indicators

Creates, updates, deletes, gets or lists an indicators resource.

Overview

Name	indicators
Type	Resource
Id	sumologic.threat_intel.indicators

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
upload_normalized	exec	region, indicators		Uploads a list indicators in a Sumo normalized format.
upload_stix	exec	region, indicators, source		Uploads a list indicators in in a STIX 2.x json format.
remove	exec	region, indicatorIds, source		Removes indicators by specifying a list of indicator IDs

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	Sumo Logic deployment (au, ca, ch, de, eu, fed, in, jp, kr, us1, us2). Resolved from the SUMOLOGIC_ENVIRONMENT environment variable when it is set (x-stackQL-envVar, the same variable the Terraform provider reads); otherwise defaults to us2. A WHERE region = '...' value always takes precedence. (enum: [au, ca, ch, de, eu, fed, in, jp, kr, us1, us2], default: us2, x-stackQL-envVar: SUMOLOGIC_ENVIRONMENT)

Lifecycle Methods

EXEC variables use wire (API) names.

upload_normalized

Uploads a list indicators in a Sumo normalized format.

EXEC sumologic.threat_intel.indicators.upload_normalized 
@region='{{ region }}' --required unless SUMOLOGIC_ENVIRONMENT is set 
@@json=
'{
"indicators": "{{ indicators }}"
}'
;

upload_stix

Uploads a list indicators in in a STIX 2.x json format.

EXEC sumologic.threat_intel.indicators.upload_stix 
@region='{{ region }}' --required unless SUMOLOGIC_ENVIRONMENT is set 
@@json=
'{
"source": "{{ source }}", 
"indicators": "{{ indicators }}"
}'
;

remove

Removes indicators by specifying a list of indicator IDs

EXEC sumologic.threat_intel.indicators.remove 
@region='{{ region }}' --required unless SUMOLOGIC_ENVIRONMENT is set 
@@json=
'{
"source": "{{ source }}", 
"indicatorIds": "{{ indicatorIds }}"
}'
;