Add or update indicators in a private intel feed
upsert_customer_intel_itemsBulk upsert up to 100 indicators into a private feed, enabling IOC extraction from reports and adding them to MagicSword via MCP.
Instructions
Bulk upserts up to 100 indicators into a private feed. This is the MCP path for “extract IOCs from this report and add them to MagicSword.” Requires intel:write.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| items | Yes | Indicators to upsert | |
| feed_id | Yes | Private feed UUID |