add_threat_indicator
Add an indicator of compromise (IOC) such as IP, domain, or hash to the InsightIDR custom threat library for improved threat detection.
Instructions
Add a new IOC (IP, domain, hash, etc.) to the InsightIDR custom threat library
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for categorization | |
| type | Yes | Type of indicator | |
| value | Yes | Indicator value (e.g., '10.0.0.1', 'malware.example.com', SHA256 hash) | |
| severity | No | Severity level of the threat | MEDIUM |
| confidence | No | Confidence score (0-100) | |
| description | No | Description of why this indicator is malicious | |
| threat_name | No | Associated threat name or campaign |