---
title: "Updates existing IOC Set"
method: PATCH
path: "/threatintel/v1/ioc-sets/{iocsetid}"
tags: ["Threat Intel"]
---

# Updates existing IOC Set

`PATCH /threatintel/v1/ioc-sets/{iocsetid}`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc-sets/{iocsetid}`
- Auth: API key in header `Authorization`

Allows you to update the details of the existing IOC Sets and also to add new IOCs to IOC Sets.

## Path parameters

- `iocsetid` integer, required

## Request body

- UpdateIocSetRequestBody: UpdateIocSetRequestBody is the request structure to handle IOC set create request
  - `description` string: IOC Set description.
  - `iocs` string[]: IOCs that needs to be added in IOC set
  - `name` string: Name of the IOC Set.
  - `source` string: Source of IOC Set.

## Response `200`

IOC Set updated successfully.

- IOCSetResponse: IOCSetResponse is the response structure of successful ioc create request
  - `countAdded` integer: Number of IOCs that got added in IOC set.
  - `countDuplicate` integer: Number of IOCs that were duplicate and not added to IOC set.
  - `countSkipped` integer: Number of IOCs that were invalid and not added to IOC set.
  - `countTotal` integer: Total number of IOCs that were provided by administrator.
  - `iocSetID` integer: Unique ID of the IOC set.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)