CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/transit+msgpack:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/transit+json:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
application/edn:
schema:
type: array
items:
title: Mitre tactics
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
techniques:
type: array
items:
title: Mitre techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Account Manipulation
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Account Manipulation".
description:
title: MitreDescription
type: string
example: "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)."
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 68
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078
description: The source url for this tactic or technique
subtechniques:
type: array
items:
title: Mitre Sub-techniques
type: object
properties:
id:
title: MitreID
type: string
example: T1078.100
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: T1078.100
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Additional Cloud Credentials
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: No short-description provided for MITRE Attack Pattern "Additional Cloud Credentials".
description:
title: MitreDescription
type: string
example: "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords)"
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 67
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/T1078/100
description: The source url for this tactic or technique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- subtechniques
description: A MITRE object from https://attack.mitre.org/
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- techniques
description: A MITRE object from https://attack.mitre.org/
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Mitre tactics, techniques, and subtechniques found in an incident
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdMitre
x-operation-id-source: derived
/v2/incident/{incident-id}/targets:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/transit+json:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
application/edn:
schema:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
- count
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Incident Assets
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdTargets
x-operation-id-source: derived
/v2/incident/{incident-id}/observables:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
application/edn:
schema:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- count
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of observables linked to this incident
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdObservables
x-operation-id-source: derived
/v2/incident/{incident-id}/indicators:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/transit+json:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
application/edn:
schema:
type: array
items:
type: object
properties:
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
producer:
type: string
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
internal:
type: boolean
source:
type:
- string
- 'null'
source_uri:
type:
- string
- 'null'
sources:
type: array
items:
type: string
tags:
type:
- array
- 'null'
items:
type: string
title:
type:
- string
- 'null'
value:
type: string
required:
- id
- producer
- description
- short_description
- internal
- source
- source_uri
- sources
- tags
- title
- value
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of indicators linked to this incident
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdIndicators
x-operation-id-source: derived
/v2/incident/{incident-id}/entities:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
application/edn:
schema:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of entities associated with this incident
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
operationId: getV2IncidentByIncidentIdEntities
x-operation-id-source: derived
/v2/incident/{incident-id}/events:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/transit+json:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/edn:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: sort
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- asc
- desc
- in: query
name: order
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- start_time
- time
- title
- severity
- source
- in: query
name: important_only
description: Include only important events
required: false
schema:
type: boolean
- in: query
name: notable
description: ''
required: false
schema:
type: boolean
- in: query
name: source
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: severity
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- in: query
name: type
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Original
- Investigated
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Original
- Investigated
- in: query
name: search_text
description: ''
required: false
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of events linked to this incident
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
operationId: getV2IncidentByIncidentIdEvents
x-operation-id-source: derived
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/transit+json:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
application/edn:
schema:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
id:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
observed_time:
type: object
properties:
start_time:
type: string
end_time:
type:
- string
- 'null'
required:
- start_time
type:
type: string
enum:
- sighting
context: {}
data:
type: object
properties:
columns:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
enum:
- integer
- markdown
- number
- observable
- string
- url
description:
type:
- string
- 'null'
required:
type: boolean
short_description:
type:
- string
- 'null'
required:
- name
- type
rows:
type: array
items: {}
row_count:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
required:
- columns
- rows
external_ids:
type: array
items:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
internal:
type: boolean
language:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
resolution:
type: string
enum:
- allowed
- blocked
- contained
- detected
sensor:
type: string
sensor_coordinates:
type: object
properties:
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
os:
type: string
type:
type: string
required:
- observables
- type
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_description:
type: string
source:
type: string
source_uri:
type: string
timestamp:
type: string
compacted_entities:
type: array
items:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
compacted_relations:
type: array
items:
type: object
properties:
source:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
related:
type: object
properties:
type:
type: string
is_asset:
type: boolean
observables:
title: Entity.Observables
type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
uniqueItems: true
- type: array
items:
type: object
properties:
type:
type: string
value:
type: string
is_asset:
type: boolean
