openapi: 3.2.0 info: title: Conure V1 API version: conure-218-1-ee422dee license: name: All Rights Reserved url: https://www.cisco.com contact: name: Cisco Security Business Group -- Advanced Threat email: cisco-intel-api-support@cisco.com description: XDR High Priority Incident and Investigation API x-provenance: method: harvested authored_by: Cisco XDR harvested_by: API Evangelist harvested_on: '2026-08-19' first_party: true provider_published: true source_host: visibility.amp.cisco.com note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine. x-evidence: - type: source url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json - type: source url: https://private.intel.amp.cisco.com/swagger.json tags: - name: v1 paths: /v1/incident-summary/search: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string summary: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data top_assets: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties maxItems: 5 required: - eventsCount - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - source - targets - top_assets required: - confidence - incident_time - status - id - groups - schema_version - type - summary application/transit+msgpack: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string summary: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data top_assets: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties maxItems: 5 required: - eventsCount - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - source - targets - top_assets required: - confidence - incident_time - status - id - groups - schema_version - type - summary application/transit+json: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string summary: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data top_assets: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties maxItems: 5 required: - eventsCount - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - source - targets - top_assets required: - confidence - incident_time - status - id - groups - schema_version - type - summary application/edn: schema: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string summary: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data top_assets: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties maxItems: 5 required: - eventsCount - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - source - targets - top_assets required: - confidence - incident_time - status - id - groups - schema_version - type - summary '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: query name: sort_by description: 'Sort result on fields. The following fields are supported: id, language, revision, schema_version, source, source_uri, timestamp, title, tlp Fields can be combined with '','' and sort order can be specified by '':asc'' and '':desc''. For example: - id # sort by id ascending - id:desc # sort by id descending - id,language:desc # sort by id ascending, then language descending' required: false schema: type: string - in: query name: sort_order description: '' required: false schema: type: string enum: - asc - desc - description: A integer greater than 0. name: offset title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - description: A integer greater than 0. name: limit title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - in: query name: search_after description: '' required: false x-anyOf: - type: array items: type: string - type: string allowEmptyValue: true schema: type: array items: type: string - in: query name: fields description: '' required: false x-anyOf: - type: array items: type: array items: type: string enum: - assignees - confidence - detection_sources - discovery_method - id - incident_time.opened - incident_time.discovered - incident_time.reported - incident_time.remediated - incident_time.closed - incident_time.rejected - intended_effect - language - meta - promotion_method - revision - schema_version - source - source_uri - status - timestamp - title - tlp - type: string allowEmptyValue: true schema: type: array items: type: array items: type: string enum: - assignees - confidence - detection_sources - discovery_method - id - incident_time.opened - incident_time.discovered - incident_time.reported - incident_time.remediated - incident_time.closed - incident_time.rejected - intended_effect - language - meta - promotion_method - revision - schema_version - source - source_uri - status - timestamp - title - tlp - in: query name: tlp description: '' required: false schema: type: string enum: - amber - green - red - white - in: query name: from description: '' required: false schema: type: string format: date-time - in: query name: to description: '' required: false schema: type: string format: date-time - in: query name: language description: '' required: false schema: type: string - in: query name: id description: '' required: false schema: type: string - in: query name: search_fields description: '' required: false x-anyOf: - type: array items: type: string enum: - id - short_description - title - source - description - type: string allowEmptyValue: true schema: type: array items: type: string enum: - id - short_description - title - source - description - in: query name: source description: '' required: false schema: type: string - in: query name: query description: '' required: false schema: type: string - in: query name: simple_query description: Query String with simple query format required: false schema: type: string - description: A integer greater than 0. name: revision title: PositiveInteger example: 2 required: false in: query schema: type: integer format: int64 minimum: 0 - in: query name: assignees description: '' required: false schema: type: string - in: query name: categories description: '' required: false schema: type: string - in: query name: confidence description: '' required: false schema: type: string - in: query name: detection_sources description: '' required: false schema: type: string - in: query name: discovery_method description: '' required: false schema: type: string - in: query name: high_impact description: '' required: false schema: type: boolean - in: query name: intended_effect description: '' required: false schema: type: string - in: query name: promotion_method description: '' required: false schema: type: string - in: query name: status description: The status of the incident required: false title: IncidentStatusType schema: type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' tags: - v1 summary: Incident Summary Search security: - JWT-Bearer: [] - oauth2: [] /v1/incident/{incident-id}/assets: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties application/transit+msgpack: schema: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties