POST /api/noise/run — Trigger a Noise Log Dispatch

POST /api/noise/run executes a noise log dispatch job, pulling LEEF-formatted log archives from storage and shipping events to one or more configured SIEMs. The endpoint is called automatically by pg_cron on your configured schedule, but you can also trigger it manually from Admin > Noise Jobs or directly via the API. Method: POST
Path: /api/noise/run
Auth: Bearer token in the Authorization header (for pg_cron / automation) or session cookie with manage_noise_logs capability

Bearer token authentication is accepted on this endpoint only. All other ThreatLab API endpoints require a session cookie. See Authentication for details.

Request Body

string

required

The UUID of the noise job to execute.

string

required

The trigger source. Use "schedule" for pg_cron-initiated calls and "manual" for API or UI-initiated calls.

object

required

A map of SIEM name to pre-created run UUID. ThreatLab updates each entry with status and event counts after execution.

{ "Splunk": "run-abc-123", "Elastic": "run-def-456" }

array

required

Array of archive objects to dispatch. Each object specifies a position and storage path.

Show archive object fields

number

required

Zero-based position of the archive within the job’s archive set. Used to order dispatch.

string

required

Path to the archive within the noise-archives storage bucket (for example, noise-archives/job1/logs.zip).

array

required

Array of SIEM name strings to ship events to. Each target is processed independently — a failure on one SIEM does not abort delivery to others.

object

required

The job’s scheduling configuration. Used to compute next_run_at after execution.

Show schedule object fields

string

required

Scheduling kind: "interval" for fixed-interval repeat or "cron" for a cron expression schedule.

number

required

Repeat interval in seconds. Required when kind is "interval".

number

Optional random jitter in seconds added to the next run time to avoid thundering herd issues.

Execution Flow

Download archives

ThreatLab downloads all archives in the archives array in parallel from the noise-archives storage bucket.

Extract and rebase

LEEF events are extracted from each archive and timestamps are rebased using the same logic as /api/sessions/start.

Ship to each SIEM

Events are shipped to every SIEM in targets independently. A per-SIEM failure does not abort delivery to other SIEMs.

Update run rows

ThreatLab updates the run records identified by run_ids with final status, event counts, and any error details.

Compute next run

next_run_at is computed from the schedule configuration and written back to the job record.

Example

curl -X POST https://threatlab.your-org.com/api/noise/run \
  -H 'Authorization: Bearer your-dispatch-token' \
  -H 'Content-Type: application/json' \
  -d '{
    "job_id": "550e8400-e29b-41d4-a716-446655440000",
    "trigger": "manual",
    "run_ids": {"Splunk": "run-abc"},
    "archives": [{"position": 0, "storage_path": "noise-archives/job1/logs.zip"}],
    "targets": ["Splunk"],
    "schedule": {"kind": "interval", "interval_seconds": 300, "jitter_seconds": 15}
  }'

{
  "ok": true
}

Overview

Endpoints

POST /api/noise/run — Trigger a Noise Log Dispatch

Request Body

Execution Flow

Example

​Request Body

​Execution Flow

​Example

Request Body

Execution Flow

Example