Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Indicators

APIs for managing indicators

Search indicators

post

Search indicators by filter.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body

IndicatorFilter is a general filter that fetches entities using a query string query using the Query value

filterobjectquerystringOptional
fromDatestring · date-timeOptional
querystringOptional
sizeinteger · int64 · max: 10000Optional

Size is limited to 10000. If not specified, it defaults to 100.

Default: 100Example: 1000
timeFrameinteger · int64Optional

A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years.

toDatestring · date-timeOptional
Responses
200

indicatorResult

application/json
accountErrorsstring[]Optional
totalinteger · int64Optional
totalAccountsinteger · int64Optional
post/xsoar/public/v1/indicators/search
POST /xsoar/public/v1/indicators/search HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 804

{
  "filterobjectquery": "text",
  "firstSeen": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "timeFrame": 1,
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "fromDate": "2026-01-01T00:00:00.000Z",
  "lastSeen": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "timeFrame": 1,
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "period": {
    "by": "text",
    "byFrom": "text",
    "byTo": "text",
    "field": "text",
    "fromValue": "text",
    "toValue": "text"
  },
  "query": "text",
  "size": 1000,
  "sort": [
    {
      "asc": true,
      "field": "text",
      "fieldType": "text"
    }
  ],
  "timeFrame": 1,
  "toDate": "2026-01-01T00:00:00.000Z"
}
200