application/transit+json: schema: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties application/edn: schema: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: '' required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string tags: - v1 summary: Incident Assets security: - JWT-Bearer: [] - oauth2: [] /v1/incident/{incident-id}/summary: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 primaryInvestigation: type: object properties: id: type: - string - 'null' description: type: - string - 'null' short_description: type: - string - 'null' source: type: - string - 'null' required: - id - description - short_description - source firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data incident: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedIncidents: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedReferences: type: object properties: snapshotsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 incidentsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicatorsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 casebooksCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - snapshotsCount - incidentsCount - indicatorsCount - casebooksCount - totalCount linkedCasebooks: type: array items: type: object properties: bundle: type: object properties: id: type: string description: type: string attack_patterns: type: array items: type: object properties: {} assets: type: array items: type: object properties: {} asset_properties: type: array items: type: object properties: {} asset_mappings: type: array items: type: object properties: {} casebooks: type: array items: type: object properties: {} indicators: type: array items: type: object properties: {} judgements: type: array items: type: object properties: {} malwares: type: array items: type: object properties: {} modules: type: array items: type: object properties: {} relationships: type: array items: type: object properties: {} sightings: type: array items: type: object properties: {} verdicts: type: array items: type: object properties: {} tools: type: array items: type: object properties: {} texts: type: array items: type: object properties: text: type: string type: type: string required: - text - type observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - casebook timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - id - groups - schema_version - type source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data graph: {} required: - eventsCount - primaryInvestigation - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - incident - linkedIncidents - linkedReferences - linkedCasebooks - source - targets - graph application/transit+msgpack: schema: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 primaryInvestigation: type: object properties: id: type: - string - 'null' description: type: - string - 'null' short_description: type: - string - 'null' source: type: - string - 'null' required: - id - description - short_description - source firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data incident: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedIncidents: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedReferences: type: object properties: snapshotsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 incidentsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicatorsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 casebooksCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - snapshotsCount - incidentsCount - indicatorsCount - casebooksCount - totalCount linkedCasebooks: type: array items: type: object properties: bundle: type: object properties: id: type: string description: type: string attack_patterns: type: array items: type: object properties: {} assets: type: array items: type: object properties: {} asset_properties: type: array items: type: object properties: {} asset_mappings: type: array items: type: object properties: {} casebooks: type: array items: type: object properties: {} indicators: type: array items: type: object properties: {} judgements: type: array items: type: object properties: {} malwares: type: array items: type: object properties: {} modules: type: array items: type: object properties: {} relationships: type: array items: type: object properties: {} sightings: type: array items: type: object properties: {} verdicts: type: array items: type: object properties: {} tools: type: array items: type: object properties: {} texts: type: array items: type: object properties: text: type: string type: type: string required: - text - type observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - casebook timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - id - groups - schema_version - type source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data graph: {} required: - eventsCount - primaryInvestigation - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - incident - linkedIncidents - linkedReferences - linkedCasebooks - source - targets - graph application/transit+json: schema: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 primaryInvestigation: type: object properties: id: type: - string - 'null' description: type: - string - 'null' short_description: type: - string - 'null' source: type: - string - 'null' required: - id - description - short_description - source firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data incident: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedIncidents: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedReferences: type: object properties: snapshotsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 incidentsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicatorsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 casebooksCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - snapshotsCount - incidentsCount - indicatorsCount - casebooksCount - totalCount linkedCasebooks: type: array items: type: object properties: bundle: type: object properties: id: type: string description: type: string attack_patterns: type: array items: type: object properties: {} assets: type: array items: type: object properties: {} asset_properties: type: array items: type: object properties: {} asset_mappings: type: array items: type: object properties: {} casebooks: type: array items: type: object properties: {} indicators: type: array items: type: object properties: {} judgements: type: array items: type: object properties: {} malwares: type: array items: type: object properties: {} modules: type: array items: type: object properties: {} relationships: type: array items: type: object properties: {} sightings: type: array items: type: object properties: {} verdicts: type: array items: type: object properties: {} tools: type: array items: type: object properties: {} texts: type: array items: type: object properties: text: type: string type: type: string required: - text - type observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - casebook timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - id - groups - schema_version - type source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data graph: {} required: - eventsCount - primaryInvestigation - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - incident - linkedIncidents - linkedReferences - linkedCasebooks - source - targets - graph application/edn: schema: type: object properties: eventsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 primaryInvestigation: type: object properties: id: type: - string - 'null' description: type: - string - 'null' short_description: type: - string - 'null' source: type: - string - 'null' required: - id - description - short_description - source firstEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time lastEventDate: type: - string - 'null' x-anyOf: - type: string - type: string format: date-time indicators: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 producer: type: string source: type: - string - 'null' internal: type: boolean id: type: string value: type: string tags: type: - array - 'null' items: type: string required: - count - producer - source - internal - id - value - tags required: - totalCount - data mitreData: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - value - title - phase_name - count required: - totalCount - data observables: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string value: type: string required: - count - type - value required: - totalCount - data severity: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data incident: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedIncidents: type: array items: type: object properties: assignees: type: array items: type: string categories: type: array items: type: string enum: - Attrition - Denial of Service - Exercise - Exercise/Network Defense Testing - Explained Anomaly - Forensics - Improper Usage - Intelligence - Investigating - Investigation - Malicious Code - Malicious Logic - Non-Compliant - Reconnaissance - Root Level - Scans/Probes/Attempted Access - Unauthorized Access - Unsuccessful - User Level - eDiscovery confidence: type: string enum: - High - Info - Low - Medium - None - Unknown detection_sources: type: array items: type: string detection_status: title: DetectionStatusType type: string enum: - active - inactive_merged - inactive_expired - inactive_oversized - inactive_user_closed description: Whether the incident is actively receiving detection data updates discovery_method: type: string enum: - SecureX Threat Hunting - Agent Disclosure - Antivirus - Audit - Customer - External - Fraud Detection - Financial Audit - HIPS - IT Audit - Incident Response - Internal - Fraud Detection - Law Enforcement - Log Review - Monitoring Service - NIDS - Security Alarm - Unknown - Unrelated Party - User incident_time: type: object properties: opened: type: string closed: type: string discovered: type: string rejected: type: string remediated: type: string reported: type: string required: - opened intended_effect: type: string enum: - Account Takeover - Advantage - Advantage - Economic - Advantage - Military - Advantage - Political - Brand Damage - Competitive Advantage - Degradation of Service - Denial and Deception - Destruction - Disruption - Embarrassment - Exposure - Extortion - Fraud - Harassment - ICS Control - Theft - Theft - Credential Theft - Theft - Identity Theft - Theft - Intellectual Property - Theft - Theft of Proprietary Information - Traffic Diversion - Unauthorized Access meta: type: object properties: ai_description: type: boolean helios_report_generated: type: boolean promotion_method: type: string enum: - Automated - Manual scores: type: object properties: asset: type: integer format: int64 minimum: 0 maximum: 10 global: type: integer format: int64 minimum: 0 maximum: 1000 ml_score: type: number format: double ttp: type: integer format: int64 minimum: 0 maximum: 100 severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_id: type: string status: title: IncidentStatusType type: string enum: - New - Closed - 'Open: Recovered' - 'Closed: Other' - 'Hold: Internal' - 'Hold: Legal' - 'Closed: Under Review' - Rejected - Open - 'Closed: Merged' - Restoration Achieved - Incident Reported - 'Closed: Suspected' - Stalled - 'Open: Contained' - 'Closed: Near-Miss' - 'Hold: External' - Containment Achieved - 'New: Processing' - 'Closed: Confirmed Threat' - 'Closed: False Positive' - 'Open: Reported' - 'Open: Investigating' - Hold - 'New: Presented' description: The status of the incident tactics: type: array items: type: string techniques: type: array items: type: string description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - incident timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - confidence - incident_time - status - id - groups - schema_version - type linkedReferences: type: object properties: snapshotsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 incidentsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 indicatorsCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 casebooksCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - snapshotsCount - incidentsCount - indicatorsCount - casebooksCount - totalCount linkedCasebooks: type: array items: type: object properties: bundle: type: object properties: id: type: string description: type: string attack_patterns: type: array items: type: object properties: {} assets: type: array items: type: object properties: {} asset_properties: type: array items: type: object properties: {} asset_mappings: type: array items: type: object properties: {} casebooks: type: array items: type: object properties: {} indicators: type: array items: type: object properties: {} judgements: type: array items: type: object properties: {} malwares: type: array items: type: object properties: {} modules: type: array items: type: object properties: {} relationships: type: array items: type: object properties: {} sightings: type: array items: type: object properties: {} verdicts: type: array items: type: object properties: {} tools: type: array items: type: object properties: {} texts: type: array items: type: object properties: text: type: string type: type: string required: - text - type observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: type: string short_description: type: string source: type: string source_uri: type: string title: type: string language: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name external_ids: type: array items: type: string tlp: type: string enum: - amber - green - red - white id: type: string client_id: type: string modified: type: string format: date-time x-anyOf: - type: string format: date-time - type: string created: type: string format: date-time x-anyOf: - type: string format: date-time - type: string owner: type: - string - 'null' x-anyOf: - type: string - type: boolean groups: type: array items: type: string schema_version: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 type: type: string enum: - casebook timestamp: type: string format: date-time x-anyOf: - type: string format: date-time - type: string required: - id - groups - schema_version - type source: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string required: - count - value required: - totalCount - data targets: type: object properties: totalCount: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 data: type: array items: type: object properties: type: type: string count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 value: type: string asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: A integer greater than 0. example: 2 observableType: type: string observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true asset_id: type: - string - 'null' properties: type: array items: type: object properties: name: type: string value: type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: type: string required: - name - value uniqueItems: true required: - type - count - value - observableType - observables - asset_id - properties required: - totalCount - data graph: {} required: - eventsCount - primaryInvestigation - firstEventDate - lastEventDate - indicators - mitreData - observables - severity - incident - linkedIncidents - linkedReferences - linkedCasebooks - source - targets - graph '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: '' required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string tags: - v1 summary: Incident Summary security: - JWT-Bearer: [] - oauth2: [] /v1/incident/{incident-id}/events: get: responses: '405': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message application/edn: schema: type: object properties: message: type: string enum: - Method Not Allowed required: - message default: description: '' content: application/json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/transit+json: schema: type: object properties: message: type: string enum: - unspecified status required: - message application/edn: schema: type: object properties: message: type: string enum: - unspecified status required: - message '429': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Too many requests required: - message application/edn: schema: type: object properties: message: type: string enum: - Too many requests required: - message '401': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Unauthorized required: - message application/edn: schema: type: object properties: message: type: string enum: - Unauthorized required: - message '500': description: '' content: application/json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/transit+json: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message application/edn: schema: type: object properties: message: type: string enum: - exception - default exception - sql exception - JSON too large - schema - external_request exception: type: string example: SqlException data: example: example: Bad Request description: Any specific error information passed by custom errors. uri: type: string example: /global/v1/incident/?/incident-summary description: The URI the error was seen at required: - message '200': description: '' content: application/json: schema: type: object properties: events: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true title: type: - string - 'null' tlp: type: string enum: - amber - green - red - white notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' targets: type: array items: type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties relations: type: array items: type: object properties: origin: type: string relation: type: string related: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties source: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties origin_uri: type: string relation_info: {} required: - origin - relation - related - source observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ required: - confidence - count - id - observed_time - type - notable - original - targets - relations - observables required: - events application/transit+msgpack: schema: type: object properties: events: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true title: type: - string - 'null' tlp: type: string enum: - amber - green - red - white notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' targets: type: array items: type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties relations: type: array items: type: object properties: origin: type: string relation: type: string related: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties source: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties origin_uri: type: string relation_info: {} required: - origin - relation - related - source observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ required: - confidence - count - id - observed_time - type - notable - original - targets - relations - observables required: - events application/transit+json: schema: type: object properties: events: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true title: type: - string - 'null' tlp: type: string enum: - amber - green - red - white notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' targets: type: array items: type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties relations: type: array items: type: object properties: origin: type: string relation: type: string related: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties source: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties origin_uri: type: string relation_info: {} required: - origin - relation - related - source observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ required: - confidence - count - id - observed_time - type - notable - original - targets - relations - observables required: - events application/edn: schema: type: object properties: events: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 id: type: string x-anyOf: - type: string - type: string format: uuid observed_time: type: object properties: start_time: type: string end_time: type: - string - 'null' required: - start_time type: type: string enum: - sighting context: {} data: type: object properties: columns: type: array items: type: object properties: name: type: string type: type: string enum: - integer - markdown - number - observable - string - url description: type: - string - 'null' required: type: boolean short_description: type: - string - 'null' required: - name - type rows: type: array items: {} row_count: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 required: - columns - rows external_ids: type: array items: type: string external_references: type: array items: type: object properties: source_name: type: string hashes: type: array items: type: string url: type: string description: type: string external_id: type: string required: - source_name internal: type: boolean language: type: string revision: title: PositiveInteger type: integer format: int64 minimum: 0 description: A integer greater than 0. example: 2 resolution: type: string enum: - allowed - blocked - contained - detected sensor: type: string sensor_coordinates: type: object properties: observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value os: type: string type: type: string required: - observables - type severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown short_description: type: string source: type: string source_uri: type: string timestamp: type: string compacted_entities: type: array items: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition uniqueItems: true compacted_relations: type: array items: type: object properties: source: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition related: type: object properties: type: type: string is_asset: type: boolean observables: title: Entity.Observables type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true x-anyOf: - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition uniqueItems: true - type: array items: type: object properties: type: type: string value: type: string is_asset: type: boolean modules: type: array items: type: - string - 'null' uniqueItems: true sources: type: array items: type: - string - 'null' uniqueItems: true disposition: type: integer format: int64 investigated: type: boolean asset_id: type: string sightings: type: array items: type: string uniqueItems: true observed_times: type: array items: type: string uniqueItems: true required: - type - value - disposition description: Observables or Attributes for a grouped Entity value: type: string observableType: type: string disposition: type: integer format: int64 investigated: type: - boolean - 'null' count: type: integer format: int64 sightings: type: array items: type: string x-anyOf: - type: string - type: string format: uuid uniqueItems: true required: - type - value - disposition relation: type: string origin: type: string required: - source - related - relation uniqueItems: true title: type: - string - 'null' tlp: type: string enum: - amber - green - red - white notability: type: object properties: first_seen_target: type: object properties: label: type: string targets: type: array items: {} uniqueItems: true required: - label - targets severity: type: object properties: label: type: string required: - label mitre-attack: type: object properties: label: type: string required: - label first_seen_indicator: type: object properties: label: type: string indicators: type: array items: {} uniqueItems: true required: - label - indicators original_event: type: object properties: label: type: string required: - label mitreData: type: array items: type: object properties: id: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 value: type: string enum: - TA0004 - TA0010 - TA0005 - TA0001 - TA0009 - TA0002 - TA0040 - TA0043 - TA0011 - TA0008 - TA0042 - TA0006 - TA0007 - TA0003 phase_name: type: string enum: - privilege-escalation - exfiltration - defense-evasion - initial-access - collection - execution - impact - reconnaissance - command-and-control - lateral-movement - resource-development - credential-access - discovery - persistence priority: type: integer enum: - 6 - 12 - 7 - 3 - 10 - 4 - 13 - 1 - 11 - 9 - 2 - 8 - 8 - 5 url: type: string enum: - https://attack.mitre.org/tactics/TA0004/ - https://attack.mitre.org/tactics/TA0010/ - https://attack.mitre.org/tactics/TA0005/ - https://attack.mitre.org/tactics/TA0001/ - https://attack.mitre.org/tactics/TA0009/ - https://attack.mitre.org/tactics/TA0002/ - https://attack.mitre.org/tactics/TA0040/ - https://attack.mitre.org/tactics/TA0043/ - https://attack.mitre.org/tactics/TA0011/ - https://attack.mitre.org/tactics/TA0008/ - https://attack.mitre.org/tactics/TA0042/ - https://attack.mitre.org/tactics/TA0006/ - https://attack.mitre.org/tactics/TA0007/ - https://attack.mitre.org/tactics/TA0003/ title: type: string enum: - Privilege Escalation - Exfiltration - Defense Evasion - Initial Access - Collection - Execution - Impact - Reconnaissance - Command and Control - Lateral Movement - Resource Development - Credential Access - Discovery - Persistence required: - id - value - phase_name - priority - url - title uniqueItems: true notable: type: boolean original: type: boolean indicators: type: array items: type: object properties: id: type: string example: string description: Globally unique URI identifying this object. type: type: string enum: - indicator example: indicator description: The fixed value indicator schema_version: type: string example: 1.3.30 description: CTIM schema version for this entity. revision: type: integer format: int64 example: 10 description: A monotonically increasing revision, incremented each time the object is changed. external_ids: type: array items: type: string example: string example: - string description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners." external_references: type: array items: type: object properties: source_name: type: string example: string description: The source within which the external-reference is defined (system, registry, organization, etc.) description: type: string example: string description: Markdown string with at most 5000 characters. url: type: string example: string description: A URL reference to an external resource. hashes: type: array items: type: string example: string example: - string description: Specifies a dictionary of hashes for the contents of the url. external_id: type: string example: string description: An identifier for the external reference content. required: - source_name example: source_name: string description: string url: string hashes: - string external_id: string description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material. example: - source_name: string description: string url: string hashes: - string external_id: string description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier." timestamp: type: string format: date-time example: '2016-01-01T01:01:01Z' description: The time