Get IOC by UUID - FalconFeeds

Endpoint

GET https://api.falconfeeds.io/merlin/ioc/v2/:uuid

Authentication

Authorization: Bearer <your-api-token>

Path Parameters

Parameter	Type	Required	Description
`uuid`	`string`	Yes	The UUID of the IOC to retrieve.

Request

curl --location 'https://api.falconfeeds.io/merlin/ioc/v2/<uuid>' \
  --header 'Authorization: Bearer <your-api-token>'

Response

{
  "message": "string",
  "data": {
    "uuid": "string",
    "type": "string",
    "ttp": ["string"],
    "indicator": "string",
    "threatType": "string",
    "threatActors": [
      {
        "uuid": "string",
        "name": "string"
      }
    ],
    "malware": [
      {
        "uuid": "string",
        "family": "string",
        "aliases": ["string"],
        "displayName": "string",
        "platformHint": "string"
      }
    ],
    "victims": [
      {
        "type": "string",
        "value": ["string"]
      }
    ],
    "createdAt": "number",
    "confidence": "string",
    "tags": ["string"]
  }
}

string

Status message from the API.

object

The IOC object matching the requested UUID.

string

Unique identifier for the IOC.

string

IOC type (e.g., ipv4, domain, sha256).

array

MITRE ATT&CK TTPs associated with this IOC.

string

The actual indicator value.

string

The threat category this IOC belongs to.

array

Threat actors associated with this IOC.

array

Malware families linked to this IOC.

array

Victim entities associated with this IOC.

number

Unix timestamp (in milliseconds) when the IOC was created. Defaults to 0 when unavailable.

string

Confidence level (e.g., limited, moderate, high).

array

Tags associated with the IOC.

​Endpoint

​Authentication

​Path Parameters

​Request

​Response

Endpoint

Authentication

Path Parameters

Request

Response