInPagestring · date-timeOptional
fieldsstring[]Optional
filterobjectquerystringOptional
fromDatestring · date-timeOptional
fromDateLicensestring · date-timeOptional
ignoreWorkersbooleanOptional
Do not use workers mechanism while searching bleve
laterTimeInPagestring · date-timeOptional
pageinteger · int64Optional
0-based page
prevPagebooleanOptional
MT support - these fields are for indicator search according to calculatedTime
querystringOptional
searchAfterstring[]Optional
Efficient next page, pass max sort value from previous page
searchAfterElasticstring[]Optional
Efficient next page, pass max ES sort value from previous page
searchBeforestring[]Optional
Efficient prev page, pass min sort value from next page
searchBeforeElasticstring[]Optional
Efficient prev page, pass min ES sort value from next page
sizeinteger · int64Optional
Size is limited to 1000, if not passed it defaults to 0, and no results will return
timeFrameinteger · int64Optional
A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.
toDatestring · date-timeOptional
trim_eventsinteger · int64Optional
Responses
200
indicatorResult
application/json
accountErrorsstring[]Optional
totalinteger · int64Optional
totalAccountsinteger · int64Optional
post/indicators/search
POST /indicators/search HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1317
{
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"earlyTimeInPage": "2026-01-01T00:00:00.000Z",
"fields": [
"text"
],
"filterobjectquery": "text",
"firstSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"lastSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"laterTimeInPage": "2026-01-01T00:00:00.000Z",
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"prevPage": true,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
}200
indicatorResult
{
"accountErrors": [
"text"
],
"iocObjects": [
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
}
],
"total": 1,
"totalAccounts": 1
}Get an indicators STIX V2 file that was exported, by ID
Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired
STIX V2 file to fetch (returned from batch export to STIX call)
Responses
200
Return STIX V2 file
No content
get/indicators/stix/v2/{id}
GET /indicators/stix/v2/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200
Return STIX V2 file
No content
Delete indicators timeline by filter
Authorizations
AuthorizationstringRequired
Body
IndicatorFilter is a general filter that fetches entities using a query string query using the Query value
earlyTimeInPagestring · date-timeOptional
fieldsstring[]Optional
filterobjectquerystringOptional
fromDatestring · date-timeOptional
fromDateLicensestring · date-timeOptional
ignoreWorkersbooleanOptional
Do not use workers mechanism while searching bleve
laterTimeInPagestring · date-timeOptional
pageinteger · int64Optional
0-based page
prevPagebooleanOptional
MT support - these fields are for indicator search according to calculatedTime
querystringOptional
searchAfterstring[]Optional
Efficient next page, pass max sort value from previous page
searchAfterElasticstring[]Optional
Efficient next page, pass max ES sort value from previous page
searchBeforestring[]Optional
Efficient prev page, pass min sort value from next page
searchBeforeElasticstring[]Optional
Efficient prev page, pass min ES sort value from next page
sizeinteger · int64Optional
Size is limited to 1000, if not passed it defaults to 0, and no results will return
timeFrameinteger · int64Optional
A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.
