--- title: "Get Threat Intel Feed" method: POST path: "/threat-intel-feed/{id}/get-item" tags: ["Threat Intel Feed"] --- # Get Threat Intel Feed `POST /threat-intel-feed/{id}/get-item` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/threat-intel-feed/{id}/get-item` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to retrieve a single Threat Intel Feed by ID ## Path parameters - `id` string, uuid, required ## Request body - object - `select` ThreatIntelFeedSelectSchema: Select schema for ThreatIntelFeed. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `name` boolean - `description` boolean - `feedType` boolean - `apiRootUrl` boolean - `listUrl` boolean - `indicatorConfidence` boolean - `securityEventConnectionId` boolean - `collectionId` boolean - `basicAuthUsername` boolean - `isEnabled` boolean - `pollIntervalInMinutes` boolean - `minimumConfidence` boolean - `shouldCreateAlert` boolean - `shouldWriteDetectionFinding` boolean - `shouldCreateIncident` boolean - `shouldCreateCase` boolean - `alertSeverityId` boolean - `incidentSeverityId` boolean - `lastPolledAt` boolean - `cursor` boolean - `nextPageToken` boolean - `lastPollSummary` boolean - `lastError` boolean - `lastEvaluatedAt` boolean - `lastMatchAt` boolean - `lastMatchError` boolean - `createdByUserId` boolean - `deletedByUserId` boolean ## Response `200` Successful response - object - `data` ThreatIntelFeed - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this feed belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `name` string, required: Friendly name for this feed, e.g. 'Corporate MISP'. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `description` string: What this feed carries and why it is subscribed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `feedType` 'taxii' | 'list' | 'google-secops', required: Where the indicators come from: a TAXII 2.1 collection (taxii), a list at an https address (list) or Google SecOps (google-secops). Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `apiRootUrl` string: The TAXII 2.1 API root, e.g. https://taxii.example.com/api1/. Collections are addressed beneath it. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `listUrl` string: For a list feed: the https address of the list, one IP address, domain, URL or file hash a line. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `indicatorConfidence` number: For a list feed: how sure the list is, 1 to 100, given to each of its indicators. It sets the severity of a match. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `securityEventConnectionId` string, uuid: For a Google SecOps feed: the ID of the connection whose key reads Google SecOps's indicator matches. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `collectionId` string: ID of the TAXII collection to poll for indicator objects. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `basicAuthUsername` string: Username for basic-auth collections. Leave empty for anonymous or token-authenticated collections. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `isEnabled` boolean, required: Whether this feed is polled and matched. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `pollIntervalInMinutes` number, required: How often the collection is polled for new indicators. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `minimumConfidence` number, required: Skip indicators whose STIX confidence is below this (0-100). 0 ingests everything; indicators that carry no confidence always pass. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `shouldCreateAlert` boolean, required: Whether indicator matches open OneUptime alerts. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `shouldWriteDetectionFinding` boolean, required: Whether matches also write a Detection Finding security event back into the events table. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `shouldCreateIncident` boolean, required: Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `shouldCreateCase` boolean, required: Whether matches open security cases (or join the open case about the same entity), where the security team works them and playbooks respond. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `alertSeverityId` string, uuid: ID of the alert severity for alerts opened by this feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `incidentSeverityId` string, uuid: ID of the incident severity for incidents opened by this feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed] - `lastPolledAt` object: When this feed was last polled. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `cursor` string: Poll cursor: for a TAXII feed the added_after timestamp already ingested, for a list feed the hash of the list last written and when, for a Google SecOps feed the end of the window last read. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `nextPageToken` string: Resume token for a poll that ended mid-pagination on a server that sends no X-TAXII-Date-Added-Last header. Cleared once the collection drains or the cursor advances. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `lastPollSummary` string: What the most recent successful poll did: objects fetched, indicators ingested, unsupported patterns skipped. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `lastError` string: The most recent poll error, if any. Cleared on the next successful poll. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `lastEvaluatedAt` object: When the matcher last evaluated security events against this feed's indicators. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `lastMatchAt` object: When this feed's indicators most recently matched security events. Null means they never have. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `lastMatchError` string: The most recent matcher error, if any. Cleared on the next successful evaluation. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the user who created this feed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the user who deleted this feed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)