indicators_insert_jsons
Insert IOCs from external threat intelligence as JSON objects into Cortex XSIAM to enrich security monitoring with hash, IP, domain, and filename indicators.
Instructions
Insert Simple Indicators, JSON
Upload IOCs as JSON objects that you retrieved from external threat intelligence sources.
Note: Cortex XSIAM does not scan historic data, rather only new incoming data.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/indicators/insert_jsons] · Rules
Example request body:
{
"request_data": [
{
"indicator": "<hash_value>",
"type": "HASH",
"comment": "test",
"reputation": "GOOD",
"reliability": "D",
"vendors": [
{
"vendor_name": "V1",
"reliability": "A",
"reputation": "GOOD"
},
{
"vendor_name": "V2",
"reliability": "A",
"reputation": "SUSPICIOUS"
}
],
"class": "Malware"
}
],
"validate": true
}Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| validate | No | Whether to return an array of errors in the case of an unsuccessful update indicator API request. | |
| request_data | Yes |