---
title: "Creates a new IOC Set"
method: POST
path: "/threatintel/v1/ioc-sets"
tags: ["Threat Intel"]
---

# Creates a new IOC Set

`POST /threatintel/v1/ioc-sets`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc-sets`
- Auth: API key in header `Authorization`

Creates a new IOC Set.

## Request body

- CreateIOCSetRequestBody
  - `description` string: IOC set description.
  - `iocType` 'hash' | 'ext', required: IOc set type, can be either hash / extension.
  - `iocs` string[], required: IOCs that needs to be added in IOC set.
  - `name` string, required: IOC set name
  - `source` string: Source of IOC set.

## Response `200`

IOC Set created successfully.

- IOCSetResponse: IOCSetResponse is the response structure of successful ioc create request
  - `countAdded` integer: Number of IOCs that got added in IOC set.
  - `countDuplicate` integer: Number of IOCs that were duplicate and not added to IOC set.
  - `countSkipped` integer: Number of IOCs that were invalid and not added to IOC set.
  - `countTotal` integer: Total number of IOCs that were provided by administrator.
  - `iocSetID` integer: Unique ID of the IOC set.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)