# Create IOCs

Creates a list of iocs that match the stix input for the EDR source.

Operation ID: edr_create_iocs

Endpoint: POST /v1/edr/iocs
Security: BearerAuth

## Query parameters:

  - `meta` (array)
    Add metadata to the response by invoking meta functions. Documentation for meta functions is available. Not all meta functions are available at every endpoint.

## Request fields (application/json):

  - `indicators` (array, required)
    The list of iocs to create

  - `indicators.type` (string, required)

  - `indicators.valid_from` (string, required)
    The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.

  - `indicators.spec_version` (string, required)

  - `indicators.id` (string, required)

  - `indicators.created` (string, required)
    The created property represents the time at which the object was originally created.

  - `indicators.modified` (string, required)
    The modified property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified.

  - `indicators.name` (string,null)
    A name used to identify the Indicator.

  - `indicators.description` (string,null)
    A description that provides more details and context about the Indicator, potentially including its purpose and its key characteristics.

  - `indicators.indicator_types` (array,null)
    A set of categorizations for this indicator.
    Enum: "anomalous_activity", "anonymization", "benign", "compromised", "malicious_activity", "attribution", "unknown"

  - `indicators.pattern` (string,null)
    The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc.

  - `indicators.pattern_type` (string)
    covers common pattern languages
    Enum: "stix", "pcre", "sigma", "snort", "suricata", "yara"

  - `indicators.pattern_version` (string,null)
    The version of the pattern expression used in the pattern property.

  - `indicators.valid_until` (string,null)
    The time at which this Indicator is no longer considered valid.

  - `indicators.kill_chain_phases` (array,null)
    The kill chain phase to which this Indicator corresponds.

  - `indicators.kill_chain_phases.kill_chain_name` (string, required)
    The kill_chain_name property specifies the name of the kill chain to which the phase belongs.

  - `indicators.kill_chain_phases.phase_name` (string, required)
    The phase_name property specifies the name of the phase within the kill chain.

  - `indicators.raw_data` (string,null)
    The data as received from the source.

  - `indicators.created_by_ref` (object)

  - `indicators.revoked` (boolean,null)
    The revoked property indicates whether this object has been revoked. If the revoked property is present and set to true, then the object has been revoked.

  - `indicators.labels` (array,null)
    The labels property is an array of strings that are used to categorize this object.

  - `indicators.confidence` (integer,null)
    The confidence property is an integer from 0 to 100 that represents the confidence that this object is accurate and valid.

  - `indicators.lang` (string,null)
    The lang property specifies the language used in the properties of the object.

  - `indicators.external_references` (array,null)
    The external_references property is an array of external references that are relevant to this object.

  - `indicators.external_references.source_name` (string, required)
    The source_name property specifies the name of the source that provided the external reference.

  - `indicators.external_references.description` (string,null)
    The description property provides a human-readable explanation of the external reference.

  - `indicators.external_references.url` (string,null)
    The url property specifies the URL of the external reference.

  - `indicators.external_references.hash` (string,null)
    The hash property specifies a hash value that uniquely identifies the external reference.

  - `indicators.external_references.external_id` (string,null)
    The external_id property specifies an identifier used by the source of the external reference.

  - `indicators.object_marking_refs` (array,null)
    The object_marking_refs property is an array of ids of marking_definition objects that apply to this object.

  - `indicators.object_marking_refs.type` (string, required)
    The type property identifies the type of object. The value of this property MUST be marking_definition.

  - `indicators.object_marking_refs.name` (string,null)

  - `indicators.granular_markings` (array,null)
    The granular_markings property is an array of granular markings that are applied to this object.

  - `indicators.granular_markings.selectors` (array, required)
    The selectors property is an array of strings that represent the selectors that are used to apply the marking_definition object to this object.

  - `indicators.granular_markings.lang` (string,null)
    The lang property specifies the language used in the properties of the marking_definition object.

  - `indicators.granular_markings.marking_ref` (object)

  - `indicators.extensions` (object,null)
    The extensions property is an object that contains custom properties or objects that extend the object.

## Response 200 fields (application/json):

  - `result` (array, required)
    A list of the indicators that were created

  - `messages` (object)

  - `messages.problems` (array,null)
    Warnings or issues that occurred during processing that did not prevent the request from returning, but may indicate a problem or issue with expected processing behavior.

  - `messages.problems.occurred_at` (string, required)
    The date and time the problem occurred.

  - `messages.problems.status` (integer, required)
    The HTTP status code of the problem. Matches the HTTP response code sent by the server.

  - `messages.problems.instance` (string, required)
    A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.

  - `messages.problems.message` (string, required)
    A short, display-friendly summary of the problem.

  - `messages.problems.type` (string)
    A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type.

  - `messages.problems.cause` (array,null)
    A list of the root cause(s) for this problem occurrence. Includes at minimum one root cause, and is otherwise an unordered list of causes.

  - `messages.problems.cause.type` (string, required)
    A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type.

  - `messages.problems.cause.message` (string, required)
    A short, display-friendly summary of the problem.

  - `messages.problems.cause.detail` (string,null)
    A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem.

  - `messages.problems.cause.remediation` (string,null)
    A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible.

  - `messages.problems.cause.context` (object)

  - `messages.problems.cause.context.parameter` (object)

  - `messages.problems.cause.context.parameter.id` (string, required)
    If the location of the parameter is body, this value is always a JSON Pointer, otherwise it's the name of the parameter.

  - `messages.problems.cause.context.parameter.location` (string, required)
    Enum: "header", "path", "query", "body"

  - `messages.problems.cause.context.parameter.value` (any,null)
    The given value of the parameter.

  - `messages.problems.cause.context.resources` (array,null)

  - `messages.problems.cause.context.resources.type` (string, required)
    Enum: "account", "bridge", "credential", "integration_point", "integration", "member", "operation", "organization_webhook", "role", "sub_org", "token", "transform"

  - `messages.problems.cause.context.resources.id` (string, required)
    ID of the related resource.

  - `messages.problems.cause.context.resources.rel` (string, required)
    Enum: "affected", "cause"

  - `messages.problems.cause.context.raw_error` (string,null)
    If available this represents the underlying raw error, for example an error response from a Provider.

  - `messages.problems.cause.context.provider_details` (object,null)
    If available this represents the underlying details from the provider. May include the error message, status code, and other details.

  - `messages.problems.detail` (string,null)
    A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem.

  - `messages.problems.remediation` (string,null)
    A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible.

  - `messages.problems.context` (object)

  - `meta` (object)

  - `meta.stats` (object)

  - `meta.stats.count` (object,null)
    A count of total response times. If present "*" will be all items, or they can be faceted into specific categories.

  - `meta.api` (object)

  - `meta.api.response` (object)

  - `meta.api.response.primary` (object)

  - `meta.api.response.primary.endpoint` (string, required)
    The endpoint URL of the primary API request made to fulfill the response.

  - `meta.api.response.primary.response` (string, required)
    The response from the primary API request.

  - `meta.api.response.list` (object,null)
    All responses from backing API calls, indexed by endpoint URL.

  - `meta.mapping` (object)

  - `meta.mapping.chains` (object)
    The list of mapping chains applied, indexed by operation ID. Each entry contains an array of mapping IDs.