indicatorResult

{
  "accountErrors": [
    "text"
  ],
  "iocObjects": [
    {
      "CustomFields": {
        "ANY_ADDITIONAL_PROPERTY": {}
      },
      "account": "text",
      "aggregatedReliability": "text",
      "cacheVersn": 1,
      "calculatedTime": "2026-01-01T00:00:00.000Z",
      "comment": "text",
      "comments": [
        {
          "cacheVersn": 1,
          "category": "text",
          "content": "text",
          "created": "2026-01-01T00:00:00.000Z",
          "entryId": "text",
          "highlight": {
            "ANY_ADDITIONAL_PROPERTY": [
              "text"
            ]
          },
          "id": "text",
          "modified": "2026-01-01T00:00:00.000Z",
          "numericId": 1,
          "primaryTerm": 1,
          "sequenceNumber": 1,
          "sortValues": [
            "text"
          ],
          "source": "text",
          "syncHash": "text",
          "type": "text",
          "user": "text",
          "version": 1
        }
      ],
      "deletedFeedFetchTime": "2026-01-01T00:00:00.000Z",
      "expiration": "2026-01-01T00:00:00.000Z",
      "expirationSource": {
        "brand": "text",
        "expirationInterval": 1,
        "expirationPolicy": "text",
        "instance": "text",
        "moduleId": "text",
        "setTime": "2026-01-01T00:00:00.000Z",
        "source": "text",
        "user": "text"
      },
      "expirationStatus": "text",
      "firstSeen": "2026-01-01T00:00:00.000Z",
      "firstSeenEntryID": "text",
      "highlight": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "id": "text",
      "indicator_type": "text",
      "insightCache": {
        "cacheVersn": 1,
        "highlight": {
          "ANY_ADDITIONAL_PROPERTY": [
            "text"
          ]
        },
        "id": "text",
        "modified": "2026-01-01T00:00:00.000Z",
        "numericId": 1,
        "primaryTerm": 1,
        "scores": {
          "ANY_ADDITIONAL_PROPERTY": {
            "content": "text",
            "contentFormat": "text",
            "context": {
              "ANY_ADDITIONAL_PROPERTY": {}
            },
            "isTypedIndicator": true,
            "reliability": "text",
            "score": 1,
            "scoreChangeTimestamp": "2026-01-01T00:00:00.000Z",
            "timestamp": "2026-01-01T00:00:00.000Z",
            "type": "text"
          }
        },
        "sequenceNumber": 1,
        "sortValues": [
          "text"
        ],
        "syncHash": "text",
        "version": 1
      },
      "investigationIDs": [
        "text"
      ],
      "isDetectable": true,
      "isPreventable": true,
      "isShared": true,
      "lastReputationRun": "2026-01-01T00:00:00.000Z",
      "lastSeen": "2026-01-01T00:00:00.000Z",
      "lastSeenEntryID": "text",
      "manualExpirationTime": "2026-01-01T00:00:00.000Z",
      "manualScore": true,
      "manualSetTime": "2026-01-01T00:00:00.000Z",
      "manuallyEditedFields": [
        "text"
      ],
      "modified": "2026-01-01T00:00:00.000Z",
      "modifiedTime": "2026-01-01T00:00:00.000Z",
      "moduleToFeedMap": {
        "ANY_ADDITIONAL_PROPERTY": {
          "ExpirationSource": {
            "brand": "text",
            "expirationInterval": 1,
            "expirationPolicy": "text",
            "instance": "text",
            "moduleId": "text",
            "setTime": "2026-01-01T00:00:00.000Z",
            "source": "text",
            "user": "text"
          },
          "bypassExclusionList": true,
          "classifierId": "text",
          "classifierVersion": 1,
          "comments": [
            {
              "content": "text",
              "created": "2026-01-01T00:00:00.000Z",
              "id": "text",
              "user": "text"
            }
          ],
          "expirationInterval": 1,
          "expirationPolicy": "text",
          "fetchTime": "2026-01-01T00:00:00.000Z",
          "fields": {
            "ANY_ADDITIONAL_PROPERTY": {}
          },
          "isEnrichment": true,
          "mapperId": "text",
          "mapperVersion": 1,
          "modifiedTime": "2026-01-01T00:00:00.000Z",
          "moduleId": "text",
          "rawJSON": {
            "ANY_ADDITIONAL_PROPERTY": {}
          },
          "relationships": [
            {
              "brand": "text",
              "entityA": "text",
              "entityAFamily": "text",
              "entityAType": "text",
              "entityB": "text",
              "entityBFamily": "text",
              "entityBType": "text",
              "fields": {
                "ANY_ADDITIONAL_PROPERTY": {}
              },
              "id": "text",
              "instance": "text",
              "name": "text",
              "reliability": "text",
              "reverseName": "text",
              "startTime": "2026-01-01T00:00:00.000Z",
              "type": "text"
            }
          ],
          "reliability": "text",
          "score": 1,
          "sourceBrand": "text",
          "sourceInstance": "text",
          "timestamp": "2026-01-01T00:00:00.000Z",
          "type": "text",
          "value": "text"
        }
      },
      "numericId": 1,
      "primaryTerm": 1,
      "relatedIncCount": 1,
      "score": 1,
      "sequenceNumber": 1,
      "setBy": "text",
      "sortValues": [
        "text"
      ],
      "source": "text",
      "sourceBrands": [
        "text"
      ],
      "sourceInstances": [
        "text"
      ],
      "syncHash": "text",
      "timestamp": "2026-01-01T00:00:00.000Z",
      "value": "text",
      "version": 1
    }
  ],
  "total": 1,
  "totalAccounts": 1
}

Create an indicator exclusion list

post

Create or update an indicator exclusion list.

Body

WhitelistedIndicator Excluded indicator

createdstring · date-timeOptional
idstringOptional
lockedbooleanOptional
reasonstringOptional
reputationsstring[]Optional
typestringOptional
valuestringOptional
whitelistTimestring · date-timeOptional
Responses
200

OK

application/json

WhitelistedIndicator Excluded indicator

createdstring · date-timeOptional
idstringOptional
lockedbooleanOptional
reasonstringOptional
reputationsstring[]Optional
typestringOptional
valuestringOptional
whitelistTimestring · date-timeOptional
post/xsoar/public/v1/indicators/whitelist/update
POST /xsoar/public/v1/indicators/whitelist/update HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 27

{
  "value": "rocket_gDN0f9tn"
}
200

OK

{
  "id": "493d33e69ef049108be3409fb67bd35b",
  "version": 1,
  "cacheVersn": 0,
  "sequenceNumber": 41558902,
  "primaryTerm": 12,
  "modified": "2024-02-22T08:00:19.837638406Z",
  "sizeInBytes": 264,
  "value": "rocket_gDN0f9tn",
  "type": "standard",
  "user": "PAPIUser_3993",
  "reason": "",
  "whitelistTime": "2024-02-22T08:00:19.837622952Z",
  "locked": false,
  "reputations": null
}

Create a relationship between indicators

post

Create a relationship between indicators returned by specific search filters.