this object was created at, or last modified. language: type: string example: string description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages. For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents based on their potential impact. The `language` field can also be used to help with correlation of incidents across different systems and regions, as well as to help with data analysis and reporting.' tlp: type: string enum: - amber - green - red - white example: green description: 'TLP stands for [Traffic Light Protocol](https://www.us-cert.gov/tlp), which indicates precisely how a resource is intended to be shared, replicated, copied, etc. It is used to indicate the sensitivity of the information contained within the message. This allows recipients to determine the appropriate handling and dissemination of the information based on their clearance level and need-to-know. For example, an entity containing information about a critical vulnerability in a widely-used software might be marked as `red`, indicating that it should only be shared with a small group of highly trusted individuals who need to know in order to take appropriate action. On the other hand, a message containing more general information about security threats might be marked as `amber` or `green`, indicating that it can be shared more broadly within an organization.' title: type: string example: string description: A short title for this object, used as primary display and reference value. description: type: - string - 'null' example: string description: A description of object, which may be detailed. short_description: type: - string - 'null' example: string description: A single line, short summary of the object. source: type: - string - 'null' example: string description: Represents the source of the intelligence that led to the creation of the entity. source_uri: type: - string - 'null' example: string description: URI of the source of the intelligence that led to the creation of the entity. valid_time: type: object properties: start_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If not present, the valid time position of the indicator does not have an upper bound. end_time: type: string format: date-time example: '2016-01-01T01:01:01Z' description: If end_time is not present, then the valid time position of the object does not have an upper bound. example: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' description: The time range during which this Indicator is considered valid. producer: type: string example: string description: String with at most 1024 characters. severity: type: string enum: - Critical - High - Info - Low - Medium - None - Unknown example: Critical negate: type: boolean example: true description: Specifies the absence of the pattern. indicator_type: type: array items: type: string enum: - Anonymization - C2 - Compromised PKI Certificate - Domain Watchlist - Exfiltration - File Hash Watchlist - Host Characteristics - IMEI Watchlist - IMSI Watchlist - IP Watchlist - Login Name - Malicious E-mail - Malware Artifacts - Private Threat Feed - URL Watchlist example: Anonymization example: - Anonymization description: Specifies the type or types for this Indicator. tags: type: - array - 'null' items: type: string example: - string description: Descriptors for this indicator. composite_indicator_expression: type: object properties: operator: type: string enum: - and - not - or example: and indicator_ids: type: array items: type: string example: string description: A URI leading to an indicator. example: - string required: - operator - indicator_ids example: operator: and indicator_ids: - string likely_impact: type: string example: string description: Likely potential impact within the relevant context if this Indicator were to occur. confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High description: level of confidence held in the accuracy of this Indicator. kill_chain_phases: type: array items: type: object properties: kill_chain_name: type: string example: string description: The name of the kill chain. phase_name: type: string example: string description: The name of the phase in the kill chain. required: - kill_chain_name - phase_name example: kill_chain_name: string phase_name: string description: The kill-chain-phase represents a phase in a kill chain, which describes the various phases an attacker may undertake in order to achieve their objectives. example: - kill_chain_name: string phase_name: string description: Relevant kill chain phases indicated by this Indicator. test_mechanisms: type: array items: type: string example: string description: String with at most 2048 characters. example: - string description: Test Mechanisms effective at identifying the cyber Observables specified in this cyber threat Indicator. specification: type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. x-anyOf: - type: object properties: type: type: string enum: - Judgement example: Judgement judgements: type: array items: type: string example: string description: A URI leading to a judgement. example: - string required_judgements: type: array items: type: object properties: confidence: type: string enum: - High - Info - Low - Medium - None - Unknown example: High source: type: string example: string relationship: type: string example: string judgement_id: type: string example: string description: A URI leading to a judgement. required: - judgement_id example: confidence: High source: string relationship: string judgement_id: string example: - confidence: High source: string relationship: string judgement_id: string required: - type - judgements - required_judgements example: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: An indicator based on a list of judgements. If any of the Observables in it's judgements are encountered, than it may be matches against. If there are any required judgements, they all must be matched in order for the indicator to be considered a match. - type: object properties: type: type: string enum: - ThreatBrain example: ThreatBrain query: type: string example: string variables: type: array items: type: string example: string example: - string required: - type - variables example: type: ThreatBrain query: string variables: - string description: An indicator which runs in threatbrain... - type: object properties: type: type: string enum: - Snort example: Snort snort_sig: type: string example: string required: - type - snort_sig example: type: Snort snort_sig: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - SIOC example: SIOC SIOC: type: string example: string required: - type - SIOC example: type: SIOC SIOC: string description: An indicator which runs in snort... - type: object properties: type: type: string enum: - OpenIOC example: OpenIOC open_IOC: type: string example: string required: - type - open_IOC example: type: OpenIOC open_IOC: string description: An indicator which contains an XML blob of an openIOC indicator. value: title: Event.Indicator.Value type: string example: W32.AdditionVariableCommandObfuscation.ioc description: The canonical label for an indicator. required: - id - producer - value example: description: string tags: - string valid_time: start_time: '2016-01-01T01:01:01Z' end_time: '2016-01-01T01:01:01Z' producer: string schema_version: 1.3.30 revision: 10 type: indicator test_mechanisms: - string source: string external_ids: - string short_description: string composite_indicator_expression: operator: and indicator_ids: - string title: string likely_impact: string indicator_type: - Anonymization external_references: - source_name: string description: string url: string hashes: - string external_id: string source_uri: string language: string id: string severity: Critical tlp: green kill_chain_phases: - kill_chain_name: string phase_name: string negate: true timestamp: '2016-01-01T01:01:01Z' confidence: High specification: type: Judgement judgements: - string required_judgements: - confidence: High source: string relationship: string judgement_id: string description: 'An indicator is a test, or a collection of judgements that define criteria for identifying the activity, or presence of malware, or other unwanted software. We follow the [STiX IndicatorType](http://stixproject.github.io/data-model/1.2/indicator/IndicatorType/) closely, with the exception of not including observables within the indicator, and preferring a _specification_ object encoded in JSON as opposed to an opaque _implementation_ block. Additional, you will want to either define judgements against Observables that are linked to this indicator, with the ID in the _indicators_ field of those Judgements, or you can provide a _specification_ value.' investigationId: type: - string - 'null' investigationShortDescription: type: - string - 'null' investigationSource: type: - string - 'null' targets: type: array items: type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties relations: type: array items: type: object properties: origin: type: string relation: type: string related: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties source: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated x-anyOf: - type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated - type: object properties: actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. type: title: TargetTypeEnum type: string enum: - device - person - user - email - endpoint.sensor - process.network-scanner - network.switch - network.security_manager - process.vulnerability-scanner - network.hub - network.ids - network.firewall - process - network.sense_making - process.sandbox - network.modem - process.email-service - process.dns-server - network.vpn - process.connection-scanner - network.nic - endpoint.printer - network.gateway - process.reputation-service - process.remediation-service - network - process.virtualization-service - network.ips - endpoint.smart-meter - endpoint.digital-telephone-handset - endpoint.workstation - endpoint.server - network.wap - endpoint.laptop - process.aaa-server - process.directory-service - endpoint.pos-terminal - network.bridge - process.file-scanner - network.proxy - endpoint - process.location-service - network.sensor - endpoint.smart-phone - network.hips - process.anti-virus-scanner - endpoint.tablet - network.guard - network.router example: endpoint description: The targe type/actuator that best fits the device. value: title: TargetSummary.Value type: string example: CARGO-Example description: The targe type/actuator that best fits the device. asset_value: title: PositiveInteger type: - integer - 'null' format: int64 minimum: 0 description: The numerical value of the Device. Will Default to 10 if the Target is resolved. example: 2 default: 7 is_asset: title: TargetSummary.IsAssetEnum enum: - true type: boolean example: true description: Always true for targets. observableType: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The observable type of the defining target observable observables: title: TargetSummary.Observables type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value uniqueItems: true description: The observable type of the defining target observable asset_id: title: TargetSummary.AssetId type: - string - 'null' example: 4911bbf5-aa42-463b-9a47-65f24140cfe4 description: The Device/User Insights ID of this Person or Device. properties: title: TargetSummary.Properties type: array items: type: object properties: name: title: Property.Name type: string description: An open vocabulary string that describes the name of the property. example: cisco:ctr:labels value: title: Property.Value type: string x-anyOf: - type: string - type: integer format: int64 - type: array items: {} description: The value of the named property. example: - example label - 1 - - it can be a string or an int or a vector of anything required: - name - value uniqueItems: true description: The List of Device or Person properties for this resolved Person/Device. required: - type - value - is_asset - observableType - observables - asset_id - properties origin_uri: type: string relation_info: {} required: - origin - relation - related - source observables: type: array items: type: object properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. actions_taken: title: ActionsTaken type: array items: title: ActionTaken type: object properties: id: title: ActionTaken.Id type: uuid description: The ID of the Action Instance example: 6969efcd-825f-4146-bcb7-a42598c9f624 action: title: ActionTaken.Action type: string description: The direct action that was taken (blocked, quarantined ...) example: blocked description: title: ActionTaken.Description type: - string - 'null' example: A sha256 was quarantined during view Investigation. description: A string between 1 and 2500 characters representing the markdown content. reason: title: ActionTaken.Reason type: - string - 'null' example: Policy Disabled description: The reason for the failure source: title: ActionTaken.Source type: - string - 'null' example: Crowdstrike description: The source of the alert source_url: title: ActionTaken.SourceURL type: - string - 'null' example: Crowdstrike description: The product specific url of the alert started_at: title: ActionTaken.StartedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was triggered. example: '2026-08-18T22:03:26.573144903Z' completed_at: title: ActionTaken.CompletedAt type: - string - 'null' format: date-time