Import Observables from STIX files

To import STIX compatible threat data (observables) into ThreatStream.

Request

/api/v1/stix_import/

HTTP Method: POST

Attributes: See the table below

Attributes

Attribute	Type	Description
classification	string	Classification of the observable—public or private.
confidence	string	Confidence score that you (the source) want to assign to an imported observable based on the level of confidence you have about the maliciousness of the observable. Confidence scores range from 0-100, in increasing order of confidence.
file	string	Path and name of the file from which the observables will be imported.
is_anonymous	boolean	Whether you want to anonymize your organization and user information. Users outside of your organization with access to the observables will see "Analyst" in all fields that would otherwise display an organization or user name. True—if you want to anonymize organization information False—if you do not want to anonymize your organization information
tags	string	Tags applied to the imported observables. Tags must be specified as follows: tags: [{"name": "my_tag","tlp": "red"},{"name": "my_tag2","tlp": "clear"},{"name": "my_tag3"}] Tag Attributes: name—name of the tag that you want to add. tlp—the visibility setting for the tag. Possible values: red, amber, amber+strict, green, clear. red—private, or visible to your organization only. white—public, or visible to all ThreatStream users with access to the data. Default: white. Note: Adding public tags may be restricted by your Organization Administrator. In the example above, my_tag is private and my_tag2 and my_tag3 are public.
trustedcircles	integer	ID of the trusted circle to which this threat data should be imported. If you want to import the threat data to multiple trusted circles, enter the list of comma-separated IDs. Tip: To find the ID of a trusted circle, locate the trusted circle on ThreatStream, click on its name. The URL displayed in the address bar shows the ID. For example, https://ui.threatstream.com/search?trustedcircles=13.

Importing STIX 2.1-Compatible Wildcard Patterns

ThreatStream supports STIX 2.1-compatible wildcard patterns for domain and URL observables. Wildcard observables allow you to represent multiple related observables using a single pattern instead of maintaining large numbers of similar entries. You can import wildcard domains and URLs into ThreatStream using an XML or JSON file.

To learn more about wildcard observables, see Wildcard Observables.

Examples

1. To import observables from a STIX compatible file:

   Copy

   curl -X POST 'https://api.threatstream.com/api/v1/stix_import/' -F “file=@<filepath>/<filename>" -F “classification=private" -F 'tags=[{"name":"my_tag", "tlp":"red"}]' -F "confidence=60" -H 'Authorization: apikey <username>:<api_key>'

2. To import observables and share them with trusted circles whose ids are 1 and 2:

   Copy

   curl -X POST 'https://api.threatstream.com/api/v1/stix_import/' -F “file=@<filepath>/<filename>" -F “classification=private" -F 'tags=[{"name":"my_tag", "tlp":"red"}]' -F "confidence=60" -F "trustedcircles=1,2" -H 'Authorization: apikey <username>:<api_key>'