Body
IDsstring[]Optional
AllbooleanOptional
Responses
200

OK

application/json
updatedRelationshipsintegerOptional
totalRelationshipsintegerOptional
post/xsoar/public/v1/relationship
POST /xsoar/public/v1/relationship HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 469

{
  "IDs": [
    "c2382dff06a5a7cbba97fec8ebc77961"
  ],
  "All": false,
  "filter": {
    "page": 0,
    "size": 50,
    "query": " and -id:a20e618ace9d72d3d13d7fa18ade135f",
    "sort": [
      {
        "field": "calculatedTime",
        "asc": false
      }
    ],
    "period": {
      "by": "day",
      "fromValue": 7
    }
  },
  "relationship": {
    "entityA": "2.205.144.162",
    "entityAFamily": "Indicator",
    "entityAType": "IP",
    "name": "related-to",
    "reverseName": "related-to",
    "fields": {
      "firstseenbysource": "2023-12-18T10:09:44.701368Z",
      "lastseenbysource": "2023-12-18T10:09:44.701453Z"
    }
  }
}
200

OK

{
  "updatedRelationships": 305,
  "totalRelationships": 305
}

Batch delete indicators or add them to the exclusion list

post

Batch delete indicators or add them to the exclusion list. To delete indicators, set doNotWhitelist field to true. To add indicators to the exclusion list, set doNotWhitelist field to false.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
allbooleanOptional

Warning: When updating or deleting indicator in a batch, setting this field to true will inverse your request and apply the action to all indicators except for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the ids field, the action will be applied to all indicators. Setting this field to false will apply the action only on the indicators specified.

Default: false
columnsstring[]Optional
doNotWhitelistbooleanOptional

To delete a batch of indicators, set this to true.

idsstring[]Optional
reasonstringOptional
reputationsstring[]Optional
Responses
200

OK

application/json
notUpdatedinteger · int64Optional
updatedIdsstring[]Optional
uppdatedinteger · int64Optional
post/xsoar/public/v1/indicators/batchDelete
POST /xsoar/public/v1/indicators/batchDelete HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 113

{
  "doNotWhitelist": true,
  "ids": [
    "b3655bd7aad56513fcdacbd4254ed6b7",
    "79a290670239a8b19fb119b375f5dfa3"
  ],
  "filter": {}
}
200

OK

{
  "notUpdated": 1,
  "updatedIds": [
    "text"
  ],
  "uppdated": 1
}

Search for indicator relationships

post

Search for a relationship between two indicators. You can search by indicator value, time, or retrieve all indicator relationships.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
fromDatestringOptional
entitiesstring[]Optional
Responses
200

OK

application/json
totalintegerOptional
SearchAfterstring[]Optional
SearchBeforestring[]Optional
post/xsoar/public/v1/relationships/search
POST /xsoar/public/v1/relationships/search HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 42

