---
title: "TIDE Data Submission Overview"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35434535/TIDE%20Data%20Submission%20Overview"
format: markdown
---
TIDE data can be uploaded to a profile associated with an account. Data policies are used to control access to your organization's data and can be specified when the data is submitted. Data policies allow your organization to control how its submitted data is shared with other organizations or groups.

Data profiles are used to identify data in the Infoblox Portal from one or many data submissions and control who can access the data. A data profile must be specified when data is submitted and is associated with a policy, which controls who can access the data. 


Users can submit threat indicators by using the Infoblox Portal or the TIDE Data API. To submit data, the following is required:

1. **A data profile**: Data profiles are associated with policies, which control who has access to your organization’s data, and they must be specified when data is submitted. When a data profile is created, it must be associated with a policy. Subscribers of Infoblox Threat Defense Advanced can create custom profiles that allow the use of custom-generated TIDE RPZ feeds that are based on an organization's requirements. When creating your own TIDE BYOF RPZ feeds for use with NIOS, keep in mind the practical limits of your NIOS system and its ability to ingest large amounts of data contained within only one RPZ feed. For details, see *[Creating Data Profiles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35468021)*.  
2. <span style="color: #333333">**Choose a file**</span><span style="color: #333333">: Supported file formats include XML, JSON and comma/tab/pipe-separated values. Data files must follow the </span><span style="color: #333333">[Infoblox Threat Defense API Guidelines](https://csp.infoblox.com/apidoc?url=https%3A%2F%2Fcsp.infoblox.com%2Fapidoc%2Fdocs%2FTIDEData)</span><span style="color: #333333"> for file and record-level fields. Records must contain a recognized threat class or property. For information, see </span><span style="color: #333333">*[Submitting TIDE Data](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35468085)*</span><span style="color: #333333">. </span>

Users can submit data as JSON, CSV, XML, and TSV (tab-separated values). For all data formats, the submitted data must identify the data/record type in addition to the list of data records. For CSV and TSV, the record type must be provided as one of the columns. For JSON and XML, the record type is defined in a separate top-level field. The record type field can have one of the following values: “host”, “ip”, or “url”. It is not possible to upload data using different profiles or different record types in the same file. Threat data consists of file-level fields and record-level fields. The following table contains descriptions of all available fields:

## <span style="color: #000000">Data Submission Formats</span>

> ⚠️ **Note**
> ⚠️ 
> ⚠️ Any unknown fields in a record will automatically go under an “extended” field for that record. This will occur after the submission is done.

|  |  |
| --- | --- |
| <span style="color: #000000">**Threat Data Fields**</span> |  |
| **File-level fields** |
| <span style="color: #000000">profile</span> | The data profile ID. |
| <span style="color: #000000">record_type</span> | host, ip, url, email, or hash. |
| <span style="color: #000000">external_id</span> | A string indicating an external ID to assign to the batch (optional). |
| <span style="color: #000000">record</span> | Surrounds the individual record(s) in the XML and JSON formats. |
| **Record-level fields** |
| <span style="color: #000000">**Field Name**</span> | <span style="color: #000000">**Description**</span> |
| <span style="color: #000000">host</span> | The threat’s hostname. |  |
| <span style="color: #000000">ip</span> | The threat’s IP address. |  |
| <span style="color: #000000">url</span> | The threat’s URL. |  |
| hash | The hash threat. |  |
| email | The email threat. |  |
| <span style="color: #000000">detected</span> | The date/time the threat was detected, in the ISO 8601 format. For example, “20231114T124742Z” and “2024-01-12T00:00:00.000Z” are valid ISO 8601 formats. |  |
| class | The threat's class. Example: **Sinkhole**.  **Note**: Either "**class**" or "**property**" is required, but not both. |  |
| <span style="color: #000000">property</span> | The threat's property. Example: **Sinkhole_SinkholedHost**. Either "**class**" or "**property**" is required, but not both. |  |
| confidence | The threat's confidence score, from 0 to 100 (optional). |  |
| domain | The domain string (optional). |  |
| <span style="color: #000000">duration</span> | The duration of the threat, in the **Xd** or **XyXmXwXdXh** format. The expiration date will be set to the detected date + this duration (optional). |  |
| expiration | The expiration is the datetime the threat will be expired. The expiration datetime is in the same format as that of the** detected **field. |  |
| threat_level | The threat's level. This is an integer from 0 to 100 (optional). |  |
| <span style="color: #000000">target</span> | <span style="color: #000000">The threat’s target (optional). For example: “</span><span style="color: #000000">**fakeamazon.com**</span><span style="color: #000000">” is a threat targeting “</span><span style="color: #000000">**amazon.com**</span><span style="color: #000000">”.</span> |  |
| <span style="color: #000000">tld</span> | The top-level domain; a string (optional). |  |

