Add or update a custom IOC file request

Adds or updates custom IOC files on the Central Management System for Network Security appliances only.

POST https://<address>/wsapis/[v1.2.0|v2.0.0]/customIOC/feed/add

Availability

This command is available on the following appliances:

Central Management System

Required headers:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]
Accept: application/json
Content-Type: multipart/form-data
filename: [File-Path]

Body:

feedName: [Feed-Name]
feedType: [Feed-Type]
feedAction: [Feed-Action]
feedSource: [Feed-Source]
overwrite: [Overwrite]

Parameters

cm_address—The IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix . For more information about the client token, contact your sales representative.
File-Path—Name and path to the file containing IP addresses, URLs, domain names, or hash values.
Feed-Name—Name of the new feed or name of an existing feed.
Feed-Type—Type of feed. Valid values are ip, url, domain, and hash.
Feed-Action—Type of notification to receive if a match is found.
Feed-Source—Source of feed.
Overwrite—If you are creating a new feed, this value is false. If you are updating an existing feed, this value is true.

Example request for adding a custom IOC file

POST https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/customioc/feed/add

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: BigDataInc
Accept: application/json
Content-Type: multipart/form-data
filename: @/home/fireeye/newfeed.txt

Request Body:

feedName: testFeed
feedType: url
feedAction: alert
feedSource: SIEM
overwrite: false

Example request for updating a custom IOC file

POST https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/customioc/feed/add

Request headers:

X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-FeClient-Token: AcmeInc
Accept: application/json
Content-Type: multipart/form-data
filename: /users/c/tmp/existingfeed.txt

Request Body:

feedName: sampleFeed
feedType: ip
feedAction: alert
feedSource: thirdparty
overwrite: true

Add or update a custom IOC file response

After the request is received, the Central Management System appliance validates the API token and sends a response code and message.

HTTP/1.1 [Response Code] [Response Message]

Date: [Date]

Response fields

Response Code—A standard HTML response code.
- 200—Request successful.
- 400—Request unsuccessful because the feed name already exists.
- 500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
- OK—Request successful.
- Error while adding feed—Request unsuccessful because the feed name already exists.
- Internal Server Error—Request unsuccessful because the server encountered a problem.
Date—Standard HTML date format.

Example

HTTP/1.1 200 OK
Date: Fri, 17 Nov 2017 08:00:00 GMT

cURL code sample: add a custom IOC file

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSkH --no-progress-bar https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/customioc/feed/add ' -X 'POST -H "Content-Type: multipart/form-data" --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" --header "Accept: application/json" -F "filename=@/cygdrive/c/cygwin/test_feeds/FLAT_IP_list.feed" -F "feed_data={\"feedName\":\"sampleFeed\", \"feedType\":\"ip\", \"feedAction\":\"alert\", \"feedSource\":\"SIEM\",\"overwrite\":\"false\"}"

This cURL sample includes the following options:

-q—This option specifies that the curlrc configuration file will not be read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
-H—This option allows you to specify a custom header with the --header switch.
--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.
https://xxx.xxx.xxx.xxx:443/wsapis/v2.0.0/customioc/feed/add—The custom IOCs request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.
-X 'POST'—This option specifies using the POST method.
-H "Content-Type: multipart/form-data"—This option encodes the data as a multipart form.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header includes the API-Token that was returned by your appliance during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token in the sample with the token received in the response to your authentication request.
--header "Accept: application/json"—This header specifies that the serverʼs response body is expected to be in JSON format.
-F "filename=@/cygdrive/c/cygwin/test_feeds/FLAT_IP_list.feed"—This option includes the FLAT_IP_list.feed file as an attachment to the message body.
Note
This example assumes you are using a Windows PC and referencing the following file name and location: C:\cygwin\test_feeds\FLAT_IP_list.feed. The file location /cygdrive/c/cygwin/test_feeds/FLAT_IP_list.feed is the Cygwin-defined POSIX-equivalent location and file.

-F "feed_data={\"feedName\":\"sampleFeed\", \"feedType\":\"ip\", \"feedAction\":\"alert\", \"feedSource\":\"SIEM\",\"overwrite\":\"false\"}"—This set of options defines the parameters for the custom IOCs file. For more information, see Parameters .

Results

This example creates a new feed of IP addresses. When a match is found, the user is sent an alert.