Detections

Submit detected IOCs to the Collective Insights

This operation sends a list of indicators of compromise (IOC) detections to Collective Insights. Submissions are associated with the API key's enterprise and are used to provide enhanced intelligence and analytics specific to your enterprise.

For each submitted detection the ioc data and a detection.type must be set. All other values are optional.

Note that all submissions of test data (for example during development) must use the options.debug property set to true.

post/detections

Request

Base URL
https://api.recordedfuture.com/collective-insights
URL
https://api.recordedfuture.com/collective-insights/detections
Auth
- API key in header X-RFToken
- or OAuth 2
  Authorization code: https://id.recordedfuture.com/authorize
  Token URL: https://id.recordedfuture.com/token

Request body

organization_idsstring[]

A list of organizations to associate the submission with. The user making the request must be a member of every organization provided

Example request

{
  "data": [
    {
      "detection": {
        "type": "detection_rule"
      },
      "incident": {
        "id": "28548e09-63e8-4f8b-abd4-be86207b1583",
        "name": "Triggered Detection Rule",
        "type": "splunk-detection-rule"
      },
      "ioc": {
        "field": "dstip",
        "source_type": "netscreen:firewall",
        "type": "ip",
        "value": "1.2.3.4"
      },
      "malwares": [
        "Stuxnet"
      ],
      "mitre_codes": [
        "T1055"
      ],
      "timestamp": "2023-01-01T10:00:00Z"
    }
  ],
  "options": {
    "summary": true
  },
  "organization_ids": [
    "uhash:T2j9Lac3k1"
  ]
}

Response

Example response

{
  "result": {
    "object_ids": [
      "16046941d44a85e4748a9e9a",
      "16046941d44a85e4748a9e9b",
      "16046941d44a85e4748a9e9c"
    ],
    "status": "OK",
    "summary": {
      "dropped": [
        {
          "index": 3,
          "ioc_value": "aaaaa",
          "message": "Invalid hash: aaaaa",
          "reason": "INVALID_IOC",
          "transient_id": "79104EXAMPLEA723"
        }
      ],
      "processed": {
        "ip": 1
      }
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.