{
 "name": "Skopnix: Malicious IPs",
 "element_type": "IP",
 "element_type_label": "IP",
 "time_to_live": "30 days",
 "timeout_type": "LAST_SEEN",
 "create": "POST /api/reference_data/sets?name=Skopnix%3A%20Malicious%20IPs&element_type=IP&time_to_live=30%20days&timeout_type=LAST_SEEN",
 "load": "POST /api/reference_data/sets/bulk_load/Skopnix%3A%20Malicious%20IPs  (body: JSON array of the elements)",
 "feed": "skopnix publishes this set as a feed; load it via the QRadar Reference Data API on a schedule (or Admin > Reference Set Management > Import). Elements age out on the time-to-live, so a retired skopnix indicator stops matching without a manual purge.",
 "elements": [
  "152.32.138.108",
  "154.205.154.82",
  "178.73.192.17",
  "185.172.128.146",
  "198.200.45.112",
  "207.148.120.52",
  "207.148.121.95",
  "209.127.19.241",
  "212.11.64.105",
  "45.133.216.15",
  "46.246.84.17",
  "64.235.60.123"
 ]
}