modules:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
sources:
type: array
items:
type:
- string
- 'null'
uniqueItems: true
disposition:
type: integer
format: int64
investigated:
type: boolean
asset_id:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
observed_times:
type: array
items:
type: string
uniqueItems: true
required:
- type
- value
- disposition
description: Observables or Attributes for a grouped Entity
value:
type: string
observableType:
type: string
disposition:
type: integer
format: int64
investigated:
type:
- boolean
- 'null'
count:
type: integer
format: int64
sightings:
type: array
items:
type: string
x-anyOf:
- type: string
- type: string
format: uuid
uniqueItems: true
required:
- type
- value
- disposition
relation:
type: string
origin:
type: string
required:
- source
- related
- relation
uniqueItems: true
title:
type:
- string
- 'null'
tlp:
type: string
enum:
- amber
- green
- red
- white
notability:
type: object
properties:
first_seen_target:
type: object
properties:
label:
type: string
targets:
type: array
items: {}
uniqueItems: true
required:
- label
- targets
severity:
type: object
properties:
label:
type: string
required:
- label
mitre-attack:
type: object
properties:
label:
type: string
required:
- label
first_seen_indicator:
type: object
properties:
label:
type: string
indicators:
type: array
items: {}
uniqueItems: true
required:
- label
- indicators
original_event:
type: object
properties:
label:
type: string
required:
- label
mitreData:
type: array
items:
type: object
properties:
id:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
value:
type: string
enum:
- TA0004
- TA0010
- TA0005
- TA0001
- TA0009
- TA0002
- TA0040
- TA0043
- TA0011
- TA0008
- TA0042
- TA0006
- TA0007
- TA0003
phase_name:
type: string
enum:
- privilege-escalation
- exfiltration
- defense-evasion
- initial-access
- collection
- execution
- impact
- reconnaissance
- command-and-control
- lateral-movement
- resource-development
- credential-access
- discovery
- persistence
priority:
type: integer
enum:
- 6
- 12
- 7
- 3
- 10
- 4
- 13
- 1
- 11
- 9
- 2
- 8
- 8
- 5
url:
type: string
enum:
- https://attack.mitre.org/tactics/TA0004/
- https://attack.mitre.org/tactics/TA0010/
- https://attack.mitre.org/tactics/TA0005/
- https://attack.mitre.org/tactics/TA0001/
- https://attack.mitre.org/tactics/TA0009/
- https://attack.mitre.org/tactics/TA0002/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/tactics/TA0043/
- https://attack.mitre.org/tactics/TA0011/
- https://attack.mitre.org/tactics/TA0008/
- https://attack.mitre.org/tactics/TA0042/
- https://attack.mitre.org/tactics/TA0006/
- https://attack.mitre.org/tactics/TA0007/
- https://attack.mitre.org/tactics/TA0003/
title:
type: string
enum:
- Privilege Escalation
- Exfiltration
- Defense Evasion
- Initial Access
- Collection
- Execution
- Impact
- Reconnaissance
- Command and Control
- Lateral Movement
- Resource Development
- Credential Access
- Discovery
- Persistence
required:
- id
- value
- phase_name
- priority
- url
- title
uniqueItems: true
notable:
type: boolean
original:
type: boolean
indicators:
type: array
items:
type: object
properties:
id:
type: string
example: string
description: Globally unique URI identifying this object.
type:
type: string
enum:
- indicator
example: indicator
description: The fixed value indicator
schema_version:
type: string
example: 1.3.30
description: CTIM schema version for this entity.
revision:
type: integer
format: int64
example: 10
description: A monotonically increasing revision, incremented each time the object is changed.
external_ids:
type: array
items:
type: string
example: string
example:
- string
description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
description:
type: string
example: string
description: Markdown string with at most 5000 characters.
url:
type: string
example: string
description: A URL reference to an external resource.
hashes:
type: array
items:
type: string
example: string
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
external_id:
type: string
example: string
description: An identifier for the external reference content.
required:
- source_name
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
example:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
timestamp:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: The time this object was created at, or last modified.
language:
type: string
example: string
description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.
For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.'
tlp:
type: string
enum:
- amber
- green
- red
- white
example: green
description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc.
It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know.
For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.'
title:
type: string
example: string
description: A short title for this object, used as primary display and reference value.
description:
type:
- string
- 'null'
example: string
description: A description of object, which may be detailed.
short_description:
type:
- string
- 'null'
example: string
description: A single line, short summary of the object.
source:
type:
- string
- 'null'
example: string
description: Represents the source of the intelligence that led to the creation of the entity.
source_uri:
type:
- string
- 'null'
example: string
description: URI of the source of the intelligence that led to the creation of the entity.
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If not present, the valid time position of the indicator does not have an upper bound.
end_time:
type: string
format: date-time
example: '2016-01-01T01:01:01Z'
description: If end_time is not present, then the valid time position of the object does not have an upper bound.
example:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
description: The time range during which this Indicator is considered valid.
producer:
type: string
example: string
description: String with at most 1024 characters.
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
example: Critical
negate:
type: boolean
example: true
description: Specifies the absence of the pattern.
indicator_type:
type: array
items:
type: string
enum:
- Anonymization
- C2
- Compromised PKI Certificate
- Domain Watchlist
- Exfiltration
- File Hash Watchlist
- Host Characteristics
- IMEI Watchlist
- IMSI Watchlist
- IP Watchlist
- Login Name
- Malicious E-mail
- Malware Artifacts
- Private Threat Feed
- URL Watchlist
example: Anonymization
example:
- Anonymization
description: Specifies the type or types for this Indicator.
tags:
type:
- array
- 'null'
items:
type: string
example:
- string
description: Descriptors for this indicator.
composite_indicator_expression:
type: object
properties:
operator:
type: string
enum:
- and
- not
- or
example: and
indicator_ids:
type: array
items:
type: string
example: string
description: A URI leading to an indicator.
example:
- string
required:
- operator
- indicator_ids
example:
operator: and
indicator_ids:
- string
likely_impact:
type: string
example: string
description: Likely potential impact within the relevant context if this Indicator were to occur.