x-anyOf: - type: string format: date-time - type: string description: The time the action was completed example: '2026-08-18T22:03:26.573166824Z' status: title: ActionTaken.Status type: string example: completed description: completed, failed, unknown observable: title: ActionTaken.Observable type: - object - 'null' properties: type: title: ObservableType type: string enum: - none - file_path - mac_address - trend_micro_id - cybereason_id - process_args - s1_agent_id - device - hostname - certificate_common_name - serial_number - meraki_network_id - url - jamf_management_id - certificate_serial - intune_id - meraki_org_id - cisco_cm_id - registry_key - process_path - darktrace_id - process_username - cortex_agent_id - orbital_node_id - process_uid - ngfw_name - user - certificate_issuer - ipv6 - email - cisco_uc_id - cvm_id - sha256 - crowdstrike_id - google_cloud_id - google_chromebook_id - acudid - sha1 - registry_name - md5 - service_now_id - ip - domain - email_subject - imei - ngfw_id - amp_computer_guid - ms_machine_id - secure_access_id - mutex - processor_id - swc_device_id - registry_path - odns_identity - odns_identity_label - cisco_mid - process_name - pki_serial - meraki_node_sn - email_messageid - imsi - user_agent - process_hash - file_name description: The type of the observable example: domain value: title: Observable.Value type: string example: ilo.brenz.pl description: The value of the observable. required: - type - value description: the process hash or file that was acted on count: title: ActionTaken.Count type: - integer - 'null' format: int64 description: The number of times this action was taken example: 1 required: - id - action - description - reason - source - source_url - started_at - completed_at - status description: An action reported by a data source or XDR Automation. description: The actions that were taken on a device, entity, or observable. disposition: title: DispositionEnum type: integer enum: - 1 - 2 - 3 - 4 - 5 example: 1 description: Disposition of the observable representing 1 - Clean, 2 - Malicious, 3 - Suspicious, 4 - Common, and 5 - Unknown. title: title: DecoratedObservable.Title type: string example: 1234...abcd description: A displayable (truncated) version of the value of this observable. internal: title: DecoratedObservable.Internal type: boolean example: true description: If this observable was seen in an internal event. sources: title: DecoratedObservable.Sources type: - array - 'null' items: type: string example: string description: String with at most 1024 characters. example: - Crowdstrike description: The sources that reported this observable is_asset: title: DecoratedObservable.IsAssetFalse enum: - false description: An Indicator if this is a Device or Target. example: false type: boolean investigated: title: Investigated type: boolean example: false description: If this specific observable was part of an investigation required: - type - value - disposition - title - is_asset - investigated tactics_and_techniques: type: array items: title: Mitre tactics and Techniques type: object properties: id: title: MitreID type: string example: TA0003 description: MITRE ATT&CK ID external_id: title: MitreExternalId type: string example: TA0003 description: MITRE ATT&CK ID title: title: MitreTitle type: string example: Persistence short_description: title: MitreShortDescription type: - string - 'null' example: Persistence description: title: MitreDescription type: string example: 'The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.' score: title: MitreScore type: - integer - 'null' format: int64 minimum: 1 maximum: 1000 example: 44 source_url: title: MitreSourceURL type: - string - 'null' example: https://attack.mitre.org/techniques/TA0003 description: The source url for this tactic or technique mitre_type: type: string enum: - tactic - technique - subtechnique required: - id - external_id - title - short_description - description - score - source_url - mitre_type description: A MITRE object from https://attack.mitre.org/ required: - confidence - count - id - observed_time - type - notable - original - targets - relations - observables required: - events '404': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Found required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Found required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Found required: - message '400': description: '' content: application/json: schema: type: object properties: message: {} required: - message application/transit+msgpack: schema: type: object properties: message: {} required: - message application/transit+json: schema: type: object properties: message: {} required: - message application/edn: schema: type: object properties: message: {} required: - message '403': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Forbidden required: - message application/edn: schema: type: object properties: message: type: string enum: - Forbidden required: - message '406': description: '' content: application/json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+msgpack: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/transit+json: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message application/edn: schema: type: object properties: message: type: string enum: - Not Acceptable required: - message parameters: - in: path name: incident-id description: '' required: true example: incident-0a38949f-d192-4d30-91ae-e593c1f57c14 schema: type: string tags: - v1 summary: Incident Events security: - JWT-Bearer: [] - oauth2: [] components: securitySchemes: JWT-Bearer: type: apiKey name: Authorization in: header oauth2: type: oauth2 flows: authorizationCode: scopes: event:read: Get event information for an org. Needed to get full report information. private-intel:read: Read data from private intel. Needed to get investigation data. private-intel: Full private intel integration scope. asset: Get Data from Device Insights. Needed during running investigations. enrich:read: Fetch Data about observables. Needed for investigations. integration:read: Get module information. Needed to create a new investigation. investigation: Run investigations. Needed for investigations. casebook: Full casebook management access. Allows read, write to casebooks. casebook:read: Read Casebook access global-intel:read: Read data from public intel. Needed to fetch global incident data and investigations. private-intel:write: Private intel write scope. ao: Execute and read workflows playbook:read: Get playbook state. Needed to get full report information. authorizationUrl: https://visibility.amp.cisco.com/iroh/oauth2/authorize tokenUrl: https://visibility.amp.cisco.com/iroh/oauth2/token x-id: - reitit.swagger/default