Create Threat Intelligence Feed - Cloud Security API

{"type":"api","title":"Create Threat Intelligence Feed","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/83e8a10367d157243cd1c3e478b807cb81262a3d/9c9cc32c-275c-3119-8ff5-3eceac33f676","info":{"title":"Cisco Secure Access Threat Intelligence Feeds API","version":"1.0.0","description":"Create and manage the integration of STIX-TAXII threat intelligence feeds in Secure Access.","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Integrations","description":"Integration management"},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/admin/threat-intelligence-feeds-overview.md","uri":"secure-access-api-reference-threat-intelligence-feeds-overview"}},"openapi":"3.0.3","servers":[{"url":"https://api.sse.cisco.com/{basePath}","variables":{"basePath":{"default":"admin/v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"The client credential flow.","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"admin.integrations.threatfeeds:read":"Read threat intelligence feeds","admin.integrations.threatfeeds:write":"Create, update, or delete threat intelligence feeds"}}}}}},"spec":{"operationId":"createFeed","summary":"Create Threat Intelligence Feed","description":"Create a new active polling job. The job will be immediately scheduled based on the polling interval.\n**Polling Interval Options:**\n- Option 1: `polling_interval`\n- Option 2: `polling_interval_value` and `polling_interval_unit` (e.g., 5 + \"minutes\")","security":[{"oauthFlow":["admin.integrations.threatfeeds:write"]}],"tags":["Integrations","Secure Access"],"requestBody":{"required":true,"description":"The properties used to create the threat intelligence feed.","content":{"application/json":{"schema":{"type":"object","description":"The properties of the threat intelligence feed.","required":["customer_id","discovery_url","root_url","collection_name","collection_id","auth_type","credentials"],"properties":{"customer_id":{"type":"string","description":"The identifier of the customer or tenant.","example":"12345a","$$ref":"#/components/schemas/customer_id"},"discovery_url":{"type":"string","format":"uri","description":"The discovery URL for the TAXII service.\nThe discovery URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.1.","example":"https://limo.anomali.com/taxii2/","$$ref":"#/components/schemas/discovery_url"},"root_url":{"type":"string","format":"uri","description":"The root URL for the TAXII API.\nThe root URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.2.","example":"https://limo.anomali.com/api1/","$$ref":"#/components/schemas/root_url"},"collection_name":{"type":"string","description":"The name of the collection provided by the threat intelligence feed.","example":"Indicators","$$ref":"#/components/schemas/collection_name"},"collection_id":{"type":"string","format":"uuid","pattern":"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$","description":"The unique ID (UUID) of the TAXII collection.\nThe collection ID must be a valid UUID v4 as specified in the \nTAXII standard v2.1 Section 5.2.1.","example":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","$$ref":"#/components/schemas/collection_id"},"auth_type":{"type":"string","enum":["basic","bearer","api_key"],"description":"The authentication method used with the threat intelligence feed.","example":"basic","$$ref":"#/components/schemas/auth_type"},"credentials":{"type":"object","description":"The properties of the credentials used to authenticate with the threat intelligence feed.","properties":{"username":{"type":"string","description":"The username on the account for the threat intelligence feed.","nullable":true},"password":{"type":"string","description":"The password on the account for the threat intelligence feed.","format":"password","nullable":true},"token":{"type":"string","description":"The access token on the account for the threat intelligence feed.","nullable":true},"api_key":{"type":"string","description":"The API key on the account for the threat intelligence feed.","nullable":true}},"$$ref":"#/components/schemas/credentials"},"polling_interval":{"type":"string","nullable":true,"description":"The cron expression for the polling schedule.","example":"*/30 * * * *","$$ref":"#/components/schemas/polling_interval"},"polling_interval_value":{"type":"integer","nullable":true,"minimum":1,"description":"The numeric value of the `polling interval`.","example":30,"$$ref":"#/components/schemas/polling_interval_value"},"polling_interval_unit":{"type":"string","nullable":true,"enum":["minutes","hours","days"],"description":"The unit of time for the `polling_interval_value`.