IOC value cannot be blank when using Indicators of Compromise (IOC) Blacklist API

Products

• Email Security.cloud

Issue/Introduction

You are trying to add the entry to IOC Blacklist via API and received 202 Accepted response with an error: "IOC value cannot be blank"

Environment

Email Security.cloud

Resolution

The field IocValue in the Body cannot be empty for any HTTP Post (api-list-action parameter = Merge/Replace/IOC).

When the api-list-action parameter = Merge/Replace, the following fields are mandatory:

• IocType
• IocValue
• Description
• EmailDirection

The RemediationAction field is optional. If this field is omitted the value is set to the default remediation action that is defined in the Email Security.cloud portal.
The IocBlacklistId and ApiRowAction fields should either be omitted or if present left blank.

When the api-list-action parameter = IOC then the IocBlacklistId field can be empty only when the ApiRowAction = A. In all other cases, all the fields are mandatory.