Bulk Import Entities

Import entities via JSON array or a comma-separated list. Each item is sent to API/entities.php (POST). Optionally link all created entities to a threat actor, detection, or ransomware group.

Import as

JSON array Comma-separated list

Acceptable JSON format (API/entities.php)

Submit an array of objects. Required: entity_type, natural_key. All other fields optional.

[
  {
    "entity_type": "hash",
    "display_name": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "natural_key": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "description": "Malware sample",
    "risk_score": 10.00
  }
]

Valid entity_type: victim, host, user, process, ip, domain, url, hash, email, file, registry, service, container, account, certificate, cve, phishing, yara, browser_extension

TIP! You can ask Cursor, Claude, or ChatGPT to convert your .csv to this format by copying & pasting this example and asking for a conversion!

Entities JSON

If you use a comma list, you must specify the entity type (e.g. IP or hash) for all items. Each value will be submitted as natural_key and display_name.

Entity type for all items (required) Comma-separated values (one per entity)

Separate values with commas. Newlines are also allowed. Empty entries are ignored.

Link all created entities to (optional)

After each entity is created, it will be linked to the IDs you specify. Same as Hunting Console "Add Entity". Search by name or enter IDs. Optionally set a default source and link for all entities.

Source (optional)

Link (optional)

Threat Actor

Detection ID(s)

Ransomware Group

Navigation