Skip to main content
POST
Create Indicator Mapping

Body

application/json
field_path
string
required

Dot-notation path into extraction_target (e.g. 'src_ip' or 'okta.data.client.ipAddress')

indicator_type
string
required

Indicator type: ip, domain, hash_md5, hash_sha1, hash_sha256, url, email, account

source_name
string | null

Restrict to a specific alert source (null = applies to all sources)

extraction_target
string
default:normalized

'normalized' (against CalsetaAlert fields) or 'raw_payload' (against source raw data)

is_active
boolean
default:true

Whether this mapping is active

description
string | null

Human-readable description

Response

Successful Response

data
IndicatorFieldMappingResponse · object
required
meta
Meta · object