---
title: "Ingest STIX threat intelligence"
method: POST
path: "/api/v2/security/threat-intel/stix"
tags: ["Threat Intelligence"]
---

# Ingest STIX threat intelligence

`POST /api/v2/security/threat-intel/stix`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/threat-intel/stix`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security/threat-intel/stix/post.ts> (a function with typed inputs; its response is checked against the schema)

Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes.

Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the `unsupported` counter. Patterns that cannot be parsed increment the `invalid` counter. Processing is best effort, so valid supported indicators in the same bundle are still added.

A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported.

## Headers

- `ti_vendor` string, required
- `Content-Encoding` 'gzip': The content encoding applied to the request body.

## Request body

- STIXBundleRequest: A STIX 2.1 bundle containing threat intelligence indicator objects.
  - `id` string, required: The STIX bundle identifier.
  - `objects` STIXObject[], required: The STIX objects included in the bundle. Indicator objects are processed and ingested; all other STIX object types are ignored and are not included in the response counters.
    - `confidence` integer: The confidence in the correctness of the indicator, from 0 through 100.
    - `created` string, date-time: The time when the object was created.
    - `external_references` STIXMetadataObject[]: Optional external reference metadata preserved with the indicator but not interpreted during ingestion.
    - `id` string, required: The STIX object identifier.
    - `indicator_types` string[]: The open vocabulary terms that categorize the indicator.
    - `kill_chain_phases` STIXMetadataObject[]: Optional kill chain metadata preserved with the indicator but not interpreted during ingestion.
    - `labels` string[]: Labels associated with the indicator.
    - `modified` string, date-time: The time when the object was last modified.
    - `object_marking_refs` string[]: References to marking definition objects that apply to the indicator.
    - `pattern` string: The STIX pattern that identifies the observable. Present on indicator objects.
    - `pattern_type` 'stix': The supported STIX pattern language.
    - `revoked` boolean: Whether the indicator has been revoked.
    - `spec_version` string: The STIX specification version declared on the object. Objects with an unsupported version are accepted and counted in the `unsupported` response counter.
    - `type` string, required: The STIX object type.
    - `valid_from` string, date-time: The time from which the indicator is considered valid. Present on indicator objects.
    - `valid_until` string, date-time: The time until which the indicator is considered valid.
  - `spec_version` '2.1': The supported STIX specification version.
  - `type` 'bundle', required: The STIX object type for a bundle.

## Response `200`

OK

- STIXIngestResponse: The response from a completed STIX ingestion request.
  - `data` STIXIngestResponseData, required: The JSON:API resource describing the completed STIX ingestion request.
    - `attributes` STIXIngestResponseAttributes, required: Counters describing the result of the STIX ingestion request.
      - `accepted` integer, required: The number of supported indicators accepted.
      - `invalid` integer, required: The number of indicators with patterns that could not be parsed.
      - `unsupported` integer, required: The number of indicator objects with an unsupported STIX version or a pattern that produced no supported observable values.
    - `id` string, required: The normalized vendor identifier.
    - `type` 'threat-intel-stix-ingest', required: The STIX ingestion resource type.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `413`: The request body exceeds 50 MB as received or 100 MB after decompression.
- `429`: Too many requests
- `502`: The STIX ingestion service returned an error while processing the request.
- `503`: The STIX ingestion service is temporarily unavailable.

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)