{
  "fromDate": "2024-06-23T12:31:56.998186Z"
}
200

OK

{
  "ErrorsPrivateDoNotUse": null,
  "total": 1,
  "data": [
    {
      "id": "4c14fb81091bd6f5dbbe018bb0cc255f",
      "version": 1,
      "cacheVersn": 0,
      "sequenceNumber": 2132,
      "primaryTerm": 13,
      "modified": "2024-06-23T12: 31: 58.108344646Z",
      "sizeInBytes": 852,
      "sortValues": [
        "1719145918108",
        "4c14fb81091bd6f5dbbe018bb0cc255f"
      ],
      "CustomFields": {
        "firstseenbysource": "2024-06-23T12: 31: 51.196004Z",
        "lastseenbysource": "2024-06-23T12: 31: 51.196058Z"
      },
      "entityA": "211.155.197.40",
      "entityAFamily": "Indicator",
      "entityAType": "IP",
      "name": "related-to",
      "reverseName": "related-to",
      "entityB": "138.159.117.139",
      "entityBFamily": "Indicator",
      "entityBType": "IP",
      "type": "IndicatorToIndicator",
      "createdInSystem": "2024-06-23T12: 31: 58.108344197Z",
      "updatedInSystemBySource": "0001-01-01T00: 00: 00Z",
      "sources": [
        {
          "CustomFields": {
            "firstseenbysource": "2024-06-23T12: 31: 51.196004Z",
            "lastseenbysource": "2024-06-23T12: 31: 51.196058Z"
          },
          "createdInSystem": "2024-06-23T12: 31: 58.10772566Z",
          "updatedInSystem": "2024-06-23T12: 31: 58.10772566Z",
          "instance": "@",
          "isManual": true
        }
      ]
    }
  ],
  "SearchAfter": [
    "1719145918108",
    "4c14fb81091bd6f5dbbe018bb0cc255f"
  ],
  "SearchBefore": [
    "1719145918108",
    "4c14fb81091bd6f5dbbe018bb0cc255f"
  ]
}

Create an indicator

post

Create an indicator entity.

To update indicator custom fields, they should be in lowercase with all spaces removed. For example: "Scan IP" -> "scanip".

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
entryIdstringOptional
investigationIdstringOptional
manuallybooleanOptional
seenNowbooleanOptional
Responses
200

OK

application/json

IocObject - represents an Ioc (or simply an indicator) object

accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional

Do not set the fields bellow this line

commentstringOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
post/xsoar/public/v1/indicator/create
POST /xsoar/public/v1/indicator/create HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 136

{
  "indicator": {
    "indicator_type": "IP",
    "manuallyEditedFields": [
      "indicator_type"
    ],
    "value": "204.190.200.188"
  },
  "manually": true,
  "seenNow": true
}
200

OK

{
  "id": "7dfdd5a322a35b2f2784f94e95f478a9",
  "version": 1,
  "cacheVersn": 0,
  "modified": "0001-01-01T00:00:00Z",
  "sizeInBytes": 0,
  "comments": [
    {
      "id": "a41130da-24af-4aa0-89cd-52ed3acae6ac",
      "version": 0,
      "cacheVersn": 0,
      "modified": "0001-01-01T00:00:00Z",
      "sizeInBytes": 0,
      "content": "Created",
      "user": "PAPIUser_9028",
      "created": "2024-06-24T10:49:59.765912207Z",
      "type": "IndicatorCommentTimeLine",
      "source": "PAPIUser_9028",
      "entryId": "",
      "category": "Sighting"
    }
  ],
  "indicator_type": "IP",
  "value": "205.170.200.177",
  "lastSeen": "2024-06-24T10:49:59.765942327Z",
  "firstSeen": "2024-06-24T10:49:59.765942327Z",
  "lastSeenEntryID": "Manual",
  "firstSeenEntryID": "Manual",
  "score": 0,
  "expiration": "2024-07-01T10:49:59.765941318Z",
  "expirationStatus": "active",
  "expirationSource": {
    "setTime": "2024-06-24T10:49:59.765941318Z",
    "source": "indicatorType",
    "user": "",
    "brand": "",
    "instance": "",
    "moduleId": "",
    "expirationPolicy": "indicatorType",
    "expirationInterval": 10080
  },
  "manuallyEditedFields": [
    "indicator_type"
  ],
  "isDetectable": false,
  "isPreventable": false
}

Batch export indicators to CSV

post

Export a batch of indicators to a CSV file and receive the file ID in response. You can then use Get indicators as a CSV file to download the CSV file. You can define the columns as well as filter the indicators to be included in the CSV file.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body
allbooleanOptional

Warning: When updating or deleting indicator in a batch, setting this field to true will inverse your request and apply the action to all indicators except for the ones specified. If there are no indicators that match the filter settings or no indicators specified in the ids field, the action will be applied to all indicators. Setting this field to false will apply the action only on the indicators specified.