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
description: level of confidence held in the accuracy of this Indicator.
kill_chain_phases:
type: array
items:
type: object
properties:
kill_chain_name:
type: string
example: string
description: The name of the kill chain.
phase_name:
type: string
example: string
description: The name of the phase in the kill chain.
required:
- kill_chain_name
- phase_name
example:
kill_chain_name: string
phase_name: string
description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives.
example:
- kill_chain_name: string
phase_name: string
description: Relevant kill chain phases indicated by this Indicator.
test_mechanisms:
type: array
items:
type: string
example: string
description: String with at most 2048 characters.
example:
- string
description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator.
specification:
type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
x-anyOf:
- type: object
properties:
type:
type: string
enum:
- Judgement
example: Judgement
judgements:
type: array
items:
type: string
example: string
description: A URI leading to a judgement.
example:
- string
required_judgements:
type: array
items:
type: object
properties:
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
example: High
source:
type: string
example: string
relationship:
type: string
example: string
judgement_id:
type: string
example: string
description: A URI leading to a judgement.
required:
- judgement_id
example:
confidence: High
source: string
relationship: string
judgement_id: string
example:
- confidence: High
source: string
relationship: string
judgement_id: string
required:
- type
- judgements
- required_judgements
example:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match.
- type: object
properties:
type:
type: string
enum:
- ThreatBrain
example: ThreatBrain
query:
type: string
example: string
variables:
type: array
items:
type: string
example: string
example:
- string
required:
- type
- variables
example:
type: ThreatBrain
query: string
variables:
- string
description: An indicator which runs in threatbrain...
- type: object
properties:
type:
type: string
enum:
- Snort
example: Snort
snort_sig:
type: string
example: string
required:
- type
- snort_sig
example:
type: Snort
snort_sig: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- SIOC
example: SIOC
SIOC:
type: string
example: string
required:
- type
- SIOC
example:
type: SIOC
SIOC: string
description: An indicator which runs in snort...
- type: object
properties:
type:
type: string
enum:
- OpenIOC
example: OpenIOC
open_IOC:
type: string
example: string
required:
- type
- open_IOC
example:
type: OpenIOC
open_IOC: string
description: An indicator which contains an XML blob of an openIOC indicator.
value:
title: Event.Indicator.Value
type: string
example: W32.AdditionVariableCommandObfuscation.ioc
description: The canonical label for an indicator.
required:
- id
- producer
- value
example:
description: string
tags:
- string
valid_time:
start_time: '2016-01-01T01:01:01Z'
end_time: '2016-01-01T01:01:01Z'
producer: string
schema_version: 1.3.30
revision: 10
type: indicator
test_mechanisms:
- string
source: string
external_ids:
- string
short_description: string
composite_indicator_expression:
operator: and
indicator_ids:
- string
title: string
likely_impact: string
indicator_type:
- Anonymization
external_references:
- source_name: string
description: string
url: string
hashes:
- string
external_id: string
source_uri: string
language: string
id: string
severity: Critical
tlp: green
kill_chain_phases:
- kill_chain_name: string
phase_name: string
negate: true
timestamp: '2016-01-01T01:01:01Z'
confidence: High
specification:
type: Judgement
judgements:
- string
required_judgements:
- confidence: High
source: string
relationship: string
judgement_id: string
description: 'An indicator is a test, or a collection of judgements that define
criteria for identifying the activity, or presence of malware, or
other unwanted software.
We follow the
[STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/)
closely, with the exception of not including observables within the
indicator, and preferring a _specification_ object encoded in JSON as
opposed to an opaque _implementation_ block.
Additional, you will want to either define judgements against
Observables that are linked to this indicator, with the ID in the
_indicators_ field of those Judgements, or you can provide a
_specification_ value.'
investigationId:
type:
- string
- 'null'
investigationShortDescription:
type:
- string
- 'null'
investigationSource:
type:
- string
- 'null'
targets:
type: array
items:
type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
relations:
type: array
items:
type: object
properties:
origin:
type: string
relation:
type: string
related:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
source:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
x-anyOf:
- type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
- type: object
properties:
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
type:
title: TargetTypeEnum
type: string
enum:
- device
- person
- user
- email
- endpoint.sensor
- process.network-scanner
- network.switch
- network.security_manager
- process.vulnerability-scanner
- network.hub
- network.ids
- network.firewall
- process
- network.sense_making
- process.sandbox
- network.modem
- process.email-service
- process.dns-server
- network.vpn
- process.connection-scanner
- network.nic
- endpoint.printer
- network.gateway
- process.reputation-service
- process.remediation-service
- network
- process.virtualization-service
- network.ips
- endpoint.smart-meter
- endpoint.digital-telephone-handset
- endpoint.workstation
- endpoint.server
- network.wap
- endpoint.laptop
- process.aaa-server
- process.directory-service
- endpoint.pos-terminal
- network.bridge
- process.file-scanner
- network.proxy
- endpoint
- process.location-service
- network.sensor
- endpoint.smart-phone
- network.hips
- process.anti-virus-scanner
- endpoint.tablet
- network.guard
- network.router
example: endpoint
description: The targe type/actuator that best fits the device.
value:
title: TargetSummary.Value
type: string
example: CARGO-Example
description: The targe type/actuator that best fits the device.
asset_value:
title: PositiveInteger
type:
- integer
- 'null'
format: int64
minimum: 0
description: The numerical value of the Device. Will Default to 10 if the Target is resolved.
example: 2
default: 7
is_asset:
title: TargetSummary.IsAssetEnum
enum:
- true
type: boolean
example: true
description: Always true for targets.
observableType:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The observable type of the defining target observable
observables:
title: TargetSummary.Observables
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
uniqueItems: true
description: The observable type of the defining target observable
asset_id:
title: TargetSummary.AssetId
type:
- string
- 'null'
example: 4911bbf5-aa42-463b-9a47-65f24140cfe4
description: The Device/User Insights ID of this Person or Device.
properties:
title: TargetSummary.Properties
type: array
items:
type: object
properties:
name:
title: Property.Name
type: string
description: An open vocabulary string that describes the name of the property.
example: cisco:ctr:labels
value:
title: Property.Value
type: string
x-anyOf:
- type: string
- type: integer
format: int64
- type: array
items: {}
description: The value of the named property.
example:
- example label
- 1
- - it can be a string or an int or a vector of anything
required:
- name
- value
uniqueItems: true
description: The List of Device or Person properties for this resolved Person/Device.
required:
- type
- value
- is_asset
- observableType
- observables
- asset_id
- properties
origin_uri:
type: string
relation_info: {}
required:
- origin
- relation
- related
- source
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
disposition:
title: DispositionEnum
type: integer
enum:
- 1
- 2
- 3
- 4
- 5
example: 1
description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown.
title:
title: DecoratedObservable.Title
type: string
example: 1234...abcd
description: A displayable (truncated) version of the value of this observable.
internal:
title: DecoratedObservable.Internal
type: boolean
example: true
description: If this observable was seen in an internal event.
sources:
title: DecoratedObservable.Sources
type:
- array
- 'null'
items:
type: string
example: string
description: String with at most 1024 characters.
example:
- Crowdstrike
description: The sources that reported this observable
is_asset:
title: DecoratedObservable.IsAssetFalse
enum:
- false
description: An Indicator if this is a Device or Target.
example: false
type: boolean
investigated:
title: Investigated
type: boolean
example: false
description: If this specific observable was part of an investigation
required:
- type
- value
- disposition
- title
- is_asset
- investigated
tactics_and_techniques:
type: array
items:
title: Mitre tactics and Techniques
type: object
properties:
id:
title: MitreID
type: string
example: TA0003
description: MITRE ATT&CK ID
external_id:
title: MitreExternalId
type: string
example: TA0003
description: MITRE ATT&CK ID
title:
title: MitreTitle
type: string
example: Persistence
short_description:
title: MitreShortDescription
type:
- string
- 'null'
example: Persistence
description:
title: MitreDescription
type: string
example: 'The adversary is trying to maintain their foothold.
Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.'
score:
title: MitreScore
type:
- integer
- 'null'
format: int64
minimum: 1
maximum: 1000
example: 44
source_url:
title: MitreSourceURL
type:
- string
- 'null'
example: https://attack.mitre.org/techniques/TA0003
description: The source url for this tactic or technique
mitre_type:
type: string
enum:
- tactic
- technique
- subtechnique
required:
- id
- external_id
- title
- short_description
- description
- score
- source_url
- mitre_type
description: A MITRE object from https://attack.mitre.org/
required:
- confidence
- count
- id
- observed_time
- type
- notable
- original
- targets
- relations
- observables
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
- description: A integer greater than 0.
name: limit
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- description: A integer greater than 0.
name: offset
title: PositiveInteger
example: 2
required: false
in: query
schema:
type: integer
format: int64
minimum: 0
- in: query
name: sort
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- asc
- desc
- in: query
name: order
description: ''
required: false
allowEmptyValue: true
schema:
type: string
enum:
- start_time
- time
- title
- severity
- source
- in: query
name: important_only
description: Include only important events
required: false
schema:
type: boolean
- in: query
name: notable
description: ''
required: false
schema:
type: boolean
- in: query
name: source
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
- in: query
name: severity
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
- in: query
name: type
description: ''
required: false
x-anyOf:
- type: array
items:
type: string
enum:
- Original
- Investigated
- type: string
allowEmptyValue: true
schema:
type: array
items:
type: string
enum:
- Original
- Investigated
- in: query
name: search_text
description: ''
required: false
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of events linked to this incident
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
requestBody:
content:
application/json:
schema:
type:
- object
- 'null'
properties:
sightings:
type: array
items:
type: string
description: sighting_ids for requested events
example:
- 0a38949f-d192-4d30-91ae-e593c1f57c14
application/transit+msgpack:
schema:
type:
- object
- 'null'
properties:
sightings:
type: array
items:
type: string
description: sighting_ids for requested events
example:
- 0a38949f-d192-4d30-91ae-e593c1f57c14
application/transit+json:
schema:
type:
- object
- 'null'
properties:
sightings:
type: array
items:
type: string
description: sighting_ids for requested events
example:
- 0a38949f-d192-4d30-91ae-e593c1f57c14
application/edn:
schema:
type:
- object
- 'null'
properties:
sightings:
type: array
items:
type: string
description: sighting_ids for requested events
example:
- 0a38949f-d192-4d30-91ae-e593c1f57c14
operationId: postV2IncidentByIncidentIdEvents
x-operation-id-source: derived
/v2/incident/{incident-id}/status:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
completed:
type: integer
format: int64
pending:
type: integer
format: int64
sightings:
type: integer
format: int64
indicators:
type: integer
format: int64
verdicts:
type: integer
format: int64
incident_id:
type: string
format: uuid
short_id:
type:
- string
- 'null'
required:
- completed
- pending
- sightings
- indicators
- verdicts
- incident_id
application/transit+msgpack:
schema:
type: object
properties:
completed:
type: integer
format: int64
pending:
type: integer
format: int64
sightings:
type: integer
format: int64
indicators:
type: integer
format: int64
verdicts:
type: integer
format: int64
incident_id:
type: string
format: uuid
short_id:
type:
- string
- 'null'
required:
- completed
- pending
- sightings
- indicators
- verdicts
- incident_id
application/transit+json:
schema:
type: object
properties:
completed:
type: integer
format: int64
pending:
type: integer
format: int64
sightings:
type: integer
format: int64
indicators:
type: integer
format: int64
verdicts:
type: integer
format: int64
incident_id:
type: string
format: uuid
short_id:
type:
- string
- 'null'
required:
- completed
- pending
- sightings
- indicators
- verdicts
- incident_id
application/edn:
schema:
type: object
properties:
completed:
type: integer
format: int64
pending:
type: integer
format: int64
sightings:
type: integer
format: int64
indicators:
type: integer
format: int64
verdicts:
type: integer
format: int64
incident_id:
type: string
format: uuid
short_id:
type:
- string
- 'null'
required:
- completed
- pending
- sightings
- indicators
- verdicts
- incident_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns the underlying incident's investigation status with surrounding threat…
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdStatus
x-operation-id-source: derived
post:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Update an incident status
security:
- JWT-Bearer: []
- oauth2: []
requestBody:
content:
application/json:
schema:
type: object
properties:
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
required:
- status
application/transit+msgpack:
schema:
type: object
properties:
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
required:
- status
application/transit+json:
schema:
type: object
properties:
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
required:
- status
application/edn:
schema:
type: object
properties:
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
required:
- status
required: true
operationId: postV2IncidentByIncidentIdStatus
x-operation-id-source: derived
/v2/incident/{incident-id}/event-filters:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
severity:
type:
- array
- 'null'
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
type:
type:
- array
- 'null'
items:
type: string
enum:
- Original
- Investigated
source:
type:
- array
- 'null'
items:
type: string
required:
- severity
- type
- source
application/transit+msgpack:
schema:
type: object
properties:
severity:
type:
- array
- 'null'
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
type:
type:
- array
- 'null'
items:
type: string
enum:
- Original
- Investigated
source:
type:
- array
- 'null'
items:
type: string
required:
- severity
- type
- source
application/transit+json:
schema:
type: object
properties:
severity:
type:
- array
- 'null'
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
type:
type:
- array
- 'null'
items:
type: string
enum:
- Original
- Investigated
source:
type:
- array
- 'null'
items:
type: string
required:
- severity
- type
- source
application/edn:
schema:
type: object
properties:
severity:
type:
- array
- 'null'
items:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
type:
type:
- array
- 'null'
items:
type: string
enum:
- Original
- Investigated
source:
type:
- array
- 'null'
items:
type: string
required:
- severity
- type
- source
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns the available filter params for this incident's events
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
operationId: getV2IncidentByIncidentIdEventFilters
x-operation-id-source: derived
/v2/incident/{incident-id}/verdicts:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/transit+json:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
application/edn:
schema:
type: array
items:
type: object
properties:
type:
type: string
observable:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
valid_time:
type: object
properties:
start_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
end_time:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
- {}
required:
- start_time
- end_time
disposition:
type: integer
format: int64
judgement_ids:
type:
- array
- 'null'
items:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module:
type: string
module_instance_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
module_type_id:
type: string
format: uuid
x-anyOf:
- type: string
format: uuid
- type: string
required:
- type
- observable
- valid_time
- disposition
- judgement_ids
- module
- module_instance_id
- module_type_id
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of events linked to this incident
security:
- JWT-Bearer: []
- oauth2: []
- JWT-Bearer: []
operationId: getV2IncidentByIncidentIdVerdicts
x-operation-id-source: derived
/v2/incident/{incident-id}/graph:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/transit+msgpack:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/transit+json:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
application/edn:
schema:
type: object
properties:
nodes:
type: object
additionalProperties:
type: object
properties:
data:
type: object
properties:
type:
type: string
value:
type: string
asset_id:
type: string
disposition:
type: integer
format: int64
indicators:
type: array
items:
type: string
uniqueItems: true
internal:
type: boolean
incoming-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
outgoing-edges:
type: array
items:
type: object
properties:
id:
type: string
value:
type: string
required:
- id
- value
uniqueItems: true
investigated:
type: boolean
is_asset:
type: boolean
observableType:
type: string
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
disposition:
type: integer
format: int64
investigated:
type: boolean
required:
- type
- value
- disposition
- investigated
properties:
type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
x-anyOf:
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
uniqueItems: true
- type: array
items:
type: object
properties:
name:
type: string
value: {}
required:
- name
- value
modules:
type: array
items:
type: string
uniqueItems: true
sightings:
type: array
items:
type: string
uniqueItems: true
sources:
type: array
items:
type: string
uniqueItems: true
title:
type: string
actions_taken:
title: ActionsTaken
type: array
items:
title: ActionTaken
type: object
properties:
id:
title: ActionTaken.Id
type: uuid
description: The ID of the Action Instance
example: 6969efcd-825f-4146-bcb7-a42598c9f624
action:
title: ActionTaken.Action
type: string
description: The direct action that was taken (blocked, quarantined ...)
example: blocked
description:
title: ActionTaken.Description
type:
- string
- 'null'
example: A sha256 was quarantined during view Investigation.
description: A string between 1 and 2500 characters representing the markdown content.
reason:
title: ActionTaken.Reason
type:
- string
- 'null'
example: Policy Disabled
description: The reason for the failure
source:
title: ActionTaken.Source
type:
- string
- 'null'
example: Crowdstrike
description: The source of the alert
source_url:
title: ActionTaken.SourceURL
type:
- string
- 'null'
example: Crowdstrike
description: The product specific url of the alert
started_at:
title: ActionTaken.StartedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was triggered.
example: '2026-08-18T22:03:26.573144903Z'
completed_at:
title: ActionTaken.CompletedAt
type:
- string
- 'null'
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
description: The time the action was completed
example: '2026-08-18T22:03:26.573166824Z'
status:
title: ActionTaken.Status
type: string
example: completed
description: completed, failed, unknown
observable:
title: ActionTaken.Observable
type:
- object
- 'null'
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description: the process hash or file that was acted on
count:
title: ActionTaken.Count
type:
- integer
- 'null'
format: int64
description: The number of times this action was taken
example: 1
required:
- id
- action
- description
- reason
- source
- source_url
- started_at
- completed_at
- status
description: An action reported by a data source or XDR Automation.
description: The actions that were taken on a device, entity, or observable.
required:
- type
- value
- indicators
- internal
- incoming-edges
- outgoing-edges
- investigated
- is_asset
- observableType
- observables
- modules
- sightings
- sources
- title
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
required:
- data
- times
edges:
type: object
additionalProperties:
type: object
properties:
id1:
type: string
id2:
type: string
times:
type: array
items:
type: object
properties:
time:
type: integer
format: int64
required:
- time
uniqueItems: true
data:
type: object
properties:
observed_times:
type: array
items:
type: string
uniqueItems: true
value:
type: string
sightings:
type: array
items:
type: string
uniqueItems: true
relation_info: {}
required:
- value
- sightings
required:
- id1
- id2
- times
- data
errors:
type: array
items:
type: object
properties:
type:
type: string
enum:
- E_DATA_TOO_LARGE
message:
type: string
required:
- type
- message
required:
- nodes
- edges
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a graph representation of this incident
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdGraph
x-operation-id-source: derived
/v2/incident/{incident-id}/linked-casebooks:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
application/edn:
schema:
type: array
items:
type: object
properties:
bundle:
type: object
properties:
id:
type: string
description:
type: string
attack_patterns:
type: array
items:
type: object
properties: {}
assets:
type: array
items:
type: object
properties: {}
asset_properties:
type: array
items:
type: object
properties: {}
asset_mappings:
type: array
items:
type: object
properties: {}
casebooks:
type: array
items:
type: object
properties: {}
indicators:
type: array
items:
type: object
properties: {}
judgements:
type: array
items:
type: object
properties: {}
malwares:
type: array
items:
type: object
properties: {}
modules:
type: array
items:
type: object
properties: {}
relationships:
type: array
items:
type: object
properties: {}
sightings:
type: array
items:
type: object
properties: {}
verdicts:
type: array
items:
type: object
properties: {}
tools:
type: array
items:
type: object
properties: {}
texts:
type: array
items:
type: object
properties:
text:
type: string
type:
type: string
required:
- text
- type
observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- casebook
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Return Linked Casebooks
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdLinkedCasebooks
x-operation-id-source: derived
/v2/incident/{incident-id}/linked-incidents:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/transit+json:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
application/edn:
schema:
type: array
items:
type: object
properties:
assignees:
type: array
items:
type: string
categories:
type: array
items:
type: string
enum:
- Attrition
- Denial of Service
- Exercise
- Exercise/Network Defense Testing
- Explained Anomaly
- Forensics
- Improper Usage
- Intelligence
- Investigating
- Investigation
- Malicious Code
- Malicious Logic
- Non-Compliant
- Reconnaissance
- Root Level
- Scans/Probes/Attempted Access
- Unauthorized Access
- Unsuccessful
- User Level
- eDiscovery
confidence:
type: string
enum:
- High
- Info
- Low
- Medium
- None
- Unknown
detection_sources:
type: array
items:
type: string
detection_status:
title: DetectionStatusType
type: string
enum:
- active
- inactive_merged
- inactive_expired
- inactive_oversized
- inactive_user_closed
description: Whether the incident is actively receiving detection data updates
discovery_method:
type: string
enum:
- SecureX Threat Hunting
- Agent Disclosure
- Antivirus
- Audit
- Customer
- External - Fraud Detection
- Financial Audit
- HIPS
- IT Audit
- Incident Response
- Internal - Fraud Detection
- Law Enforcement
- Log Review
- Monitoring Service
- NIDS
- Security Alarm
- Unknown
- Unrelated Party
- User
incident_time:
type: object
properties:
opened:
type: string
closed:
type: string
discovered:
type: string
rejected:
type: string
remediated:
type: string
reported:
type: string
required:
- opened
intended_effect:
type: string
enum:
- Account Takeover
- Advantage
- Advantage - Economic
- Advantage - Military
- Advantage - Political
- Brand Damage
- Competitive Advantage
- Degradation of Service
- Denial and Deception
- Destruction
- Disruption
- Embarrassment
- Exposure
- Extortion
- Fraud
- Harassment
- ICS Control
- Theft
- Theft - Credential Theft
- Theft - Identity Theft
- Theft - Intellectual Property
- Theft - Theft of Proprietary Information
- Traffic Diversion
- Unauthorized Access
meta:
type: object
properties:
ai_description:
type: boolean
helios_report_generated:
type: boolean
promotion_method:
type: string
enum:
- Automated
- Manual
scores:
type: object
properties:
asset:
type: integer
format: int64
minimum: 0
maximum: 10
global:
type: integer
format: int64
minimum: 0
maximum: 1000
ml_score:
type: number
format: double
ttp:
type: integer
format: int64
minimum: 0
maximum: 100
severity:
type: string
enum:
- Critical
- High
- Info
- Low
- Medium
- None
- Unknown
short_id:
type: string
status:
title: IncidentStatusType
type: string
enum:
- New
- Closed
- 'Open: Recovered'
- 'Closed: Other'
- 'Hold: Internal'
- 'Hold: Legal'
- 'Closed: Under Review'
- Rejected
- Open
- 'Closed: Merged'
- Restoration Achieved
- Incident Reported
- 'Closed: Suspected'
- Stalled
- 'Open: Contained'
- 'Closed: Near-Miss'
- 'Hold: External'
- Containment Achieved
- 'New: Processing'
- 'Closed: Confirmed Threat'
- 'Closed: False Positive'
- 'Open: Reported'
- 'Open: Investigating'
- Hold
- 'New: Presented'
description: The status of the incident
tactics:
type: array
items:
type: string
techniques:
type: array
items:
type: string
description:
type: string
short_description:
type: string
source:
type: string
source_uri:
type: string
title:
type: string
language:
type: string
external_references:
type: array
items:
type: object
properties:
source_name:
type: string
hashes:
type: array
items:
type: string
url:
type: string
description:
type: string
external_id:
type: string
required:
- source_name
external_ids:
type: array
items:
type: string
tlp:
type: string
enum:
- amber
- green
- red
- white
id:
type: string
client_id:
type: string
modified:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
created:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
owner:
type:
- string
- 'null'
x-anyOf:
- type: string
- type: boolean
groups:
type: array
items:
type: string
schema_version:
type: string
revision:
title: PositiveInteger
type: integer
format: int64
minimum: 0
description: A integer greater than 0.
example: 2
type:
type: string
enum:
- incident
timestamp:
type: string
format: date-time
x-anyOf:
- type: string
format: date-time
- type: string
required:
- confidence
- incident_time
- status
- id
- groups
- schema_version
- type
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns linked incidents
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdLinkedIncidents
x-operation-id-source: derived
/v2/incident/{incident-id}/primary-investigation:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
application/transit+msgpack:
schema:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
application/transit+json:
schema:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
application/edn:
schema:
type: object
properties:
id:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
description:
type:
- string
- 'null'
source:
type:
- string
- 'null'
required:
- id
- short_description
- description
- source
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns linked investigations
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdPrimaryInvestigation
x-operation-id-source: derived
/v2/incident/{incident-id}/errors:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: array
items:
type: object
properties:
module_instance_id:
type: string
format: uuid
module_type_id:
type: string
format: uuid
module:
type:
- string
- 'null'
type:
type: string
enum:
- fatal
- warning
- error
code:
type: string
message:
type: string
required:
- module_instance_id
- module_type_id
- type
- code
- message
application/transit+msgpack:
schema:
type: array
items:
type: object
properties:
module_instance_id:
type: string
format: uuid
module_type_id:
type: string
format: uuid
module:
type:
- string
- 'null'
type:
type: string
enum:
- fatal
- warning
- error
code:
type: string
message:
type: string
required:
- module_instance_id
- module_type_id
- type
- code
- message
application/transit+json:
schema:
type: array
items:
type: object
properties:
module_instance_id:
type: string
format: uuid
module_type_id:
type: string
format: uuid
module:
type:
- string
- 'null'
type:
type: string
enum:
- fatal
- warning
- error
code:
type: string
message:
type: string
required:
- module_instance_id
- module_type_id
- type
- code
- message
application/edn:
schema:
type: array
items:
type: object
properties:
module_instance_id:
type: string
format: uuid
module_type_id:
type: string
format: uuid
module:
type:
- string
- 'null'
type:
type: string
enum:
- fatal
- warning
- error
code:
type: string
message:
type: string
required:
- module_instance_id
- module_type_id
- type
- code
- message
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns a list of errors reported by the attached investigations
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdErrors
x-operation-id-source: derived
/v2/incident/{incident-id}/overview:
get:
responses:
'405':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Method Not Allowed
required:
- message
default:
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- unspecified status
required:
- message
'429':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Too many requests
required:
- message
'401':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Unauthorized
required:
- message
'500':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- exception
- default exception
- sql exception
- JSON too large
- schema
- external_request
exception:
type: string
example: SqlException
data:
example:
example: Bad Request
description: Any specific error information passed by custom errors.