  
The following is an example of data submitted in the XML format: 

```plaintext
<feed>
   <profile>SampleProfile</profile>
   <record_type>ip</record_type>
   <record>
     <ip>127.1.0.1</ip>
    <property>Phishing_Phish</property>
    <detected>20170602T154742Z</detected>
   </record>
   <record>
  <ip>8.8.8.8</ip>
   <property>Scanner_Generic</property>
   <detected>19980927T154242Z</detected>
   <duration>42y0m0w0d42h</duration>
   </record>
  </feed>
```

<span style="color: #000000"> (XML format)</span>  
  
  
The following is an example of data submitted in the CSV format:

```plaintext
record_type,url,profile,detected,property
url,https://example.com/page1.html,SampleProfile,20170602T154742Z,UnwantedContent_Parasite
url,http://example.com/gift.html,SampleProfile,20170602T154742Z,Scam_FakeGiftCard
```

<span style="color: #000000"> (CSV format)</span>

  
The following is an example of data submitted in the JSON format:

```plaintext
  {
    "feed": {
      "profile": "SampleProfile",
      "record_type": "host",
      "record": [
        {"host": "www.example.com", "property": "Scanner_Generic",
          "detected": "19980927T154242Z", "duration":"42y0m0w0d42h"},                  
        {"host": "www.example.com", "property": "Phishing_Phish",
          "detected": "20170602T154742Z"}
        ]
      }
  }
```

<span style="color: #000000"> (JSON format)</span>

The recommended limit for the number of records in a data submission is 50,000. The maximum number of records should not exceed 60,000 at this point in time.  
  
  
The following is an example of data submitted in the JSON format and with additional parameter fields:

```plaintext
{ "feed": {
    "profile": "SampleProfile", 
    "record_type": "host",
    "record": [ 
        { 
            "host": "test-domain.org", 
                        "domain": "example.com", 
                        "class": "CompromisedHost", 
                         "property" : "CompromisedHost_Generic", 
                         "detected": "2024-01-12T00:00:00.000Z",
                         "duration": "90d", 
                         "confidence": 70, 
                         "threat_level": 80 
                }, 
                { 
                         "host": "example.com", 
                         "class": "Sinkhole", 
                         "property" : "Sinkhole_SinkholedHost", 
                         "detected": "2024-01-12T00:00:00.000Z", 
                         "expiration": "2024-03-01T00:00:00.000Z", 
                         "confidence": 30, 
                         "threat_level": 50 
                 }] 
     } 
}
```

<span style="color: #000000"> (JSON format)</span>  


<span style="color: #000000">For additional information, see the following:</span>

- *[Submitting TIDE Data](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35468085)*
- *[Viewing Data Profiles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35402378)*
- *[Creating Data Profiles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35468021)*
- *[Editing Data Profiles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35434702)*
- *[Deactivating and Reactivating Data Profiles](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35434737)*
- *[Creating and Adding Custom TIDE Feeds](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35403424)*
- *[TIDE Custom RPZ Feed](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/60131338)*
- *[TIDE Country Based RPZ Feed](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/60065408)*