---
title: "List Threat Intel Feed"
method: POST
path: "/threat-intel-feed/get-list"
tags: ["Threat Intel Feed"]
---

# List Threat Intel Feed

`POST /threat-intel-feed/get-list`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/threat-intel-feed/get-list`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/threat-intel-feed/get-list/post.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to list all Threat Intel Feed items

## Request body

- object
  - `query` ThreatIntelFeedQuerySchema: Query schema for ThreatIntelFeed. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"<relation>": {"<field>": <value or Search>}}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}.
    - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `name` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `description` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `feedType` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `apiRootUrl` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `listUrl` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `indicatorConfidence` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween.
      - number
      - object
        - `_type` 'EqualTo', required
        - `value` number, required
      - object
        - `_type` 'NotEqual', required
        - `value` number, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` number, required
      - object
        - `_type` 'GreaterThan', required
        - `value` number, required
      - object
        - `_type` 'LessThan', required
        - `value` number, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'InBetween', required
        - `startValue` number, required
        - `endValue` number, required
    - `securityEventConnectionId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `collectionId` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `basicAuthUsername` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `isEnabled` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull.
      - boolean
      - object
        - `_type` 'EqualTo', required
        - `value` boolean, required
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` boolean, required
    - `pollIntervalInMinutes` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween.
      - number
      - object
        - `_type` 'EqualTo', required
        - `value` number, required
      - object
        - `_type` 'NotEqual', required
        - `value` number, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` number, required
      - object
        - `_type` 'GreaterThan', required
        - `value` number, required
      - object
        - `_type` 'LessThan', required
        - `value` number, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'InBetween', required
        - `startValue` number, required
        - `endValue` number, required
    - `minimumConfidence` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween.
      - number
      - object
        - `_type` 'EqualTo', required
        - `value` number, required
      - object
        - `_type` 'NotEqual', required
        - `value` number, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` number, required
      - object
        - `_type` 'GreaterThan', required
        - `value` number, required
      - object
        - `_type` 'LessThan', required
        - `value` number, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` number, required
      - object
        - `_type` 'InBetween', required
        - `startValue` number, required
        - `endValue` number, required
    - `shouldCreateAlert` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull.
      - boolean
      - object
        - `_type` 'EqualTo', required
        - `value` boolean, required
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` boolean, required
    - `shouldWriteDetectionFinding` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull.
      - boolean
      - object
        - `_type` 'EqualTo', required
        - `value` boolean, required
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` boolean, required
    - `shouldCreateIncident` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull.
      - boolean
      - object
        - `_type` 'EqualTo', required
        - `value` boolean, required
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` boolean, required
    - `shouldCreateCase` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull.
      - boolean
      - object
        - `_type` 'EqualTo', required
        - `value` boolean, required
      - object
        - `_type` 'NotEqual', required
        - `value` boolean, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` boolean, required
    - `alertSeverityId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `incidentSeverityId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `lastPolledAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `cursor` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `nextPageToken` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `lastPollSummary` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `lastError` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `lastEvaluatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `lastMatchAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z.
      - string, date-time
      - object
        - `_type` 'EqualTo', required
        - `value` string, date-time, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThan', required
        - `value` string, date-time, required
      - object
        - `_type` 'GreaterThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'LessThanOrEqual', required
        - `value` string, date-time, required
      - object
        - `_type` 'InBetween', required
        - `startValue` string, date-time, required
        - `endValue` string, date-time, required
    - `lastMatchError` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes.
      - string
      - object
        - `_type` 'EqualTo', required
        - `value` string, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, required
      - object
        - `_type` 'Search', required
        - `value` string, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `createdByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
    - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes.
      - string, uuid
      - object
        - `_type` 'EqualTo', required
        - `value` string, uuid, required
      - object
        - `_type` 'NotEqual', required
        - `value` string, uuid, required
      - object
        - `_type` 'IsNull', required
      - object
        - `_type` 'NotNull', required
      - object
        - `_type` 'EqualToOrNull', required
        - `value` string, uuid, required
      - object
        - `_type` 'Includes', required
        - `value` string[], required
  - `select` ThreatIntelFeedSelectSchema: Select schema for ThreatIntelFeed. Set fields to true to include them in the response.
    - `_id` boolean
    - `createdAt` boolean
    - `updatedAt` boolean
    - `deletedAt` boolean
    - `projectId` boolean
    - `name` boolean
    - `description` boolean
    - `feedType` boolean
    - `apiRootUrl` boolean
    - `listUrl` boolean
    - `indicatorConfidence` boolean
    - `securityEventConnectionId` boolean
    - `collectionId` boolean
    - `basicAuthUsername` boolean
    - `isEnabled` boolean
    - `pollIntervalInMinutes` boolean
    - `minimumConfidence` boolean
    - `shouldCreateAlert` boolean
    - `shouldWriteDetectionFinding` boolean
    - `shouldCreateIncident` boolean
    - `shouldCreateCase` boolean
    - `alertSeverityId` boolean
    - `incidentSeverityId` boolean
    - `lastPolledAt` boolean
    - `cursor` boolean
    - `nextPageToken` boolean
    - `lastPollSummary` boolean
    - `lastError` boolean
    - `lastEvaluatedAt` boolean
    - `lastMatchAt` boolean
    - `lastMatchError` boolean
    - `createdByUserId` boolean
    - `deletedByUserId` boolean
  - `sort` ThreatIntelFeedSortSchema: Sort schema for ThreatIntelFeed. Only sortable fields are included.
    - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `name` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `description` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `feedType` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `apiRootUrl` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `listUrl` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `indicatorConfidence` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `securityEventConnectionId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `collectionId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `basicAuthUsername` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `isEnabled` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `pollIntervalInMinutes` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `minimumConfidence` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `shouldCreateAlert` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `shouldWriteDetectionFinding` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `shouldCreateIncident` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `shouldCreateCase` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `alertSeverityId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `incidentSeverityId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastPolledAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `cursor` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `nextPageToken` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastPollSummary` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastError` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastEvaluatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastMatchAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `lastMatchError` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `createdByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
    - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending).
  - `limit` number: Maximum number of items to return. Defaults to 10.
  - `skip` number: Number of items to skip for pagination. Defaults to 0.

