How to view threatlist via REST

[laleger]

Is there any way to view actual contents of a threatlist via REST? I've found references to:

| rest /services/data/threatliststats

and

| rest /services/data/inputs/threatlist

But these objects only show metadata about the threatlist. How do I get actual contents? The reason I need to do this is because my threatlist type is custom (i.e. not "threatlist" or "threatlist_domain") which means that the contents do not actually get put in the normal threatlist lookup tables such as threatlist_lookup_by_domain_or_url or threatlist_lookup_by_str.

Thanks in advance for the help!

[koshyk]

May be its quite old now, but found it in

| rest /services/data/inputs/threatlist

[mcronkrite]

Try this search:

| 'all_threat_intel' | fields ip,url,domain,threat_key

That is the macro all_threat_intel, so enclose that term in back ticks ``