{"type":"model","meta":{"id":"/apps/pubhub/media/cloud-security-apis-in-eft/83e8a10367d157243cd1c3e478b807cb81262a3d/9c9cc32c-275c-3119-8ff5-3eceac33f676","info":{"title":"Cisco Secure Access Threat Intelligence Feeds API","version":"1.0.0","description":"Create and manage the integration of STIX-TAXII threat intelligence feeds in Secure Access.","contact":{"name":"Cloud Security Developer Community"}},"security":[{"oauthFlow":[]}],"tags":[{"name":"Integrations","description":"Integration management"},{"name":"Secure Access"}],"x-parser-conf":{"overview":{"markdownPath":"secure-access/reference/admin/threat-intelligence-feeds-overview.md","uri":"secure-access-api-reference-threat-intelligence-feeds-overview"}},"openapi":"3.0.3","servers":[{"url":"https://api.sse.cisco.com/{basePath}","variables":{"basePath":{"default":"admin/v2"}}}],"securitySchemes":{"oauthFlow":{"type":"oauth2","description":"The client credential flow.","flows":{"clientCredentials":{"tokenUrl":"https://api.sse.cisco.com/auth/v2/token","scopes":{"admin.integrations.threatfeeds:read":"Read threat intelligence feeds","admin.integrations.threatfeeds:write":"Create, update, or delete threat intelligence feeds"}}}}}},"spec":{"type":"array","description":"The list of the properties for the integrated threat intelligence feeds in the organization.","items":{"type":"object","description":"The properties of the threat intelligence feed.","required":["job_id","customer_id","state","feed_vendor"],"properties":{"job_id":{"type":"string","description":"The unique identifier of the job.","example":"0000303900000000000001a4","$$ref":"#/components/schemas/job_id"},"customer_id":{"type":"string","description":"The identifier of the customer or tenant.","example":"12345a","$$ref":"#/components/schemas/customer_id"},"discovery_url":{"type":"string","format":"uri","description":"The discovery URL for the TAXII service.\nThe discovery URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.1.","example":"https://limo.anomali.com/taxii2/","$$ref":"#/components/schemas/discovery_url"},"root_url":{"type":"string","format":"uri","description":"The root URL for the TAXII API.\nThe root URL must end with a trailing slash.\nFor more information, see the TAXII 2.1 standard, section 4.2.","example":"https://limo.anomali.com/api1/","$$ref":"#/components/schemas/root_url"},"collection_name":{"type":"string","description":"The name of the collection provided by the threat intelligence feed.","example":"Indicators","$$ref":"#/components/schemas/collection_name"},"collection_id":{"type":"string","format":"uuid","pattern":"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$","description":"The unique ID (UUID) of the TAXII collection.\nThe collection ID must be a valid UUID v4 as specified in the \nTAXII standard v2.1 Section 5.2.1.","example":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","$$ref":"#/components/schemas/collection_id"},"auth_id":{"type":"string","description":"The identifier of the encrypted credentials.","$$ref":"#/components/schemas/auth_id"},"polling_interval":{"type":"string","nullable":true,"description":"The cron expression for the polling schedule.","example":"*/30 * * * *","$$ref":"#/components/schemas/polling_interval"},"window_duration":{"type":"integer","description":"The number of seconds that represents the polling window.","example":300,"$$ref":"#/components/schemas/window_duration"},"max_content_length":{"type":"integer","description":"Maximum content length in bytes"},"feed_vendor":{"type":"string","description":"The name of the vendor that provides the threat intelligence feed.","example":"Anomali","$$ref":"#/components/schemas/feed_vendor"},"state":{"type":"string","description":"The state of a threat intelligence feed job.","enum":["draft","active","paused","disabled"],"example":"active","$$ref":"#/components/schemas/state"},"created_at":{"type":"string","format":"date-time","description":"The date and time when the system created the threat intelligence feed.\nTimestamp created using the ISO 8601 format with UTC timezone.","example":"2026-01-04T15:30:00.000000Z","$$ref":"#/components/schemas/created_at"},"updated_at":{"type":"string","format":"date-time","description":"The date and time when the system updated the threat intelligence feed.\nTimestamp created using the ISO 8601 format with UTC timezone.","example":"2026-01-04T16:45:00.000000Z","$$ref":"#/components/schemas/updated_at"}}},"example":[{"job_id":"0000303900000000000001a4","customer_id":"12345","discovery_url":"https://limo.anomali.com/taxii2/","root_url":"https://limo.anomali.com/api1/","collection_name":"Indicators","collection_id":"91a7b528-80eb-42ed-a74d-c6fbd5a26116","polling_interval":"*/5 * * * *","window_duration":300,"feed_vendor":"anomali","state":"active","created_at":"2026-01-04T15:30:00.000000Z","updated_at":"2026-01-04T16:45:00.000000Z"}],"$$ref":"#/components/schemas/listFeedsResponse","title":"listFeedsResponse"}}