THthreatconnect
Indicators

Create Indicator

Changed on

Allows the creation of a new Indicator

post/v3/indicators

Request

  • Base URL
    https://app.threatconnect.com/api
  • URL
    https://app.threatconnect.com/api/v3/indicators
  • Auth
    API key in header Authorization

Query parameters

fieldsstring[]

Indicator subentity fields to include in response (See OPTIONS endpoint for valid values)

createActivityLogstring

Boolean to signal whether or not to create an alert for this action

Request body

idinteger
dateAddedstring date-time
ownerIdinteger
ownerNamestring
webLinkstring
typestring required
lastModifiedstring date-time
externalDateAddedstring date-time
externalLastModifiedstring date-time
externalDateExpiresstring date-time
firstSeenstring date-time
lastSeenstring date-time
ratingnumber
confidenceinteger
threatAssessRatingnumber double
threatAssessConfidencenumber double
threatAssessScoreinteger
threatAssessScoreObservedinteger
threatAssessScoreFalsePositiveinteger
calScoreinteger
calLastCheckedstring date-time
sourcestring
descriptionstring
summarystring
observationsinteger
lastObservedstring date-time
falsePositivesinteger
lastFalsePositivestring date-time
falsePositiveReportedByUserboolean
falsePositiveFlagboolean
trackedUsersobject
privateFlagboolean
activeboolean
activeLockedboolean
value1string
value2string
value3string
flag1boolean
flag2boolean
flag3boolean
intValue1integer
intValue2integer
intValue3integer
addressstring
md5string
sha1string
sha256string
sizeinteger
modestring
ipstring
hostNamestring
dnsActiveboolean
whoisActiveboolean
textstring
legacyLinkstring

Response

The new Indicator

idinteger
dateAddedstring date-time
ownerIdinteger
ownerNamestring
webLinkstring
typestring required
lastModifiedstring date-time
externalDateAddedstring date-time
externalLastModifiedstring date-time
externalDateExpiresstring date-time
firstSeenstring date-time
lastSeenstring date-time
ratingnumber
confidenceinteger
threatAssessRatingnumber double
threatAssessConfidencenumber double
threatAssessScoreinteger
threatAssessScoreObservedinteger
threatAssessScoreFalsePositiveinteger
calScoreinteger
calLastCheckedstring date-time
sourcestring
descriptionstring
summarystring
observationsinteger
lastObservedstring date-time
falsePositivesinteger
lastFalsePositivestring date-time
falsePositiveReportedByUserboolean
falsePositiveFlagboolean
trackedUsersobject
privateFlagboolean
activeboolean
activeLockedboolean
value1string
value2string
value3string
flag1boolean
flag2boolean
flag3boolean
intValue1integer
intValue2integer
intValue3integer
addressstring
md5string
sha1string
sha256string
sizeinteger
modestring
ipstring
hostNamestring
dnsActiveboolean
whoisActiveboolean
textstring
legacyLinkstring

Changes

  • 726ab3792601Revision changes
    • info

      added the new optional request property

    • info

      added the optional property to the response with the status