Update an indicator’s malice verdict.
Send {"malice": "Malicious"} to set an analyst override.
Send {"malice": null} to reset to the enrichment-computed value.
Patch request for updating an indicator — PATCH /v1/indicators/{uuid}.
Indicator malice verdict — shared validation enum.
Pending, Benign, Suspicious, Malicious