Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/vanhecke/celmex is gone (deleted or private); Software Heritage not asked yet (this run's --swh-calls were used up); no fork with the same repo name found; no cached copy. Use another version.
Cortex threat intelligence indicators (IOCs).
A SearchArgs with no filters, sort, pagination, or
timeframe.
A single threat-intelligence indicator (hash, domain, URL, IP, etc.).
Envelope returned by get. Not wrapped in the standard reply.
POST /public_api/v1/indicators/get
Response is top-level {objects_count, objects, objects_type} — NOT wrapped
in the usual reply envelope.
Arguments to insert. items is the raw request_data array
of indicator objects — each entry must include at least indicator, type,
severity, and comment. The optional reputation / reliability fields
are polymorphic per source (see Indicator) so the SDK does
not type them ahead of time; callers build the JSON shape themselves and
pass it through. Pass an existing rule_id on an item to upsert that IOC
instead of inserting a new one.
Outcome of an insert call. addedObjects lists the newly
created IOC IDs and the server's status string for each; updatedObjects
lists upserts; errors collects per-item failures the server flagged
without aborting the batch.
One row in the InsertResult addedObjects /
updatedObjects arrays — the rule ID the server assigned and the matching
human-readable status it returned.
One row in the InsertResult errors array — the
zero-based index of the offending item in the request and the server's
human-readable rejection reason.
POST /public_api/v1/indicators/insert — insert or upsert a batch of IOCs. The response carries the rule IDs of every IOC the server touched, which a test can use to delete what it inserted.
Arguments to delete. filters is AND-ed server-side; pass
multiple entries to narrow the match further. Build entries via
deleteFilter so the wire shape stays an SDK detail.
One {field, operator, value} predicate accepted by indicators/delete.
The delete endpoint accepts only a constrained operator set (EQ, NEQ,
IN, GTE, LTE) and a closed field set (indicator, type, severity,
expiration_date, default_expiration_enabled, comment, reputation,
reliability); the SDK does not validate either — the server will reject
invalid combinations.
Build a DeleteFilter from the raw triple. The
operator should already be one of the API's uppercase keywords (EQ,
NEQ, IN, GTE, LTE); the encoder writes it through verbatim.
Outcome of a delete call. objectsCount is the number of
IOCs the server removed; objects is the list of rule IDs it removed.
Arguments to
get. All fields are optional; passdefaultSearchArgsfor an unfiltered request.extrais merged last intorequest_dataand overrides any SDK-generated key on collision — e.g. the indicator endpoint'sextended_viewflag is reachable through it.