For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/ko/api/latest/threat-intelligence/ingest-stix-threat-intelligence.md. A documentation index is available at /llms.txt.
homeHomedocs문서apiAPI
Language
Datadog site

STIX 위협 인텔리전스 수집

경고Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.
POSThttps://api.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.us3.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.us5.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.datadoghq.eu/api/v2/security/threat-intel/stixhttps://api.ap1.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.ap2.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.uk1.datadoghq.com/api/v2/security/threat-intel/stixhttps://api.ddog-gov.com/api/v2/security/threat-intel/stixhttps://api.us2.ddog-gov.com/api/v2/security/threat-intel/stix

개요

위협 인텔리전스 지표가 포함된 STIX 2.1 번들을 수집합니다. 지표 객체만 처리됩니다. 지원되는 지표 패턴에는 IPv4 주소, IPv6 주소, 도메인 이름 또는 SHA-256 파일 해시가 포함됩니다.

지표가 아닌 객체는 무시되며 응답 카운터에 포함되지 않습니다. 지원되지 않는 STIX 버전의 지표 객체나 지원되는 관찰 가능한 값을 생성하지 않는 패턴은 unsupported 카운터를 증가시킵니다. 구문 분석할 수 없는 패턴은 invalid 카운터를 증가시킵니다. 처리는 최선의 방식으로 이루어지므로 동일한 번들에 있는 유효하고 지원되는 지표는 계속 추가됩니다.

성공적인 응답은 수집이 완료되었음을 의미합니다. 참조 테이블 구체화 및 보강은 비동기적으로 발생합니다. 요청은 수신 시 50MB로 제한되며 압축 해제 후 100MB, API 키당 초당 10개 요청으로 제한됩니다. Gzip으로 압축된 요청 본문이 지원됩니다.

This endpoint requires the reference_tables_write permission.

인수

헤더 파라미터

이름
유형
설명
ti_vendor [required]
string

Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores.

Content-Encoding
enum

Content encoding for the request body. Use gzip for a compressed STIX bundle.

Allowed enum values: gzip

요청

Body Data (required)

지표 객체를 포함하는 STIX 2.1 번들입니다. 요청 본문은 수신 시 50MB를 초과할 수 없으며 압축 해제 후에는 100MB를 초과할 수 없습니다.

항목
유형
설명
id [required]
string

위협 인텔리전스 지표 객체를 포함하는 STIX 2.1 번들입니다.

objects [required]
[object]

The STIX objects included in the bundle. Indicator objects are processed and ingested; all other STIX object types are ignored and are not included in the response counters.

spec_version
enum

The supported STIX specification version.

Allowed enum values: 2.1
type [required]
enum

The STIX object type for a bundle.

Allowed enum values: bundle

응답

OK

The response from a completed STIX ingestion request.

항목
유형
설명
data [required]
object

The JSON:API resource describing the completed STIX ingestion request.

코드 예시

Ingest STIX threat intelligence returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/security/threat-intel/stix" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "ti_vendor: acme" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "id": "bundle--44444444-4444-4444-8444-444444444444",
  "objects": [
    {
      "created": "2026-07-22T12:00:00Z",
      "id": "indicator--55555555-5555-4555-8555-555555555555",
      "modified": "2026-07-22T12:00:00Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-07-22T12:00:00Z"
    }
  ],
  "spec_version": "2.1",
  "type": "bundle"
}
EOF