Skip to content

Create indicators

POST/firewall-config/firewalls/{firewallId}/mdr-threat-feed/indicators

Firewall Management API · Firewall Config

Create indicators of mdr-threat-feed for given firewall.

Required permissionfwcm.firewall.api.config:write

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
firewallId path string (uuid) Yes Firewall ID.

Request body

Content type: application/json

Request body fields

indicatorsarray of objectrequired
Indicator list limited to 100.
Items must be unique.
Indicator details.
Show child attributesHide child attributes
valuestringrequired
Indicator value.
typestringrequired
Indicator types as per STIX standard.
Must be one of: ipv4-addr, domain-name, url.

Request samples

curl -X POST "https://api-<data-region>.central.sophos.com/firewall/v1/firewall-config/firewalls/<firewallId>/mdr-threat-feed/indicators" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"indicators\": [
    {
      \"value\": \"string\",
      \"type\": \"ipv4-addr\"
    }
  ]
}"


import requests

response = requests.post(
    "https://api-<data-region>.central.sophos.com/firewall/v1/firewall-config/firewalls/<firewallId>/mdr-threat-feed/indicators",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={'indicators': [{'value': 'string', 'type': 'ipv4-addr'}]},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "indicators": [
    {
      "value": "string",
      "type": "ipv4-addr"
    }
  ]
}'
Invoke-RestMethod -Method POST -Uri "https://api-<data-region>.central.sophos.com/firewall/v1/firewall-config/firewalls/<firewallId>/mdr-threat-feed/indicators" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api-<data-region>.central.sophos.com/firewall/v1/firewall-config/firewalls/<firewallId>/mdr-threat-feed/indicators", strings.NewReader(`{
  "indicators": [
    {
      "value": "string",
      "type": "ipv4-addr"
    }
  ]
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/firewall/v1/firewall-config/firewalls/<firewallId>/mdr-threat-feed/indicators", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "indicators": [
    {
      "value": "string",
      "type": "ipv4-addr"
    }
  ]
}),
});
const data = await response.json();
console.log(data);

Responses

202 — Request accepted.

Response fields

transactionIdstring (uuid)required

Errors

Status Meaning
400 Bad request.
401 Authentication required.
403 Authorization required.
404 Resource not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

202

{
  "transactionId": "00000000-0000-0000-0000-000000000000"
}

See the guide for a narrative walkthrough of this API.