update_iocs_in_collection
Add or remove Indicators of Compromise (IOCs) like domains, files, IP addresses, or URLs in a Google Threat Intelligence collection to maintain current threat data.
Instructions
Updates (add or remove) Indicators of Compromise (IOCs) to a collection. Args: id (required): The ID of the collection to update. relationship (required): The type of relationship to add. Can be "domains", "files", "ip_addresses", or "urls". iocs (required): List of IOCs to add to the collection. For "urls", these are the full URLs. For other types, they are the identifiers (hashes for files, domain names for domains, etc.). operation (required): The operation to perform. Can be "add" or "remove".
Returns: A string indicating the success or failure of the operation.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| relationship | Yes | ||
| iocs | Yes | ||
| operation | Yes | ||
| api_key | No |