# IOC Aging via TIP

**URL:** <https://discuss.rapid7.com/t/ioc-aging-via-tip/2353>\
**Category:** InsightIDR\
**Tags:** research\
**Created:** [November 5, 2020, 1:02pm UTC](https://discuss.rapid7.com/t/ioc-aging-via-tip/2353 "2020-11-05T13:02:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![michael\_ekladious](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/bbce88/32.png) [@michael\_ekladious](https://discuss.rapid7.com/u/michael_ekladious)\
**Post date:** [November 5, 2020, 1:02pm UTC](https://discuss.rapid7.com/t/ioc-aging-via-tip/2353/1 "2020-11-05T13:02:06Z")

</div>

We are looking on aging out indicators from our IDR threat feed and our TIP. IDR documentation shows that there is a replace model in the API but does that remove the IOC if the TIP aged it out?

---

<div class="post-metadata">

**Author:** ![nick\_mifsud1](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/nick_mifsud1/32/278_2.png) [@nick\_mifsud1](https://discuss.rapid7.com/u/nick_mifsud1)\
**Post date:** [November 5, 2020, 3:44pm UTC](https://discuss.rapid7.com/t/ioc-aging-via-tip/2353/2 "2020-11-05T15:44:33Z")

</div>

Hi Michael,

If you are talking about this API endpoint:  
[https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators](https://help.rapid7.com/insightidr/en-us/api/v1/docs.html#operation/replaceIndicators)  
then the answer is yes, this will remove IoC’s that used to be in the threat but are not included in the new data.

---

<div class="post-metadata">

**Author:** ![michael\_ekladious](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/bbce88/32.png) [@michael\_ekladious](https://discuss.rapid7.com/u/michael_ekladious)\
**Post date:** [November 9, 2020, 8:22pm UTC](https://discuss.rapid7.com/t/ioc-aging-via-tip/2353/3 "2020-11-09T20:22:46Z")

</div>

Hi Nick,

Thanks for the response. I was looking at a way just to find and replace indicators one by one since the entire feed may not meet the aging criteria.

R/S,  
Mike

---

<div class="post-metadata">

**Author:** ![nick\_mifsud1](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/nick_mifsud1/32/278_2.png) [@nick\_mifsud1](https://discuss.rapid7.com/u/nick_mifsud1)\
**Post date:** [November 11, 2020, 1:45pm UTC](https://discuss.rapid7.com/t/ioc-aging-via-tip/2353/4 "2020-11-11T13:45:57Z")

</div>

Hi Michael,

I’m afraid that at this time, you can only add new IoC’s or replace them all. However, if the feed you are using only contains the active IoC’s then you can use the replace endpoint to effectively remove the aged ones.  
I know there are some plans afoot to increase the capabilities here and will be sure to let you know if removing individual IoC’s via the API is going to be possible.