Ingest Indicators from TruSTAR
Updated 2 weeks ago
by
Sachit Soni
Use this API command to query TruSTAR Enclaves for Indicators and return the information. The indicators can be individual indicators or contained within an Intelligence Report.
Search Indicators
GET/1.3/indicators/search
Description: Searches for all indicators that contain the given search term. If no search term is provided, the search will filter on other (optional) parameters, from and to dates, Enclave, and tags. Results are ordered by last seen time, descending.
Notes
The integration must include a configuration page where the user can define the following:
- One or more Enclave IDs to query for the indicators. TruSTAR suggests naming this field Observable Ingest Enclave IDs. If no Enclave IDs are specified, the commands will search all Enclaves that the user has access to in TruSTAR.
