Skip to content

Commit 6361d66

Browse files
committed
IDEV-2013: Update README.md
1 parent bb0e087 commit 6361d66

File tree

1 file changed

+27
-3
lines changed

1 file changed

+27
-3
lines changed

README.md

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -223,16 +223,40 @@ Real-Time Threat Intelligence Feeds provide data on the different stages of the
223223
Custom parameters aside from the common `GET` Request parameters:
224224
- `endpoint` (choose either `download` or `feed` API endpoint - default is `feed`)
225225
```python
226-
api = API(USERNAME, KEY)
226+
api = API(USERNAME, KEY, always_sign_api_key=False)
227227
api.nod(endpoint="feed", **kwargs)
228228
```
229229
- `header_authentication`: by default, we're using API Header Authentication. Set this False if you want to use API Key and Secret Authentication. Apparently, you can't use API Header Authentication for `download` endpoints so you need to set this to `False` when calling `download` API endpoints.
230230
```python
231-
api = API(USERNAME, KEY)
231+
api = API(USERNAME, KEY, always_sign_api_key=False)
232232
api.nod(header_authentication=False, **kwargs)
233233
```
234234
- `output_format`: (choose either `csv` or `jsonl` - default is `jsonl`). Cannot be used in `domainrdap` feeds. Additionally, `csv` is not available for `download` endpoints.
235235
```python
236-
api = API(USERNAME, KEY)
236+
api = API(USERNAME, KEY, always_sign_api_key=False)
237237
api.nod(output_format="csv", **kwargs)
238238
```
239+
240+
The Feed API standard access pattern is to periodically request the most recent feed data, as often as every 60 seconds. Specify the range of data you receive in one of two ways:
241+
242+
1. With `sessionID`: Make a call and provide a new `sessionID` parameter of your choosing. The API will return the last hour of data by default.
243+
- Each subsequent call to the API using your `sessionID` will return all data since the last.
244+
- Any single request returns a maximum of 10M results. Requests that exceed 10M results will return a HTTP 206 response code; repeat the same request (with the same `sessionID`) to receive the next tranche of data until receiving a HTTP 200 response code.
245+
2. Or, specify the time range in one of two ways:
246+
- Either an `after=-60` query parameter, where (in this example) -60 indicates the previous 60 seconds.
247+
- Or `after` and `before` query parameters for a time range, with each parameter accepting an ISO-8601 UTC formatted timestamp (a UTC date and time of the format YYYY-MM-DDThh:mm:ssZ)
248+
249+
### Handling iterative response from RTUF endpoints:
250+
251+
Since we may dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
252+
Example:
253+
```python
254+
from domaintools import API
255+
256+
api = API(USERNAME, KEY, always_sign_api_key=False)
257+
results = api.nod(sessionID="my-session-id", after=-7200)
258+
259+
for result in results.response() # generator that holds 2 hours of NOD feeds data
260+
partial_data = result.text # In JSONL format
261+
# do things
262+
```

0 commit comments

Comments
 (0)