Export IoCs to TXT

GET

/compromised-host/iocs/export

Copy path

Exports unique values from all pages: IP addresses first, then domains, then URLs, one per line without headers. Ports are not added separately, and URLs are kept whole. input filters families the same way as the library search; profile_input and the other filters select IoC profiles the same way as the family window. export_types selects artifacts within the matched profiles, including linked IoCs. A family read error aborts the entire export without producing a partial file.

Contract

Parameter	Value
Section	compromised-host
Authentication	CookieAuth
Consumes	not required
Produces	text/plain

Parameters

10 parameters

Name	Location	Required	Type	Description
export_types	query	yes	string	Comma-separated value types: ip, domain, url; at least one
campaign_id	query	no	integer	Single family; cannot be combined with input and test_purpose
input	query	no	string	Current search in the family library
test_purpose	query	no	enum(c2_anti_bot, compromised_host_scan)	Family test purpose
profile_input	query	no	string	Current search across IoC profiles
type	query	no	string	Filter profiles by linked IoC types: ip, domain, url
role	query	no	string	Comma-separated profile role filter: c2, payload_delivery
protocol	query	no	string	Comma-separated protocol filter: dns, http, https, tcp, raw_udp; raw_tcp is equivalent to tcp
behavior	query	no	string	Comma-separated replay method filter: dns_query, http_beacon, https_beacon, http_payload_delivery, https_payload_delivery, tcp_connection, url_request, unknown
exchange	query	no	string	Comma-separated exchange template filter: family, universal

• "c2_anti_bot"

  Copy schema

Responses

6 responses

Status	Description	Type
200	UTF-8 TXT, LF line endings, one indicator per line	file
204	No indicators match the selected filters and types	no body
400	Invalid filter, ID, or type list	object
401	Unauthorized	object
404	Family not found	object
500	Database error, family read error, or invalid indicator	object

• {}

  Copy schema

• {
    "data": {},
    "error": "<string>"
  }

  Copy schema

• {
    "data": {},
    "error": "<string>"
  }

  Copy schema

• {
    "data": {},
    "error": "<string>"
  }

  Copy schema

• {
    "data": {},
    "error": "<string>"
  }

  Copy schema