For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/es/api/latest/threat-intelligence/ingest-stix-threat-intelligence.md. A documentation index is available at /llms.txt.
homeIniciodocsDocumentaciónapiAPI
Language
Datadog site

Ingest STIX threat intelligence

ADVERTENCIANote: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.
POSThttps://api.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.us3.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.us5.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.datadoghq.eu/api/v2/security/threat-intel/stixhttps://api.ap1.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.ap2.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.uk1.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.ddog-gov.com/api/v2/security/threat-intel/stixhttps://api.us2.ddog-gov.com/api/v2/security/threat-intel/stix

Descripción general

Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes.

Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the unsupported counter. Patterns that cannot be parsed increment the invalid counter. Processing is best effort, so valid supported indicators in the same bundle are still added.

A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported.

This endpoint requires the reference_tables_write permission.

Argumentos

Parámetros de encabezado

Nombre
Type
Descripción
ti_vendor [required]
string

Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores.

Content-Encoding
enum

Content encoding for the request body. Use gzip for a compressed STIX bundle.

Allowed enum values: gzip

Solicitud

Body Data (required)

A STIX 2.1 bundle containing indicator objects. The request body must not exceed 50 MB as received or 100 MB after decompression.

Campo
Type
Descripción
id [required]
string

The STIX bundle identifier.

objects [required]
[object]

The STIX objects included in the bundle. Indicator objects are processed and ingested; all other STIX object types are ignored and are not included in the response counters.

spec_version
enum

The supported STIX specification version.

Allowed enum values: 2.1
type [required]
enum

The STIX object type for a bundle.

Allowed enum values: bundle

Respuesta

OK

The response from a completed STIX ingestion request.

Campo
Type
Descripción
data [required]
object

The JSON:API resource describing the completed STIX ingestion request.

Ejemplo de código

Ingest STIX threat intelligence returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF