Examples of using the API to POST and PATCH IoCs
In this example an IOC is being pushed using POST to add an URL indicator, www.dubya.com, to an API plugin created and named DW. It has 2 tags associated with it that were already in the tenant - “test_tag” and “test_tag2”. If adding multiple tags, they must each be in their own open and close quotation marks, separated by a comma.
If you wish to POST IoC with tags, you need to create the tags ahead of time, either via the GUI or API.
 |
To update an IoC with new data, use PATCH. In the example below, the IoC has had its reputation increased from 5 to 7.
 |
Note that there are no additional tags added in this example.
Tags can be removed in the GUI or via the API using the remove command issued with a PATCH to endpoint api/cte/indicators/bulk. In the example below, the tag “abc” is removed from indicator "b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa".
 |