\nConstraints: minutes (1-59), hours (1-23), days (1-31).","example":"minutes","$$ref":"#/components/schemas/polling_interval_unit"},"window_duration":{"type":"integer","description":"The number of seconds that represents the polling window.","example":300,"$$ref":"#/components/schemas/window_duration"}},"example":{"customer_id":"customer123","discovery_url":"https://limo.anomali.com/taxii2/","root_url":"https://limo.anomali.com/api1/","collection_name":"Indicators","collection_id":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","auth_type":"basic","credentials":{"username":"user","password":"secret"},"polling_interval_value":5,"polling_interval_unit":"minutes","window_duration":300}}}},"$$ref":"#/components/requestBodies/createFeedRequest"},"responses":{"201":{"description":"Created","content":{"application/json":{"schema":{"type":"object","description":"The properties used to create the threat intelligence feed.","required":["job_id","customer_id","state","feed_vendor"],"properties":{"job_id":{"type":"string","description":"The unique identifier of the job.","example":"0000303900000000000001a4","$$ref":"#/components/schemas/job_id"},"customer_id":{"type":"string","description":"The identifier of the customer or tenant.","example":"12345a","$$ref":"#/components/schemas/customer_id"},"discovery_url":{"type":"string","format":"uri","description":"The discovery URL for the TAXII service.\nThe discovery URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.1.","example":"https://limo.anomali.com/taxii2/","$$ref":"#/components/schemas/discovery_url"},"root_url":{"type":"string","format":"uri","description":"The root URL for the TAXII API.\nThe root URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.2.","example":"https://limo.anomali.com/api1/","$$ref":"#/components/schemas/root_url"},"collection_name":{"type":"string","description":"The name of the collection provided by the threat intelligence feed.","example":"Indicators","$$ref":"#/components/schemas/collection_name"},"collection_id":{"type":"string","format":"uuid","pattern":"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$","description":"The unique ID (UUID) of the TAXII collection.\nThe collection ID must be a valid UUID v4 as specified in the \nTAXII standard v2.1 Section 5.2.1.","example":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","$$ref":"#/components/schemas/collection_id"},"auth_id":{"type":"string","description":"The identifier of the encrypted credentials.","$$ref":"#/components/schemas/auth_id"},"polling_interval":{"type":"string","nullable":true,"description":"The cron expression for the polling schedule.","example":"*/30 * * * *","$$ref":"#/components/schemas/polling_interval"},"window_duration":{"type":"integer","description":"The number of seconds that represents the polling window.","example":300,"$$ref":"#/components/schemas/window_duration"},"max_content_length":{"type":"integer"},"feed_vendor":{"type":"string","description":"The name of the vendor that provides the threat intelligence feed.","example":"Anomali","$$ref":"#/components/schemas/feed_vendor"},"state":{"type":"string","description":"The state of a threat intelligence feed job.","enum":["draft","active","paused","disabled"],"example":"active","$$ref":"#/components/schemas/state"},"created_at":{"type":"string","format":"date-time","description":"The date and time when the system created the threat intelligence feed.\nTimestamp created using the ISO 8601 format with UTC timezone.","example":"2026-01-04T15:30:00.000000Z","$$ref":"#/components/schemas/created_at"},"updated_at":{"type":"string","format":"date-time","description":"The date and time when the system updated the threat intelligence feed.