Skip to main content

​
Overview

Allows the client to add open intelligence about an endpoint.

​
HTTP request

POST /Agent/Intelligence/Add

​
Authentication

Requires a valid JWT bearer token.

​
Request (JSON)

{
	"Information":
	{
		"endpoint": Required(Str(PEndpoint)),
		"expires": Required(DateTime(PExpires>Now)),
	    "vector": Optional(Str(PVector)),
		"protocol": Optional(Str(PProtocol)),
		"classification": Optional(Str(PClassification)),
		"code": Optional(Str(PCode)),
		"message": Optional(Str(PMessage)),
		"Tag":Optional(
		{
			"name": Required(Str(PTagName)),
		    "value": Required(Str(PTagValue)),
			"type": Optional(Str(PTagType))
		}[]),
		"AgentProperty":Optional(
		{
			"name": Required(Str(PAgentPropertyName))
		}[])
	}
}

​
Input parameters

ParameterDescription
PEndpointThe endpoint to which the information refers. It can be an IP endpoint, XMPP endpoint, etc. Format depends on the protocol used.
PExpiresWhen the information will be purged from the record.
PVectorA string representing the threat vector.
PProtocolA string representing the protocol used.
PClassificationA string representing a classification of the information.
PCodeA machine-readable string-valued code representing the message or type of information added.
PMessageA human readable message.
PTagNameName of information meta-tag associated with the information.
PTagValueValue of information meta-tag associated with the information.
PTagTypeXML data type of information (with prefix xs:). If recognized by the system, the corresponding string-valued tag value will be parsed and stored in parsed format for improved interoperability.
PAgentPropertyNameNamed of Agent property that will be stored with the information, together with the corresponding agent identity value (if one exists) of the agent user adding the intelligence. Adding agent information adds recipients decide wether to trust the information or not.

​
Response (JSON)

{
	"objectId": Required(Str(PObjectId))
}

​
Response parameters

ParameterDescription
PObjectIdA Globally Unique ID (GUID) representing the information.

​
Notes

This endpoint uses the request schema notation described in Pattern matching.