List, attach, or detach intel feeds on a policy
manage_policy_intel_sourcesList, attach, or detach global or customer-owned intel feeds on a policy's current version, so you can control which threat intelligence sources apply to endpoints.
Instructions
Lists, attaches, or detaches global/customer-owned intel feeds on a policy current version. Customer feeds only affect endpoints in that org with the feed attached. List requires policies:read; attach/detach require policies:write.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| policy_id | Yes | ||
| source_id | No | Source ID for detach | |
| source_ids | No | One or more source IDs for attach |