Default: false
columnsstring[]Optional
doNotWhitelistbooleanOptional

To delete a batch of indicators, set this to true.

idsstring[]Optional
reasonstringOptional
reputationsstring[]Optional
Responses
200

OK - returns the CSV filename.

application/json
stringOptional
post/xsoar/public/v1/indicators/batch/exportToCsv
POST /xsoar/public/v1/indicators/batch/exportToCsv HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 256

{
  "ids": [
    "3d8b6c2cad7900ce8dea531898e9e5fb",
    "23efd9dee6cd3bcc948f141885ceb0be"
  ],
  "all": false,
  "filter": {
    "page": 0,
    "size": 50,
    "query": "",
    "sort": [
      {
        "field": "id",
        "asc": false
      }
    ],
    "period": {
      "by": "day",
      "fromValue": 7
    }
  },
  "columns": [
    "id",
    "value",
    "score",
    "expirationStatus"
  ]
}
200

OK - returns the CSV filename.

{
  "indicators_report_Thu_15_Aug_2024_12_52_21_UTC.csv": null
}

Get a batch of indicators in a CSV file

get

Download the indicator details in a CSV file format after preparing it by calling the Batch export indicators to CSV API endpoint. The response of that call contains the prepared indicator report filename with a timestamp. Use that filename as the path parameter in this API endpoint to download the file.

Note: To use cURL to run this command, add the -O curl command for downloading a file to the current folder, or -o /my_custom_location/my_custom_name.csv to customize the destination of the downloaded file. For example:

curl "https://api-yourfqdn/xsoar/public/v1/indicators/csv/indicators_report_Mon_12_Aug_2024_10_06_04_UTC.csv" 
-H 'content-type: application/json' 
-H 'accept: application/json' 
-H "Authorization:$api_key" 
-H "x-xdr-auth-id:$api_key_id" 
-O
Path parameters
filenamestringRequired

Filename of the CSV file outputted by the "Batch export indicators to CSV" API call

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Responses
200

OK

application/json
filestring · binaryOptional

Example content of the CSV file:

"id,value,verdict,expirationStatus 9072e24d0da6620bf4ede78e5f990ddc,indicator_mZe0qZxl,Unknown,active 7dacf1c7866f34ac1b84711a5ddfd33c,indicator_u75KsXBB,Unknown,active "

get/xsoar/public/v1/indicators/csv/{filename}
GET /xsoar/public/v1/indicators/csv/{filename} HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Accept: */*
200

OK

{
  "file": "binary"
}

Create feed indicators from JSON

post

Create indicators from raw JSON (similar to ingesting from a feed). Builds indicators according to the specified feed classifier or uses the default one if not specified.

The following indicator properties can be used in the JSON to create indicators:

See the Table for POST /xsoar/public/v1/indicators/feed/json for more details.

Header parameters
authorizationstringRequired

api_key

Example: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-idstringRequired

api_key_id

Example: 2841
Body

FeedIndicatorsRequest is the input for JSON feed indicator ingestion

bypassExclusionListbooleanOptional
classifierIdstringOptional
mapperIdstringOptional
Responses
201

Indicators created

application/json
objectOptional
post/xsoar/public/v1/indicators/feed/json
POST /xsoar/public/v1/indicators/feed/json HTTP/1.1
Host: api-yourfqdn
authorization: DCdIeow0xm73EwnxjPza1tdHTfZQv2eH7bTKlTPkgBHLj8aSjFzjgTE9bQUK1DidlWLrnYRhaYQ4PCIyNrNJbMUC6DOWi8ANIn1JWpMTE2neGvoDIRsKUbj6pJ1z7Gmr
x-xdr-auth-id: 2841
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "indicators": [
    {
      "type": "Domain",
      "value": "domainname.com"
    }
  ]
}
201

Indicators created

{}

Edit indicator

post

Edit an indicator.

