IOC Aging via TIP

michael_ekladious · November 5, 2020, 1:02pm

We are looking on aging out indicators from our IDR threat feed and our TIP. IDR documentation shows that there is a replace model in the API but does that remove the IOC if the TIP aged it out?

nick_mifsud1 · November 5, 2020, 3:44pm

Hi Michael,

If you are talking about this API endpoint:
https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators
then the answer is yes, this will remove IoC’s that used to be in the threat but are not included in the new data.

michael_ekladious · November 9, 2020, 8:22pm

Hi Nick,

Thanks for the response. I was looking at a way just to find and replace indicators one by one since the entire feed may not meet the aging criteria.

R/S,
Mike

nick_mifsud1 · November 11, 2020, 1:45pm

Hi Michael,

I’m afraid that at this time, you can only add new IoC’s or replace them all. However, if the feed you are using only contains the active IoC’s then you can use the replace endpoint to effectively remove the aged ones.
I know there are some plans afoot to increase the capabilities here and will be sure to let you know if removing individual IoC’s via the API is going to be possible.