What this endpoint does

This endpoint ingests indicator of compromise (IoC) detections from your security tools into Collective Insights. You can submit detections for five IoC types—IP addresses, domains, file hashes, vulnerabilities (CVEs), and URLs—each paired with the detection context that triggered the finding, such as a detection rule, correlation, playbook, or sandbox analysis. Optional enrichment fields allow you to include MITRE ATT&CK technique codes, associated malware names, incident references, and source metadata (e.g., firewall, IDS) for each detection. Set the debug option to true to validate submissions without persisting them, which is required for all test data during development. For an overview of the Collective Insights pipeline, consult the Collective Insights: Overview page. To query previously submitted events after they have been enriched, use the Collective Insights: Search endpoint.

Response data

A successful response confirms the processing status and, when the summary option is enabled, returns a breakdown of how many IoCs were processed for each type (IP, domain, hash, vulnerability, URL) along with details about any dropped detections. In non-debug mode, the response also includes object identifiers for the persisted detection records. Detections with unrecognized IoC types are silently dropped rather than causing errors, so review the processed counts to verify all submissions were accepted.