To update indicator custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body

IocObject - represents an Ioc (or simply an indicator) object

accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional

Do not set the fields bellow this line

commentstringOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
Responses
200

OK

application/json

IocObject - represents an Ioc (or simply an indicator) object

accountstringOptional
aggregatedReliabilitystringOptional
cacheVersninteger · int64Optional
calculatedTimestring · date-timeOptional

Do not set the fields bellow this line

commentstringOptional
deletedFeedFetchTimestring · date-timeOptional
expirationstring · date-timeOptional
expirationStatusstringOptional
firstSeenstring · date-timeOptional
firstSeenEntryIDstringOptional
idstringOptional
indicator_typestringOptional
investigationIDsstring[]Optional
isDetectablebooleanOptional
isPreventablebooleanOptional
isSharedbooleanOptional
lastReputationRunstring · date-timeOptional
lastSeenstring · date-timeOptional
lastSeenEntryIDstringOptional
manualExpirationTimestring · date-timeOptional
manualScorebooleanOptional
manualSetTimestring · date-timeOptional
manuallyEditedFieldsstring[]Optional
modifiedstring · date-timeOptional
modifiedTimestring · date-timeOptional
numericIdinteger · int64Optional
primaryTerminteger · int64Optional
relatedIncCountinteger · int64Optional
scoreinteger · int64Optional
sequenceNumberinteger · int64Optional
setBystringOptional
sortValuesstring[]Optional
sourcestringOptional
sourceBrandsstring[]Optional
sourceInstancesstring[]Optional
syncHashstringOptional
timestampstring · date-timeOptional
valuestringOptional
versioninteger · int64Optional
post/xsoar/public/v1/indicator/edit
POST /xsoar/public/v1/indicator/edit HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 915

{
  "id": "9388",
  "value": "test_indicator",
  "indicator_type": "Host",
  "investigationIDs": "None",
  "modifiedTime": "None",
  "created": "0001-01-01T00:00:00Z",
  "modified": "0001-01-01T00:00:00Z",
  "calculatedTime": "None",
  "score": 1,
  "manualScore": true,
  "enrichAfterSave": "None",
  "sourceInstances": "None",
  "moduleToFeedMap": "None",
  "CustomFields": {},
  "comments": [
    {
      "content": "Created",
      "id": "3c4185c1-b6c8-46c9-82ed-432ca724b4b3",
      "source": "admin",
      "category": "Sighting",
      "type": "IndicatorCommentTimeLine",
      "created": "2025-01-08T07:24:46.049963Z",
      "modified": "0001-01-01T00:00:00Z"
    }
  ],
  "expirationStatus": "active",
  "expirationSource": {
    "setTime": "2025-01-08T07:24:46.049993388Z",
    "source": "indicatorType",
    "user": "",
    "brand": "",
    "instance": "",
    "moduleId": "",
    "expirationPolicy": "never",
    "expirationInterval": 0
  },
  "relatedIncCount": "None",
  "manuallyEditedFields": [
    "indicator_type"
  ],
  "firstSeen": "2025-01-08T07:24:46.049994Z",
  "lastSeen": "2025-01-08T07:24:46.049994Z"
}
200

OK

{
  "id": "9388",
  "value": "test_indicator",
  "indicator_type": "Host",
  "investigationIDs": "None",
  "modifiedTime": "None",
  "created": "0001-01-01T00:00:00Z",
  "modified": "0001-01-01T00:00:00Z",
  "calculatedTime": "None",
  "score": 1,
  "manualScore": true,
  "enrichAfterSave": "None",
  "sourceInstances": "None",
  "moduleToFeedMap": "None",
  "CustomFields": {},
  "comments": [
    {
      "content": "Created",
      "id": "3c4185c1-b6c8-46c9-82ed-432ca724b4b3",
      "source": "admin",
      "category": "Sighting",
      "type": "IndicatorCommentTimeLine",
      "created": "2025-01-08T07:24:46.049963Z",
      "modified": "0001-01-01T00:00:00Z"
    }
  ],
  "expirationStatus": "active",
  "expirationSource": {
    "setTime": "2025-01-08T07:24:46.049993388Z",
    "source": "indicatorType",
    "user": "",
    "brand": "",
    "instance": "",
    "moduleId": "",
    "expirationPolicy": "never",
    "expirationInterval": 0
  },
  "relatedIncCount": "None",
  "manuallyEditedFields": [
    "indicator_type"
  ],
  "firstSeen": "2025-01-08T07:24:46.049994Z",
  "lastSeen": "2025-01-08T07:24:46.049994Z"
}
PreviousIncidents
NextIntegrations

Last updated

Was this helpful?