uri:
type: string
example: /global/v1/incident/?/incident-summary
description: The URI the error was seen at
required:
- message
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
owner:
type: string
short_id:
type:
- string
- 'null'
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
- owner
application/transit+msgpack:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
owner:
type: string
short_id:
type:
- string
- 'null'
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
- owner
application/transit+json:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
owner:
type: string
short_id:
type:
- string
- 'null'
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
- owner
application/edn:
schema:
type: object
properties:
id:
type: string
format: uuid
created_at:
type: string
format: date-time
description:
type:
- string
- 'null'
short_description:
type:
- string
- 'null'
saved:
type: boolean
saved_at:
type:
- string
- 'null'
format: date-time
investigated_observables:
type: array
items:
type: object
properties:
type:
title: ObservableType
type: string
enum:
- none
- file_path
- mac_address
- trend_micro_id
- cybereason_id
- process_args
- s1_agent_id
- device
- hostname
- certificate_common_name
- serial_number
- meraki_network_id
- url
- jamf_management_id
- certificate_serial
- intune_id
- meraki_org_id
- cisco_cm_id
- registry_key
- process_path
- darktrace_id
- process_username
- cortex_agent_id
- orbital_node_id
- process_uid
- ngfw_name
- user
- certificate_issuer
- ipv6
- email
- cisco_uc_id
- cvm_id
- sha256
- crowdstrike_id
- google_cloud_id
- google_chromebook_id
- acudid
- sha1
- registry_name
- md5
- service_now_id
- ip
- domain
- email_subject
- imei
- ngfw_id
- amp_computer_guid
- ms_machine_id
- secure_access_id
- mutex
- processor_id
- swc_device_id
- registry_path
- odns_identity
- odns_identity_label
- cisco_mid
- process_name
- pki_serial
- meraki_node_sn
- email_messageid
- imsi
- user_agent
- process_hash
- file_name
description: The type of the observable
example: domain
value:
title: Observable.Value
type: string
example: ilo.brenz.pl
description: The value of the observable.
required:
- type
- value
title:
type: string
owner:
type: string
short_id:
type:
- string
- 'null'
required:
- id
- created_at
- description
- short_description
- saved
- saved_at
- investigated_observables
- title
- owner
'404':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Found
required:
- message
'400':
description: ''
content:
application/json:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message: {}
required:
- message
application/transit+json:
schema:
type: object
properties:
message: {}
required:
- message
application/edn:
schema:
type: object
properties:
message: {}
required:
- message
'403':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Forbidden
required:
- message
'406':
description: ''
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+msgpack:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/transit+json:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
application/edn:
schema:
type: object
properties:
message:
type: string
enum:
- Not Acceptable
required:
- message
parameters:
- in: path
name: incident-id
description: The non-URL qualified ID of the incident
required: true
example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14
schema:
type: string
tags:
- Incident Overview
summary: Returns baseline incident information
security:
- JWT-Bearer: []
- oauth2: []
operationId: getV2IncidentByIncidentIdOverview
x-operation-id-source: derived
components:
securitySchemes:
JWT-Bearer:
type: apiKey
name: Authorization
in: header
oauth2:
type: oauth2
flows:
authorizationCode:
scopes:
event:read: Get event information for an org. Needed to get full report information.
private-intel:read: Read data from private intel. Needed to get investigation data.
private-intel: Full private intel integration scope.
asset: Get Data from Device Insights. Needed during running investigations.
enrich:read: Fetch Data about observables. Needed for investigations.
integration:read: Get module information. Needed to create a new investigation.
investigation: Run investigations. Needed for investigations.
casebook: Full casebook management access. Allows read, write to casebooks.
casebook:read: Read Casebook access
global-intel:read: Read data from public intel. Needed to fetch global incident data and investigations.
private-intel:write: Private intel write scope.
ao: Execute and read workflows
playbook:read: Get playbook state. Needed to get full report information.
authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize
tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token
x-id:
- reitit.swagger/default