---
title: "Uploads indicators in a Sumo normalized format."
method: POST
path: "/v1/threatIntel/datastore/indicators/normalized"
tags: ["threatIntelIngestProducer"]
---

# Uploads indicators in a Sumo normalized format.

`POST /v1/threatIntel/datastore/indicators/normalized`

Uploads a list indicators in a Sumo normalized format.

## Request body

- UploadNormalizedIndicatorRequest
  - `indicators` NormalizedIndicator[], required — The list of normalized threat intel indicators to upload.
    - `id` string, required — ID of the indicator
    - `indicator` string, required — Value of the indicator
    - `type` string, required — Type of indicator
    - `source` string, required — User-provided text to identify the source of the indicator
    - `updated` string, date-time — When this indicator was most recently updated in Sumo. Timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
    - `validFrom` string, date-time, required — Beginning time this indicator is valid. Timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
    - `validUntil` string, date-time — Time at which this indicator expires. If not set, a default TTL is applied based on indicator type and confidence. File hash indicators (type prefix `file:hashes`): 30/365/730 days for low/medium/high confidence. All other indicator types: 30/90/180 days for low/medium/high confidence. Confidence bands: low 0-49, medium 50-74, high 75-100. Timestamp in UTC in [RFC3339](https://tools.ietf.org/html/rfc3339) format.
    - `confidence` integer, required — Confidence that the creator has in the correctness of their data, where 100 is highest
    - `threatType` string, required — Type of indicator ( https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_cvhfwe3t9vuo )
    - `actors` string — Actors as a comma separated list.
    - `killChain` string — Kill Chain as a comma separated list.
    - `fields` object — Flattened fields from the original indicator object (e.g. flattened STIX fields)

## Response `204`

Normalized indicators successfully uploaded.

## Other responses

- `default` — Operation failed with an error.

---

[API](https://skmtc.dev/sumologic/apis/sumo-logic-api.md) · [All operations](https://skmtc.dev/sumologic/apis/sumo-logic-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sumologic/sumo-logic-api/revisions/88a343690a6e/schema)