Class ThreatIntelligenceApi

addSTIXThreatIntel

• addSTIXThreatIntel(param: ThreatIntelligenceApiAddSTIXThreatIntelRequest, options?: Configuration): Promise<STIXIngestResponse>

• Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes.

  Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the unsupported counter. Patterns that cannot be parsed increment the invalid counter. Processing is best effort, so valid supported indicators in the same bundle are still added.

  A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported.

  Parameters

  • param: ThreatIntelligenceApiAddSTIXThreatIntelRequest

    The request object

  • Optional options: Configuration

  Returns Promise<STIXIngestResponse>