update_iocs_in_collection
Update a collection by adding or removing Indicators of Compromise (IOCs). Specify the collection ID, IOC type, list of IOCs, and whether to add or remove.
Instructions
Updates (add or remove) Indicators of Compromise (IOCs) to a collection. Args: id (required): The ID of the collection to update. relationship (required): The type of relationship to add. Can be "domains", "files", "ip_addresses", or "urls". iocs (required): List of IOCs to add to the collection. For "urls", these are the full URLs. For other types, they are the identifiers (hashes for files, domain names for domains, etc.). operation (required): The operation to perform. Can be "add" or "remove".
Returns: A string indicating the success or failure of the operation.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| iocs | Yes | ||
| operation | Yes | ||
| relationship | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |