Skip to main content
POST /api/noise/run executes a noise log dispatch job, pulling LEEF-formatted log archives from storage and shipping events to one or more configured SIEMs. The endpoint is called automatically by pg_cron on your configured schedule, but you can also trigger it manually from Admin > Noise Jobs or directly via the API. Method: POST
Path: /api/noise/run
Auth: Bearer token in the Authorization header (for pg_cron / automation) or session cookie with manage_noise_logs capability
Bearer token authentication is accepted on this endpoint only. All other ThreatLab API endpoints require a session cookie. See Authentication for details.

​
Request Body

​
job_id
string
required
The UUID of the noise job to execute.
​
trigger
string
required
The trigger source. Use "schedule" for pg_cron-initiated calls and "manual" for API or UI-initiated calls.
​
run_ids
object
required
A map of SIEM name to pre-created run UUID. ThreatLab updates each entry with status and event counts after execution.
{ "Splunk": "run-abc-123", "Elastic": "run-def-456" }
​
archives
array
required
Array of archive objects to dispatch. Each object specifies a position and storage path.
​
targets
array
required
Array of SIEM name strings to ship events to. Each target is processed independently — a failure on one SIEM does not abort delivery to others.
​
schedule
object
required
The job’s scheduling configuration. Used to compute next_run_at after execution.

​
Execution Flow

1

Download archives

ThreatLab downloads all archives in the archives array in parallel from the noise-archives storage bucket.
2

Extract and rebase

LEEF events are extracted from each archive and timestamps are rebased using the same logic as /api/sessions/start.
3

Ship to each SIEM

Events are shipped to every SIEM in targets independently. A per-SIEM failure does not abort delivery to other SIEMs.
4

Update run rows

ThreatLab updates the run records identified by run_ids with final status, event counts, and any error details.
5

Compute next run

next_run_at is computed from the schedule configuration and written back to the job record.

​
Example

curl -X POST https://threatlab.your-org.com/api/noise/run \
  -H 'Authorization: Bearer your-dispatch-token' \
  -H 'Content-Type: application/json' \
  -d '{
    "job_id": "550e8400-e29b-41d4-a716-446655440000",
    "trigger": "manual",
    "run_ids": {"Splunk": "run-abc"},
    "archives": [{"position": 0, "storage_path": "noise-archives/job1/logs.zip"}],
    "targets": ["Splunk"],
    "schedule": {"kind": "interval", "interval_seconds": 300, "jitter_seconds": 15}
  }'