{
 "name": "Skopnix: UNC5820 - IPs (historical)",
 "element_type": "IP",
 "element_type_label": "IP",
 "time_to_live": "30 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20UNC5820%20-%20IPs%20%28historical%29&element_type=IP&time_to_live=30%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20UNC5820%20-%20IPs%20%28historical%29  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "104.238.141.143",
  "158.247.199.37",
  "195.85.114.78",
  "45.32.41.202"
 ],
 "elements_detail": [
  {
   "value": "104.238.141.143",
   "last_seen": "2026-10-19",
   "valid_until": "2027-01-17"
  },
  {
   "value": "158.247.199.37",
   "last_seen": "2026-10-19",
   "valid_until": "2027-01-17"
  },
  {
   "value": "195.85.114.78",
   "last_seen": "2026-10-19",
   "valid_until": "2027-01-17"
  },
  {
   "value": "45.32.41.202",
   "last_seen": "2026-10-19",
   "valid_until": "2027-01-17"
  }
 ]
}