## Response `200`

Successful response

- object
  - `data` ThreatIntelFeed[]
    - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `version` number: Object version
    - `projectId` string, uuid, required: ID of the project this feed belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `name` string, required: Friendly name for this feed, e.g. 'Corporate MISP'. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `description` string: What this feed carries and why it is subscribed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `feedType` 'taxii' | 'list' | 'google-secops', required: Where the indicators come from: a TAXII 2.1 collection (taxii), a list at an https address (list) or Google SecOps (google-secops). Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `apiRootUrl` string: The TAXII 2.1 API root, e.g. https://taxii.example.com/api1/. Collections are addressed beneath it. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `listUrl` string: For a list feed: the https address of the list, one IP address, domain, URL or file hash a line. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `indicatorConfidence` number: For a list feed: how sure the list is, 1 to 100, given to each of its indicators. It sets the severity of a match. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `securityEventConnectionId` string, uuid: For a Google SecOps feed: the ID of the connection whose key reads Google SecOps's indicator matches. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `collectionId` string: ID of the TAXII collection to poll for indicator objects. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `basicAuthUsername` string: Username for basic-auth collections. Leave empty for anonymous or token-authenticated collections. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `isEnabled` boolean, required: Whether this feed is polled and matched. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `pollIntervalInMinutes` number, required: How often the collection is polled for new indicators. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `minimumConfidence` number, required: Skip indicators whose STIX confidence is below this (0-100). 0 ingests everything; indicators that carry no confidence always pass. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `shouldCreateAlert` boolean, required: Whether indicator matches open OneUptime alerts. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `shouldWriteDetectionFinding` boolean, required: Whether matches also write a Detection Finding security event back into the events table. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `shouldCreateIncident` boolean, required: Whether matches also open OneUptime incidents. Off by default: incidents drive on-call, SLAs and status pages, so opt in per feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `shouldCreateCase` boolean, required: Whether matches open security cases (or join the open case about the same entity), where the security team works them and playbooks respond. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `alertSeverityId` string, uuid: ID of the alert severity for alerts opened by this feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `incidentSeverityId` string, uuid: ID of the incident severity for incidents opened by this feed. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Threat Intel Feed], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Threat Intel Feed]
    - `lastPolledAt` object: When this feed was last polled. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `cursor` string: Poll cursor: for a TAXII feed the added_after timestamp already ingested, for a list feed the hash of the list last written and when, for a Google SecOps feed the end of the window last read. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `nextPageToken` string: Resume token for a poll that ended mid-pagination on a server that sends no X-TAXII-Date-Added-Last header. Cleared once the collection drains or the cursor advances. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `lastPollSummary` string: What the most recent successful poll did: objects fetched, indicators ingested, unsupported patterns skipped. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `lastError` string: The most recent poll error, if any. Cleared on the next successful poll. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `lastEvaluatedAt` object: When the matcher last evaluated security events against this feed's indicators. Null means it has never run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `lastMatchAt` object: When this feed's indicators most recently matched security events. Null means they never have. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `lastMatchError` string: The most recent matcher error, if any. Cleared on the next successful evaluation. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `createdByUserId` string, uuid: ID of the user who created this feed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
    - `deletedByUserId` string, uuid: ID of the user who deleted this feed. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Threat Intel Feed], Update: [No access - you don't have permission for this operation]
  - `count` number

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)