add_threat_indicator
Add an indicator of compromise (IOC) such as IP, domain, or hash to the InsightIDR custom threat library for improved threat detection.
Instructions
Add a new IOC (IP, domain, hash, etc.) to the InsightIDR custom threat library
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"type": "<type>",
"value": "<value>"
},
"name": "add_threat_indicator"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| type | Yes | Type of indicator | |
| value | Yes | Indicator value (e.g., '10.0.0.1', 'malware.example.com', SHA256 hash) | |
| severity | No | Severity level of the threat | MEDIUM |
| confidence | No | Confidence score (0-100) | |
| description | No | Description of why this indicator is malicious | |
| threat_name | No | Associated threat name or campaign |