\nTimestamp created using the ISO 8601 format with UTC timezone.","example":"2026-01-04T16:45:00.000000Z","$$ref":"#/components/schemas/updated_at"}},"example":{"job_id":"0000303900000000000001a4","customer_id":"customer123","discovery_url":"https://limo.anomali.com/taxii2/","root_url":"https://limo.anomali.com/api1/","collection_name":"Indicators","collection_id":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","polling_interval":"*/5 * * * *","window_duration":300,"feed_vendor":"anomali","state":"active","created_at":"2026-01-04T15:30:00.000000Z","updated_at":"2026-01-04T15:30:00.000000Z"},"$$ref":"#/components/schemas/createFeedResponse"}}}},"400":{"description":"Bad Request","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The date and time (ISO 8601-formatted timestamp) when the system returned the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","properties":{"error_id":{"type":"string","description":"Error message explaining the reason for failure.","example":"Forbidden"},"http_status":{"type":"integer","description":"The HTTP status code returned in the response.","example":403}}},"examples":{"example_one":{"summary":"Bad Request","value":{"title":"Bad Request","description":"Invalid discovery URL format","http_status":400,"error_id":"err-20260310-a1b2c3d4","error_code":"VALIDATION_ERROR"}},"invalidRequest":{"summary":"Bad request","value":{"title":"Bad Request","description":"Invalid job definition","http_status":400,"error_id":"err-20260310-a1b2c3d4","error_code":"VALIDATION_ERROR"}},"vendorLimit":{"summary":"Vendor limit exceeded","value":{"title":"Vendor Limit Exceeded","description":"Maximum 5 active jobs allowed for vendor 'pulsedive'","http_status":400,"error_id":"err-20260310-b2c3d4e5","error_code":"VENDOR_LIMIT_EXCEEDED"}}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized","content":{"application/json":{"example":{"Error":"Authentication required"}}}},"403":{"description":"Forbidden","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The date and time (ISO 8601-formatted timestamp) when the system returned the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","properties":{"error_id":{"type":"string","description":"Error message explaining the reason for failure.","example":"Forbidden"},"http_status":{"type":"integer","description":"The HTTP status code returned in the response.","example":403}}}}},"$$ref":"#/components/responses/403Error"},"409":{"description":"Conflict - Job already exists for this vendor/collection combination","content":{"application/json":{"example":{"title":"Conflict","description":"A job already exists for this vendor and collection combination","http_status":409,"error_id":"err-20260310-c3d4e5f6","error_code":"DUPLICATE_JOB"}}}},"422":{"description":"Unprocessable Entity - Request validation error","content":{"application/json":{"example":{"title":"Validation Error","description":"3 validation error(s): body.org_id, body.polling_interval, body.credentials","http_status":422,"error_id":"err-20260310-d4e5f6a7","error_code":"REQUEST_VALIDATION_ERROR","details":{"errors":[{"field":"body.polling_interval","message":"field required","type":"value_error.missing"},{"field":"body.credentials","message":"field required","type":"value_error.missing","input":"[REDACTED]"}]}}}}},"429":{"description":"Too Many Requests","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The date and time (ISO 8601-formatted timestamp) when the system returned the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"example":{"Error":"Rate limit exceeded"}}},"$$ref":"#/components/responses/429Error"},"500":{"description":"Internal Server Error","headers":{"Content-Type":{"schema":{"type":"string"},"description":"The MIME content type of the response body.","example":"application/json","$$ref":"#/components/headers/Content-Type"},"Date":{"schema":{"type":"string","pattern":"^[0-90-90-90-9-0-90-9-0-90-9T0-90-9:0-90-9:0-90-9Z]+$"},"description":"The date and time (ISO 8601-formatted timestamp) when the system returned the response.","example":"2023-03-14T18:34:25Z","$$ref":"#/components/headers/Date"}},"content":{"application/json":{"schema":{"type":"object","properties":{"error_id":{"type":"string","description":"Error message explaining the reason for failure.","example":"Internal Server Error"},"http_status":{"type":"integer","description":"The HTTP status code returned in the response.","example":500}},"example":{"title":"Internal Server Error","description":"An unexpected error occurred","http_status":500,"error_id":"err-20260310-f6a7b8c9"}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"createFeed","method":"post","path":"/integrations/threatFeeds/feeds"}}