diff --git a/docs/platform-services/threat-intelligence-indicators.md b/docs/platform-services/threat-intelligence-indicators.md
index 65a2a329c7..054eb1fb0b 100644
--- a/docs/platform-services/threat-intelligence-indicators.md
+++ b/docs/platform-services/threat-intelligence-indicators.md
@@ -48,7 +48,7 @@ To search logs that contain correlations to threat intelligence indicators, you
* [ZeroFox Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zerofox-intel-source)
* **The API**. See the following APIs in the [Threat Intel Ingest Management](https://api.sumologic.com/docs/#tag/threatIntelIngest) API resource:
* [uploadNormalizedIndicators API](https://api.sumologic.com/docs/#operation/uploadNormalizedIndicators)
- * [uploadCsvIndicators API](https://api.sumologic.com/docs/#operation/uploadCsvIndicators)
+
* [uploadStixIndicators API](https://api.sumologic.com/docs/#operation/uploadStixIndicators)
See [Upload formats](#upload-formats) for the format to use when uploading indicators using the Threat Intelligence tab or APIs.
@@ -374,6 +374,7 @@ The following attributes are required:
* `domain-name`. Domain name. (Entity type in Cloud SIEM is `_domain`.)
* `email-addr`. Email address. (Entity type in Cloud SIEM is `_email`.)
* `file`. File name. (Entity type in Cloud SIEM is `_file`.)
+ * `file:hashes`. File hash. (Entity type in Cloud SIEM is `_hash`.)
If you want to add the hash algorithm, enter `file:hashes.''`. For example, `[file:hashes.'SHA-256' = '4bac393bdd']`.
* `ipv4-addr`. IPv4 IP address. (Entity type in Cloud SIEM is `_ip`.)
* `ipv6-addr`. IPv6 IP address. (Entity type in Cloud SIEM is `_ip`.)
* `mac-addr`. Mac address name. (Entity type in Cloud SIEM is `_mac`.)
@@ -429,11 +430,11 @@ If uploading a CSV file using the API, the file should be contained in a JSON ob
}
```
-For other examples for uploading CSV files using the API, see the [uploadCsvIndicators API](https://api.sumologic.com/docs/#operation/uploadCsvIndicators) and the [uploadBlobIndicators API](https://api.sumologic.com/docs/#operation/uploadBlobIndicators).
+
#### Required attributes
-For information about the attributes to use, see ["Indicator" in the STIX 2.1 specification](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_muftrcpnf89v), and the [uploadCsvIndicators API](https://api.sumologic.com/docs/#operation/uploadCsvIndicators) in the [Threat Intel Ingest Management](https://api.sumologic.com/docs/#tag/threatIntelIngest) API resource.
+For information about the attributes to use, see ["Indicator" in the STIX 2.1 specification](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_muftrcpnf89v).
Columns for the following attributes are required in the upload file:
* **id** (string). ID of the indicator. For example, `indicator--d81f86b9-975b-4c0b-875e-810c5ad45a4f`.
@@ -442,6 +443,7 @@ Columns for the following attributes are required in the upload file:
* `domain-name`. Domain name. (Entity type in Cloud SIEM is `_domain`.)
* `email-addr`. Email address. (Entity type in Cloud SIEM is `_email`.)
* `file`. File name. (Entity type in Cloud SIEM is `_file`.)
+ * `file:hashes`. File hash. (Entity type in Cloud SIEM is `_hash`.)
If you want to add the hash algorithm, enter `file:hashes.''`. For example, `[file:hashes.'SHA-256' = '4bac393bdd']`.
* `ipv4-addr`. IPv4 IP address. (Entity type in Cloud SIEM is `_ip`.)
* `ipv6-addr`. IPv6 IP address. (Entity type in Cloud SIEM is `_ip`.)
* `mac-addr`. Mac address name. (Entity type in Cloud SIEM is `_mac`.)
@@ -623,10 +625,10 @@ The following attributes are required:
* **id** (string). ID of the indicator. For example, `indicator--d81f86b9-975b-4c0b-875e-810c5ad45a4f`.
* **created** (string [date-time]). The time at which the object was originally created. Timestamp in UTC in RFC3339 format. For example, `2016-05-01T06:13:14.000Z`.
* **modified** (string [date-time]). When the object is modified. Timestamp in UTC in RFC3339 format. For example, `2023-05-01T06:13:14.000Z`. This property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified.
- * **pattern** (string). The pattern of this indicator (as defined by [pattern in STIX 2.1](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_me3pzm77qfnf)).
For example, `[ file:hashes.'SHA-256' = '4bac393bdd' ]`. Following are valid values:
+ * **pattern** (string). The pattern of this indicator (as defined by [pattern in STIX 2.1](https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_me3pzm77qfnf)). Following are valid values:
* `domain-name:value`. Domain name. (Entity type in Cloud SIEM is `_domain`.)
* `email-addr:value`. Email address. (Entity type in Cloud SIEM is `_email`.)
- * `file:hashes`. File hash. (Entity type in Cloud SIEM is `_hash`.)
+ * `file:hashes`. File hash. (Entity type in Cloud SIEM is `_hash`.)
If you want to add the hash algorithm, enter `file:hashes.''`. For example, `[file:hashes.'SHA-256' = '4bac393bdd']`.
* `file:name`. File name. (Entity type in Cloud SIEM is `_file`.)
* `ipv4-addr:value`. IPv4 IP address. (Entity type in Cloud SIEM is `_ip`.)
* `ipv6-addr:value`. IPv6 IP address. (Entity type in Cloud SIEM is `_ip`.)