TIDE data can be uploaded to a profile associated with an account. Policies are used to control access to your organization's data and can be specified when the data is submitted. Data Policies allow organizations to control how their submitted data is shared with other organizations or groups. Infoblox can enable accessing and data sharing between organizations upon request. Policies can be used for multiple data submissions and are only visible within your organization. Data profiles are used to identify data in the platform from one or many data submissions. A data profile must be specified when data is submitted. Data profiles are associated with policies, which control who can access the data. When a data profile is created it must be associated with a policy.
A dedicated service key for each data output is the recommended best practice.
Users can submit threat indicators using the Cloud Services Portal or via the TIDE Data API. In order to submit data, the following is required:
...
Data Submission Formats
| Note | ||
|---|---|---|
| ||
Any unknown fields in a record will automatically go under an “extended” field for that record. This will occur after the submission is done. |
| Threat Data Fields | |||
| File-level fields | |||
| profile | The data profile id. | ||
| record_type | This is either host, ip, url, email, or hash. | ||
| external_id | This is a string indicating an external ID to assign to the batch (optional). | ||
| record | This surrounds the individual record(s) in the XML and JSON formats. | ||
| Record-level fields | |||
| Field Name | Description | ||
| host | The threat hostname. | ||
| ip | The threat IP address. | ||
| url | The threat URL. | ||
| hash | The hash threat. | ||
| The email threat. | |||
| detected | The date/time the threat was detected in ISO 8601 format. For example, '20231114T124742Z' and '2024-01-12T00:00:00.000Z' are valid ISO 8601 formats. | ||
| class | The threat's class. For example: Sinkhole. Note: Either "class" or "property" is required, but not both. | ||
| property | The threat's property, For example, Sinkhole_SinkholedHost. Note: Either "class" or "property" is required, but not both. | ||
| confidence | Tthe threat's confidence score ranging from 0 - 100 (optional). | ||
| domain | The domain string (optional). | ||
| duration | The duration of the threat in Xd format or XyXmXwXdXh - the expiration date will be set to the detected date + this duration (optional). | ||
| expiration | The expiration is the datetime the threat will be expired. The expiration datedatetime of thethe threat in Xd format or XyXmXwXdXh - the expiration date will be set to this detected date + the duration (optional)the same format as the detected field. | ||
| threat_level | The threat's level ranging from 0 - 100 as an integer (optional). | ||
| target | The target of threat (optional). For example: “fakeamazon.com” is a threat targeting “amazon.com”. | ||
| tld | The top-level domain, string (optional). | ||
...