Adds a new intel feed.
Structure of intel
{
"name" : "IntelFeed123",
"intel_class" : "black-list | white-list"
"intel_type" : "ip | url | domain | md5 | sha256",
"action" : "block | alert", --> (relevant for BL only)
"signature_name" : "My.Malware.Binary", (optional), default=feed name orentry-level name
"permission" : "readonly | readwrite" (optional), default=readwrite
"comment" : "test_comment"
}
POST https://<host>/wsapis/v2.0.0/intel
Sample curl request
curl -gsk -H 'Content-Type: multipart/form-data' -F filename=@ip_feed.txt -F 'options={"name":"IPFeed1", "intel_type":"ip","comment":"test comment" ,"intel_class":"black-list","action":"block", "signature_name":"malware.binary"}' https://<host>/wsapis/v2.0.0/intel
Authentication
Standard WSAPI authentication
Request mime type
multipart/form-data
Response
HTTP OK with JSON, containing the uuid of the intel created
{"uuid" : "<uuid>"}Error JSON with displayable message