AZazure

Upload Structured Threat Information Expression (STIX) objects to the workspace

Changed on

Upload an array of Structured Threat Information Expression (STIX) objects to the workspace specified

post/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload

Request

  • Base URL
    https://api.ti.sentinel.azure.com
  • URL
    https://api.ti.sentinel.azure.com/workspaces/{workspaceId}/threat-intelligence-stix-objects:upload
  • Auth
    OAuth 2
    Implicit: https://login.microsoftonline.com/common/oauth2/authorize
    Scopes: user_impersonation

Path parameters

workspaceIdstring uuid required

The workspace ID for the STIX objects to be uploaded.

Query parameters

api-versionstring required

The api-version for operation

Request body

sourcesystemstring

Source of the STIX objects to be uploaded. Source system name cannot be Microsoft Sentinel. Maximum length is 256 characters.

stixobjectsJsonPropertyBag[]

The stixobjects param is an array of STIX objects. STIX objects need to be in STIX format. We only support STIX 2.0 and 2.1 format.

Response

The API returns 200 when at least one STIX object is successfully validated and published.

Changes