toDatestring · date-timeOptional
trim_eventsinteger · int64Optional
Responses
200
IndicatorEditBulkResponse
application/json
totalinteger · uint64Optional
updatedinteger · uint64Optional
post/indicators/timeline/delete
POST /indicators/timeline/delete HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1317
{
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"earlyTimeInPage": "2026-01-01T00:00:00.000Z",
"fields": [
"text"
],
"filterobjectquery": "text",
"firstSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"ignoreWorkers": true,
"lastSeen": {
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z"
},
"laterTimeInPage": "2026-01-01T00:00:00.000Z",
"page": 1,
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"prevPage": true,
"query": "text",
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"timeFrame": 1,
"toDate": "2026-01-01T00:00:00.000Z",
"trim_events": 1
}200
IndicatorEditBulkResponse
{
"total": 1,
"updated": 1
}Create indicators from a file
Authorizations
AuthorizationstringRequired
Body
fileNamestringOptional
file name
filestringOptional
file
Responses
200
IocObjects
application/json
IocObject - represents an Ioc (or simply an indicator) object
accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional
Do not set the fields bellow this line
commentstringOptional
createdstring · date-timeOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indexNamestringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
post/indicators/upload
POST /indicators/upload HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 33
{
"fileName": "text",
"file": "text"
}200
IocObjects
[
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"account": "text",
"aggregatedReliability": "text",
"cacheVersn": 1,
"calculatedTime": "2026-01-01T00:00:00.000Z",
"comment": "text",
"comments": [
{
"cacheVersn": 1,
"category": "text",
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"entryId": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"syncHash": "text",
"type": "text",
"user": "text",
"version": 1
}
],
"created": "2026-01-01T00:00:00.000Z",
"deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
"expiration": "2026-01-01T00:00:00.000Z",
"expirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"expirationStatus": "text",
"firstSeen": "2026-01-01T00:00:00.000Z",
"firstSeenEntryID": "text",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"indicator_type": "text",
"insightCache": {
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"scores": {
"ANY_ADDITIONAL_PROPERTY": {
"content": "text",
"contentFormat": "text",
"context": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isTypedIndicator": true,
"reliability": "text",
"score": 1,
"scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text"
}
},
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"version": 1
},
"investigationIDs": [
"text"
],
"isDetectable": true,
"isPreventable": true,
"isShared": true,
"lastReputationRun": "2026-01-01T00:00:00.000Z",
"lastSeen": "2026-01-01T00:00:00.000Z",
"lastSeenEntryID": "text",
"manualExpirationTime": "2026-01-01T00:00:00.000Z",
"manualScore": true,
"manualSetTime": "2026-01-01T00:00:00.000Z",
"manuallyEditedFields": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleToFeedMap": {
"ANY_ADDITIONAL_PROPERTY": {
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
},
"numericId": 1,
"primaryTerm": 1,
"relatedIncCount": 1,
"score": 1,
"sequenceNumber": 1,
"setBy": "text",
"sizeInBytes": 1,
"sortValues": [
"text"
],
"source": "text",
"sourceBrands": [
"text"
],
"sourceInstances": [
"text"
],
"syncHash": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"value": "text",
"version": 1
}
]Create or update excluded indicators list
Authorizations
AuthorizationstringRequired
Body
WhitelistedIndicator Excluded indicator
cacheVersninteger · int64Optional
createdstring · date-timeOptional
idstringOptional
indexNamestringOptional
lockedbooleanOptional
modifiedstring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
reasonstringOptional
reputationsstring[]Optional
sequenceNumberinteger · int64Optional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
typestringOptional
userstringOptional
valuestringOptional
versioninteger · int64Optional
whitelistTimestring · date-timeOptional
Responses
200
WhitelistedIndicator
application/json
WhitelistedIndicator Excluded indicator
cacheVersninteger · int64Optional
createdstring · date-timeOptional
idstringOptional
indexNamestringOptional
lockedbooleanOptional
modifiedstring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
reasonstringOptional
reputationsstring[]Optional
sequenceNumberinteger · int64Optional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
typestringOptional
userstringOptional
valuestringOptional
versioninteger · int64Optional
whitelistTimestring · date-timeOptional
post/indicators/whitelist/update
POST /indicators/whitelist/update HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 427
{
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"reason": "text",
"reputations": [
"text"
],
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"type": "text",
"user": "text",
"value": "text",
"version": 1,
"whitelistTime": "2026-01-01T00:00:00.000Z"
}200
WhitelistedIndicator
{
"cacheVersn": 1,
"created": "2026-01-01T00:00:00.000Z",
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"primaryTerm": 1,
"reason": "text",
"reputations": [
"text"
],
"sequenceNumber": 1,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"type": "text",
"user": "text",
"value": "text",
"version": 1,
"whitelistTime": "2026-01-01T00:00:00.000Z"
}Last updated
Was this helpful?